@@ -37,6 +37,8 @@ fi
WORK = " $( mktemp -d) "
cleanup( ) {
# 恢复默认搜索列表（构建期临时独占，见下）——失败路径也必须恢复
security list-keychains -d user -s login.keychain-db 2>/dev/null || true
security delete-keychain " $KEYCHAIN " 2>/dev/null || true
rm -rf " $WORK "
rm -f " $HOME /Library/MobileDevice/Provisioning Profiles/jiu-ci.mobileprovision " 2>/dev/null || true
@@ -53,10 +55,24 @@ security unlock-keychain -p "$KEYCHAIN_PWD" "$KEYCHAIN"
echo " ${ IOS_DIST_CERT_P12_BASE64 } " | base64 --decode > " $WORK /dist.p12 "
security import " $WORK /dist.p12 " -k " $KEYCHAIN " \
-P " ${ IOS_DIST_CERT_PASSWORD :- } " -T /usr/bin/codesign -T /usr/bin/security
# 补齐证书链：p12 只含叶子证书，独占搜索列表后 login 里的 Apple WWDR 中间证书
# 不可见会报 errSecInternalComponent(unable to build chain)——把本机已有的
# WWDR 中间证书（纯公钥）一并导入临时 keychain。
security find-certificate -a -c "Apple Worldwide Developer Relations" -p \
~/Library/Keychains/login.keychain-db /Library/Keychains/System.keychain \
> " $WORK /wwdr.pem " 2>/dev/null || true
if [ -s " $WORK /wwdr.pem " ] ; then
security import " $WORK /wwdr.pem " -k " $KEYCHAIN " -T /usr/bin/codesign 2>/dev/null || true
else
echo "WARN: 本机未找到 Apple WWDR 中间证书，签名可能报 unable to build chain" >& 2
fi
# 允许 codesign 非交互访问私钥
security set-key-partition-list -S apple-tool:,apple: -k " $KEYCHAIN_PWD " " $KEYCHAIN " >/dev/null
# 把临时 keychain 加入搜索列表（保留默认 login keychain）
security list-keychains -d user -s " $KEYCHAIN " login.keychain-db
# 构建期独占搜索列表（fastlane 同款）：只见临时 keychain，隔离本机其他项目的
# 同名「Apple Distribution」证书（2026-07-07 事故：login 里另一项目的新证书被
# xcodebuild 优先选中，与 Jiu App Store profile 不配对 → archive 失败）。
# trap cleanup 恢复 login，失败路径也不遗留。
security list-keychains -d user -s " $KEYCHAIN "
# --- 2. 安装 provisioning profile ---
PROFILES_DIR = " $HOME /Library/MobileDevice/Provisioning Profiles "
wangjia