Skip to content

emrg: pkg 签名补 Import step 早检 — find-certificate 校验 Developer ID Installer 证书（输出判空） #464

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
argszero merged 1 commit into from
Aug 6, 2026
Merged

emrg: pkg 签名补 Import step 早检 — find-certificate 校验 Developer ID Installer 证书（输出判空） #464

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/workflows/build-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,18 @@ jobs:
echo "::error::MACOS_SIGNING_P12_BASE64 未包含可签名私钥（security import 仅导入证书链）。请从 Keychain Access 导出含私钥的 p12（证书右键 → 导出 → 勾选\"包含私钥\"），重新 base64 后更新 GitHub Secret。import 输出：${IMPORT_OUTPUT}"
exit 1
fi
# pkg 签名证书存在性校验（v0.2.7 第 7 次构建根因：p12 只有 Developer ID
# Application 证书——签 .app 成功，但 productsign 签 pkg 需要独立的
# Developer ID Installer 证书，缺失报 "An installer signing identity (not
# an application signing identity) is required" 的 cryptic 错误）。
# 两种证书在 developer.apple.com → Certificates 分别创建，导出 p12 时
# 需同时勾选（或分别导出后合并）。find-certificate 不受 policy 限制。
# ⚠️ 必须用输出判空而非退出码：实测 find-certificate 无匹配证书时
# 也返回 exit 0（正反两态验证，#455 教训）。
if [ -z "$(security find-certificate -c 'Developer ID Installer' -a /tmp/ci.keychain 2>/dev/null)" ]; then
echo "::error::MACOS_SIGNING_P12_BASE64 缺少 Developer ID Installer 证书（pkg 签名必需）。Developer ID Application 只能签 .app，productsign 签 pkg 需要独立的 Developer ID Installer 证书。请在 developer.apple.com → Certificates 创建 Developer ID Installer（与 Application 是两张不同证书），连同私钥一起导出 p12 后更新 GitHub Secret。"
exit 1
fi
# set-key-partition-list 与 electron-builder macCodeSign.js 完全一致：
# security set-key-partition-list -S apple-tool:,apple: -s -k <password> <keychain>
# -s = Match keys that can sign（必须显式提供才能定位私钥项目）；
Expand Down
Loading