From aad2b788419ea3b44dbd02aecb7c35d308dd60c4 Mon Sep 17 00:00:00 2001
From: EMRG Evolution <emrg@argszero.dev>
Date: Thu, 6 Aug 2026 11:41:51 +0800
Subject: [PATCH] =?UTF-8?q?emrg:=20p12=20=E7=A7=81=E9=92=A5=E5=AD=98?=
 =?UTF-8?q?=E5=9C=A8=E6=80=A7=E6=A0=A1=E9=AA=8C=20=E2=80=94=20import=20?=
 =?UTF-8?q?=E8=BE=93=E5=87=BA=E8=A7=A3=E6=9E=90=20identity=20=E8=A1=8C?=
 =?UTF-8?q?=EF=BC=88v0.2.7=20=E6=A0=B9=E5=9B=A0=204/4=EF=BC=9Ap12=20?=
 =?UTF-8?q?=E4=BB=85=E8=AF=81=E4=B9=A6=E9=93=BE=E6=97=A0=E7=A7=81=E9=92=A5?=
 =?UTF-8?q?=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/build-release.yml | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 4a1af5c..a5e3540 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -69,8 +69,17 @@ jobs:
           security default-keychain -s /tmp/ci.keychain
           security set-keychain-settings -lut 21600 /tmp/ci.keychain
           security unlock-keychain -p 'ci-temp' /tmp/ci.keychain
-          security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
-            -T /usr/bin/codesign -T /usr/bin/productsign
+          # 私钥存在性校验（v0.2.7 根因：p12 仅证书链无私钥 → set-key-partition-list 报
+          # "SecItemCopyMatching: item not found" 的 cryptic 错误）。实测（macOS 本机）：
+          #   p12 含私钥 → "1 identity imported."；仅证书链 → "N certificates imported."（无 identity 行）
+          # import 输出捕获后校验 identity 行，缺失即明确报错，指引宿主重新导出含私钥的 p12。
+          IMPORT_OUTPUT="$(security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
+            -T /usr/bin/codesign -T /usr/bin/productsign 2>&1)"
+          echo "$IMPORT_OUTPUT"
+          if [[ "$IMPORT_OUTPUT" != *"identity imported"* ]]; then
+            echo "::error::MACOS_SIGNING_P12_BASE64 未包含可签名私钥（security import 仅导入证书链）。请从 Keychain Access 导出含私钥的 p12（证书右键 → 导出 → 勾选\"包含私钥\"），重新 base64 后更新 GitHub Secret。import 输出：${IMPORT_OUTPUT}"
+            exit 1
+          fi
           # set-key-partition-list 语法：[-S partition-list] [-k password] [match-options] [keychain]
           # -s = Match keys that can sign（匹配可签名私钥，必须显式提供才能定位项目）；
           # -S 后跟分区 ID 列表；-k 后跟 keychain 密码。