aleleba/deckcraft
1
0
Fork 0
mirror of https://github.com/storytold/deckcraft.git synced 2026-10-24 10:37:03 -06:00
Code Issues Packages Projects Releases Wiki Activity

security: use exclusive temporary directories for macOS cert import and media fixtures (#1263)

Browse Source
This commit is contained in:
Dylan M. Taylor
2026-10-24 04:40:26 -04:00
committed by GitHub
parent d94790d97a
commit 1e097e3edd
2 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/media/tests/fixtures/make.sh
Vendored
+6 -4
View File
@@ -28,11 +28,13 @@ for f in range(6):
sys.stdout.buffer.write(bytes(v for y in range(h) for x in range(w) for v in ((x * 4 + f * 20) % 256, (y * 5) % 256, (f * 40) % 256)))
" > "$out"
}
frames 64 48 /tmp/deckcraft-fixture-64x48.rgb
frames 64 64 /tmp/deckcraft-fixture-64x64.rgb
VID="-f rawvideo -pix_fmt rgb24 -s 64x48 -r 10 -i /tmp/deckcraft-fixture-64x48.rgb"
TMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/deckcraft-fixture.XXXXXX")"
trap 'rm -rf "$TMP_DIR"' EXIT
frames 64 48 "$TMP_DIR/deckcraft-fixture-64x48.rgb"
frames 64 64 "$TMP_DIR/deckcraft-fixture-64x64.rgb"
VID="-f rawvideo -pix_fmt rgb24 -s 64x48 -r 10 -i $TMP_DIR/deckcraft-fixture-64x48.rgb"
$FF $VID $TONE44 -c:v libx264 -pix_fmt yuv420p -g 5 -bf 2 -c:a aac -b:a 48k -shortest $META clip-h264.mp4
$FF $VID -c:v libx264 -pix_fmt yuv420p -g 5 -bf 0 $META clip-h264.mov
$FF $VID -c:v libx265 -pix_fmt yuv420p -x265-params log-level=error:keyint=5 -tag:v hvc1 $META clip-hevc.mp4
$FF $VID $TONE -c:v libvpx-vp9 -pix_fmt yuv420p -g 5 -b:v 100k -c:a libopus -b:a 32k -shortest $META clip-vp9.webm
$FF -f rawvideo -pix_fmt rgb24 -s 64x64 -r 10 -i /tmp/deckcraft-fixture-64x64.rgb -c:v libsvtav1 -pix_fmt yuv420p -g 5 -svtav1-params loglevel=0 $META clip-av1.mkv
$FF -f rawvideo -pix_fmt rgb24 -s 64x64 -r 10 -i "$TMP_DIR/deckcraft-fixture-64x64.rgb" -c:v libsvtav1 -pix_fmt yuv420p -g 5 -svtav1-params loglevel=0 $META clip-av1.mkv
packaging/macos/import-cert.sh
+6 -4
View File
@@ -17,12 +17,14 @@ if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
exit 0
fi
TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
KEYCHAIN="$TMP/deckcraft-signing.keychain-db"
CERT="$TMP/deckcraft-signing.p12"
TMP_BASE="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
TMP_DIR="$(mktemp -d "$TMP_BASE/deckcraft-cert.XXXXXX")"
chmod 0700 "$TMP_DIR"
KEYCHAIN="$TMP_DIR/deckcraft-signing.keychain-db"
CERT="$TMP_DIR/deckcraft-signing.p12"
KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
trap 'rm -f "$CERT"' EXIT
trap 'rm -rf "$TMP_DIR"' EXIT
printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
security create-keychain -p "$KC_PASS" "$KEYCHAIN"
security set-keychain-settings -lut 21600 "$KEYCHAIN"