Skip to content

emrg: 修复 pkg 签名证书校验 — 需要 Developer ID Installer 证书（第 7 次构建 productsign cryptic 错误根因） #463

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
argszero wants to merge 1 commit into from
Closed

emrg: 修复 pkg 签名证书校验 — 需要 Developer ID Installer 证书（第 7 次构建 productsign cryptic 错误根因） #463

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions .github/workflows/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,34 @@ security import 你的证书.p12 -k /tmp/test.keychain -P 密码
base64 < 含私钥的证书.p12 # 输出结果整段复制为 MACOS_SIGNING_P12_BASE64
```

## ⚠️ 需要两种证书：Developer ID Application + Developer ID Installer（v0.2.7 第 7 次构建教训）

**现象**：第 7 次构建（#461 修复私钥校验后）在 `Sign pkg` 步骤报：
```
productsign: error: Could not find appropriate signing identity for "***".
An installer signing identity (not an application signing identity) is required for signing flat-style products.
```

**根因**：macOS 代码签名需要**两种不同证书**，缺一不可：
| 证书类型 | 用途 | 产物 |
|---|---|---|
| `Developer ID Application` | 签名 .app（electron-builder codesign） | GUI 应用本体 |
| `Developer ID Installer` | 签名 .pkg（productsign） | 安装包 |

p12 若只有 Application 证书：.app 签名成功，但 productsign 报 cryptic 错误——CI 已在 import 步骤加显式校验（#462），缺失时明确报错。

**获取 Installer 证书**（developer.apple.com → Certificates → + → Software → **Developer ID Installer**）：
1. 在开发者门户创建 Developer ID Installer 证书（与 Application 是两张不同的证书，需分别申请）
2. 下载 .cer 双击导入钥匙串
3. 导出 p12 时**同时勾选两张证书**（或分别导出后合并）——`security export -t identities` 会导出所有 identity

**验证 p12 含两种证书**：
```bash
security import 你的证书.p12 -k /tmp/test.keychain -P 密码
security find-certificate -c "Developer ID Installer" -a /tmp/test.keychain # 必须能找到
security find-certificate -c "Developer ID Application" -a /tmp/test.keychain # 必须能找到
```

## 降级行为

- **Secret 未配置**（空字符串）：对应步骤跳过，构建不失败（不签名、不公证）。
Expand Down
20 changes: 19 additions & 1 deletion .github/workflows/build-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,16 @@ jobs:
echo "::error::MACOS_SIGNING_P12_BASE64 未包含可签名私钥（security import 仅导入证书链）。请从 Keychain Access 导出含私钥的 p12（证书右键 → 导出 → 勾选\"包含私钥\"），重新 base64 后更新 GitHub Secret。import 输出：${IMPORT_OUTPUT}"
exit 1
fi
# pkg 签名证书存在性校验（v0.2.7 第 7 次构建根因：p12 只有 Developer ID
# Application 证书——签 .app 成功，但 productsign 签 pkg 需要独立的
# Developer ID Installer 证书，缺失报 "An installer signing identity (not
# an application signing identity) is required" 的 cryptic 错误）。
# 两种证书在 developer.apple.com → Certificates 分别创建，导出 p12 时
# 需同时勾选（或分别导出后合并）。
if ! security find-certificate -c "Developer ID Installer" -a /tmp/ci.keychain >/dev/null 2>&1; then
echo "::error::MACOS_SIGNING_P12_BASE64 缺少 Developer ID Installer 证书（pkg 签名必需）。Developer ID Application 只能签 .app，productsign 签 pkg 需要独立的 Developer ID Installer 证书。请在 developer.apple.com → Certificates 创建 Developer ID Installer（与 Application 是两张不同证书），连同私钥一起导出 p12 后更新 GitHub Secret。"
exit 1
fi
# set-key-partition-list 与 electron-builder macCodeSign.js 完全一致：
# security set-key-partition-list -S apple-tool:,apple: -s -k <password> <keychain>
# -s = Match keys that can sign（必须显式提供才能定位私钥项目）；
Expand Down Expand Up @@ -152,7 +162,15 @@ jobs:
run: |
PKG="$(find dist/artifacts -maxdepth 1 -name 'EMRG-*-macos-*.pkg' | head -1)"
if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
productsign --sign "$MACOS_SIGNING_IDENTITY" "$PKG" "${PKG}.signed"
# productsign 需要 Developer ID Installer 证书（非 Application）。
# 从已导入的临时 keychain 自动探测 Installer 身份，避免使用
# MACOS_SIGNING_IDENTITY（Application）导致 productsign 报 cryptic 错误。
INSTALLER_ID="$(security find-identity -v -p codesigning /tmp/ci.keychain | grep -o 'Developer ID Installer: [^"]*' | head -1)"
if [ -z "$INSTALLER_ID" ]; then
echo "::error::临时 keychain 未找到 Developer ID Installer 身份（pkg 签名必需）。请检查 p12 是否包含 Developer ID Installer 证书。"
exit 1
fi
productsign --sign "$INSTALLER_ID" "$PKG" "${PKG}.signed"
mv "${PKG}.signed" "$PKG"
# P3 验证：证书存在时签名必须成功（rant 验收：pkgutil 显示 signed by Developer ID）
pkgutil --check-signature "$PKG"
Expand Down
Loading