Skip to content

emrg: macOS 签名 import 后加私钥存在性检查 — p12 仅证书链时明确报错（R88 根因定位） #455

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
argszero wants to merge 2 commits into from
Closed

emrg: macOS 签名 import 后加私钥存在性检查 — p12 仅证书链时明确报错（R88 根因定位） #455

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
09a5964
emrg: 诊断 — Import signing 加 p12/keychain 诊断输出（set-key-partition-list …
argszero Aug 6, 2026
fa537a5
emrg: macOS 签名 import 后加私钥存在性检查 — p12 仅证书链时明确报错（R88 根因定位）
argszero Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .github/workflows/build-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,16 @@ jobs:
security unlock-keychain -p 'ci-temp' /tmp/ci.keychain
security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
-T /usr/bin/codesign -T /usr/bin/productsign
# ── 私钥存在性检查（R88 根因：p12 仅证书链无私钥 → SecItemCopyMatching item not found）──
# 有效签名 p12 应报 "1 identity imported"（含私钥）；仅证书链报 "N certificates imported"。
# find-identity 0 valid + 私钥数 0 → p12 无签名身份，签名必失败，明确报错而非 cryptic 错误。
KEY_COUNT="$(security dump-keychain /tmp/ci.keychain 2>&1 | grep -c 'class: 0x0000000F' || true)"
IDENTITY_COUNT="$(security find-identity -v -p codesigning /tmp/ci.keychain 2>/dev/null | grep -c 'valid identities found' || true)"
echo "诊断: keychain 私钥数=${KEY_COUNT}, find-identity 输出行数=${IDENTITY_COUNT}"
if [ "$KEY_COUNT" = "0" ]; then
echo "::error::MACOS_SIGNING_P12_BASE64 未包含可签名私钥（import 仅导入证书链，无私钥）。请从钥匙串导出含私钥的 p12：Keychain Access → 右键证书 → 导出 → 格式 p12（勾选包含私钥），然后 base64 更新 GitHub secret。"
exit 1
fi
# set-key-partition-list 语法：[-S partition-list] [-k password] [match-options] [keychain]
# -s = Match keys that can sign（匹配可签名私钥，必须显式提供才能定位项目）；
# -S 后跟分区 ID 列表；-k 后跟 keychain 密码。
Expand Down
Loading