From ab6ca89064ad63c334a088c835bcbe9126a54fab Mon Sep 17 00:00:00 2001 From: wangjia <809946525@qq.com> Date: Wed, 17 Jun 2026 13:39:25 +0800 Subject: [PATCH] =?UTF-8?q?ci:=20=E5=88=87=E5=9B=9E=E5=AE=8C=E6=95=B4?= =?UTF-8?q?=E7=AD=BE=E5=90=8D+=E5=85=AC=E8=AF=81=E9=AA=8C=E8=AF=81?= =?UTF-8?q?=EF=BC=88API=20key=20=E5=B7=B2=E4=BF=AE=E5=A4=8D=E5=90=8E?= =?UTF-8?q?=E5=A4=8D=E9=AA=8C=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/verify-macos-signing.yml | 69 +++++++++++++++-------- 1 file changed, 44 insertions(+), 25 deletions(-) diff --git a/.gitea/workflows/verify-macos-signing.yml b/.gitea/workflows/verify-macos-signing.yml index 6cc984c..55e541a 100644 --- a/.gitea/workflows/verify-macos-signing.yml +++ b/.gitea/workflows/verify-macos-signing.yml @@ -1,5 +1,6 @@ -# 临时诊断 workflow —— 只检查 App Store Connect API key (.p8) 的 PEM 合法性，不编译。 -# 不打印密钥本体，仅输出 PEM 头尾/字节数/openssl 解析结果。验证后删除。 +# 临时验证 workflow —— 仅验证 macOS 签名+公证链路，不发版、不部署。 +# 触发：push 到 verify-macos-signing 分支。验证通过后连同本文件与分支一并删除。 +# host 模式 runner 以本机用户身份运行，把验证输出写到固定宿主路径，便于本地读取结果。 name: Verify macOS Signing on: @@ -8,35 +9,53 @@ on: - verify-macos-signing jobs: - diag-apikey: + verify-macos: runs-on: mac + env: + PUB_HOSTED_URL: https://pub.flutter-io.cn + FLUTTER_STORAGE_BASE_URL: https://storage.flutter-io.cn + RESULT_FILE: /Users/wangjia/.cache/jiu-verify-result.txt + steps: - - name: Diagnose API key (.p8) — no secret leakage + - uses: actions/checkout@v4 + + - name: Reset result file + run: | + mkdir -p /Users/wangjia/.cache + echo "=== verify-macos-signing run @ $(date) ===" > "$RESULT_FILE" + + - name: Provision (idempotent) + run: sh scripts/ci/provision-mac.sh + + - name: Compile + sign + notarize (Flutter macOS) env: + MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_CERT_P12_BASE64 }} + MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_CERT_PASSWORD }} APPSTORE_API_KEY_ID: ${{ secrets.APPSTORE_API_KEY_ID }} APPSTORE_API_ISSUER_ID: ${{ secrets.APPSTORE_API_ISSUER_ID }} APPSTORE_API_KEY_P8_BASE64: ${{ secrets.APPSTORE_API_KEY_P8_BASE64 }} - MACOS_DEVELOPER_ID_CERT_P12_BASE64: ${{ secrets.MACOS_DEVELOPER_ID_CERT_P12_BASE64 }} - MACOS_DEVELOPER_ID_CERT_PASSWORD: ${{ secrets.MACOS_DEVELOPER_ID_CERT_PASSWORD }} run: | - mkdir -p /Users/wangjia/.cache - RF=/Users/wangjia/.cache/jiu-verify-result.txt + set -o pipefail + sh scripts/ci/compile-macos.sh "client-v0.0.0" 2>&1 | tee -a "$RESULT_FILE" + + - name: Assert + persist proof + if: always() + run: | + APP="client/build/macos/Build/Products/Release/jiu_client.app" { - echo "=== diag @ $(date) ===" - echo "KEY_ID set=$([ -n "$APPSTORE_API_KEY_ID" ] && echo "yes(${#APPSTORE_API_KEY_ID})" || echo NO)" - echo "ISSUER set=$([ -n "$APPSTORE_API_ISSUER_ID" ] && echo "yes(${#APPSTORE_API_ISSUER_ID})" || echo NO)" - echo "P8_B64 set=$([ -n "$APPSTORE_API_KEY_P8_BASE64" ] && echo "yes(${#APPSTORE_API_KEY_P8_BASE64})" || echo NO)" - echo "P12_B64 set=$([ -n "$MACOS_DEVELOPER_ID_CERT_P12_BASE64" ] && echo "yes(${#MACOS_DEVELOPER_ID_CERT_P12_BASE64})" || echo NO)" - echo "P12_PWD set=$([ -n "$MACOS_DEVELOPER_ID_CERT_PASSWORD" ] && echo yes || echo NO)" - echo "--- decode .p8 ---" - printf '%s' "$APPSTORE_API_KEY_P8_BASE64" | base64 --decode > /tmp/diag.p8 2>/tmp/diag.err - echo "decode_rc=$? bytes=$(wc -c < /tmp/diag.p8 | tr -d ' ')" - echo "decode_err=$(cat /tmp/diag.err)" - echo "first_line=[$(head -1 /tmp/diag.p8)]" - echo "last_line=[$(tail -1 /tmp/diag.p8)]" - echo "has_CR=$(LC_ALL=C grep -c $'\r' /tmp/diag.p8 2>/dev/null || echo 0)" - echo "line_count=$(wc -l < /tmp/diag.p8 | tr -d ' ')" - openssl pkcs8 -nocrypt -in /tmp/diag.p8 -inform PEM -out /dev/null 2>&1 && echo "OPENSSL_PKCS8_OK" || echo "OPENSSL_PKCS8_FAILED" - rm -f /tmp/diag.p8 /tmp/diag.err + echo "" + echo "=== ASSERT @ $(date) ===" + if [ -d "$APP" ]; then + echo "-- codesign --verify --" + codesign --verify --deep --strict --verbose=2 "$APP" 2>&1 && echo "CODESIGN_VERIFY_OK" || echo "CODESIGN_VERIFY_FAILED" + echo "-- codesign -dvvv (Authority/Team/flags) --" + codesign -dvvv "$APP" 2>&1 | grep -E "Authority|TeamIdentifier|flags|Timestamp" || true + echo "-- stapler validate --" + xcrun stapler validate "$APP" 2>&1 && echo "STAPLE_OK" || echo "STAPLE_INVALID" + echo "-- spctl assessment --" + spctl -a -vvv -t install "$APP" 2>&1 && echo "SPCTL_ACCEPTED" || echo "SPCTL_REJECTED" + else + echo "APP_NOT_BUILT (compile/sign/notarize 步骤已失败，见上方日志)" + fi echo "=== END @ $(date) ===" - } > "$RF" 2>&1 + } >> "$RESULT_FILE" 2>&1