Skip to content

emrg: p12 私钥存在性校验 — import 输出解析 identity 行（v0.2.7 根因 4/4：p12 仅证书链无私钥） #456

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
argszero merged 2 commits into from
Aug 6, 2026
Merged

emrg: p12 私钥存在性校验 — import 输出解析 identity 行（v0.2.7 根因 4/4：p12 仅证书链无私钥） #456

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aad2b78
emrg: p12 私钥存在性校验 — import 输出解析 identity 行（v0.2.7 根因 4/4：p12 仅证书链无私钥）
Aug 6, 2026
cee7fb7
emrg: merge master (#454 分区对齐) — 保留私钥校验 + 标准分区列表
Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions .github/workflows/build-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,8 +69,17 @@ jobs:
security default-keychain -s /tmp/ci.keychain
security set-keychain-settings -lut 21600 /tmp/ci.keychain
security unlock-keychain -p 'ci-temp' /tmp/ci.keychain
security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
-T /usr/bin/codesign -T /usr/bin/productsign
# 私钥存在性校验（v0.2.7 根因：p12 仅证书链无私钥 → set-key-partition-list 报
# "SecItemCopyMatching: item not found" 的 cryptic 错误）。实测（macOS 本机）：
# p12 含私钥 → "1 identity imported."；仅证书链 → "N certificates imported."（无 identity 行）
# import 输出捕获后校验 identity 行，缺失即明确报错，指引宿主重新导出含私钥的 p12。
IMPORT_OUTPUT="$(security import /tmp/signing.p12 -k /tmp/ci.keychain -P "$MACOS_SIGNING_P12_PASSWORD" \
-T /usr/bin/codesign -T /usr/bin/productsign 2>&1)"
echo "$IMPORT_OUTPUT"
if [[ "$IMPORT_OUTPUT" != *"identity imported"* ]]; then
echo "::error::MACOS_SIGNING_P12_BASE64 未包含可签名私钥（security import 仅导入证书链）。请从 Keychain Access 导出含私钥的 p12（证书右键 → 导出 → 勾选\"包含私钥\"），重新 base64 后更新 GitHub Secret。import 输出：${IMPORT_OUTPUT}"
exit 1
fi
# set-key-partition-list 与 electron-builder macCodeSign.js 完全一致：
# security set-key-partition-list -S apple-tool:,apple: -s -k <password> <keychain>
# -s = Match keys that can sign（必须显式提供才能定位私钥项目）；
Expand Down
Loading