opencode/yao
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactor Makefile to update certificate verification and remove importing private key

Browse source
This commit is contained in:
Max 2024-09-28 10:29:23 +08:00
parent bbaa0ee62c
commit ab188c9a5e
2 changed files with 23 additions and 56 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
.github/workflows/build-macos.yml vendored
View file

@ -109,15 +109,34 @@ jobs:
mv dist/release/yao-$VERSION-dev-darwin-amd64 dist/release/yao-$VERSION-unstable-darwin-amd64
- name: Install Certificates
env:
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
run: |
mkdir -p certs
echo "${{ secrets.APPLE_DEVELOPERIDG2CA }}" | base64 --decode > certs/DeveloperIDG2CA.cer
echo "${{ secrets.APPLE_DISTRIBUTION }}" | base64 --decode > certs/distribution.cer
echo "${{ secrets.APPLE_DEVELOPERIDG2CA }}" | base64 --decode > certs/DeveloperIDG2CA.cer
echo "${{ secrets.APPLE_DISTRIBUTION }}" | base64 --decode > certs/distribution.cer
echo "${{ secrets.APPLE_PRIVATE_KEY }}" | base64 --decode > certs/private_key.p12
security verify-cert -c certs/DeveloperIDG2CA.cer
security verify-cert -c certs/distribution.cer
- name: Import Certificates
run: |
security import ./certs/DeveloperIDG2CA.cer -k ~/Library/Keychains/login.keychain-db -T /usr/bin/codesign
security import ./certs/distribution.cer -k ~/Library/Keychains/login.keychain-db -T /usr/bin/codesign
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
# create temporary keychain
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
# import certificate to keychain
security import ./certs/DeveloperIDG2CA.cer -k $KEYCHAIN_PATH -T /usr/bin/codesign
security import ./certs/distribution.cer -k $KEYCHAIN_PATH -T /usr/bin/codesign
# import private key to keychain
security import ./certs/private_key.p12 -k $KEYCHAIN_PATH -P "${{ secrets.APPLE_PRIVATE_KEY_PASSWORD }}" -T /usr/bin/codesign
security list-keychain -d user -s $KEYCHAIN_PATH
- name: Sign Artifacts
run: |

52
.github/workflows/debug-macos.yml vendored
View file

@ -1,52 +0,0 @@
name: Apple Sign debug
on:
workflow_dispatch:
inputs:
tags:
description: "Version tags"
env:
VERSION: 0.9.0
jobs:
build:
strategy:
matrix:
go: [1.21.1]
runs-on: "macos-12"
steps:
- name: Install Certificates
env:
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
run: |
mkdir -p certs
echo "${{ secrets.APPLE_DEVELOPERIDG2CA }}" | base64 --decode > certs/DeveloperIDG2CA.cer
echo "${{ secrets.APPLE_DISTRIBUTION }}" | base64 --decode > certs/distribution.cer
echo "${{ secrets.APPLE_PRIVATE_KEY }}" | base64 --decode > certs/private_key.p12
security verify-cert -c certs/DeveloperIDG2CA.cer
security verify-cert -c certs/distribution.cer
- name: Import Certificates
run: |
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
# create temporary keychain
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
# import certificate to keychain
security import ./certs/DeveloperIDG2CA.cer -k $KEYCHAIN_PATH -T /usr/bin/codesign
security import ./certs/distribution.cer -k $KEYCHAIN_PATH -T /usr/bin/codesign
# import private key to keychain
security import ./certs/private_key.p12 -k $KEYCHAIN_PATH -P "${{ secrets.APPLE_PRIVATE_KEY_PASSWORD }}" -T /usr/bin/codesign
security list-keychain -d user -s $KEYCHAIN_PATH
- name: Check Certificates
run: |
security find-identity -v -p codesigning
security find-identity -p codesigning