mirror of
https://github.com/storytold/effectcraft.git
synced 2026-11-10 02:11:41 -06:00
Dylan M. Taylor
ec653f8a91
serve_dir stripped '..' and leading slashes but could still be steered
outside the dist folder ('/..//etc/passwd' left '//etc/passwd', which
join treats as absolute); it now keeps only normal path components. Each
connection's thread blocked forever on a silent client and thread creation
failure panicked; reads now time out and a failed spawn drops the
connection. import-cert.sh wrote the signing bundle to a predictable path
that another user could pre-create; mktemp makes it new and private. The
audio probe test trusted a predictable, possibly pre-existing scratch dir
for executables on PATH; it now creates a fresh private one. Ease Presets
looked up each loaded preset name in the whole list (quadratic); a name
set replaces it.
52 lines
2.3 KiB
Bash
Executable File
52 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# CI only: import the Developer ID certificate into a temporary keychain so codesign can use it.
|
|
#
|
|
# Inputs (env): APPLE_CERTIFICATE (base64 .p12), APPLE_CERTIFICATE_PASSWORD, KEYCHAIN_PASSWORD
|
|
# (optional; random if unset), RUNNER_TEMP (or TMPDIR).
|
|
# Outputs: MACOS_SIGN_IDENTITY (SHA-1 of the identity) and MACOS_KEYCHAIN, appended to
|
|
# $GITHUB_ENV when running in Actions, otherwise printed.
|
|
#
|
|
# Missing certificate: prints a warning and exits 0, so package.sh falls back to ad-hoc signing.
|
|
set -euo pipefail
|
|
umask 077
|
|
# shellcheck source=../env.sh
|
|
. "$(dirname "${BASH_SOURCE[0]}")/../env.sh"
|
|
|
|
if [[ -z "${APPLE_CERTIFICATE:-}" ]]; then
|
|
warn "APPLE_CERTIFICATE is not set: macOS builds will be ad-hoc signed and not notarized"
|
|
exit 0
|
|
fi
|
|
|
|
TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
|
|
KEYCHAIN="$TMP/effectcraft-signing.keychain-db"
|
|
# Created new and private (mode 0600) by mktemp, never an existing file someone else can read.
|
|
CERT="$(mktemp "$TMP/effectcraft-signing.XXXXXX")"
|
|
KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
|
|
|
|
trap 'rm -f "$CERT"' EXIT
|
|
printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
|
|
security create-keychain -p "$KC_PASS" "$KEYCHAIN"
|
|
security set-keychain-settings -lut 21600 "$KEYCHAIN"
|
|
security unlock-keychain -p "$KC_PASS" "$KEYCHAIN"
|
|
security import "$CERT" -P "${APPLE_CERTIFICATE_PASSWORD:-}" -T /usr/bin/codesign -T /usr/bin/security -t cert -f pkcs12 -k "$KEYCHAIN"
|
|
rm -f "$CERT"
|
|
# Let codesign use the key without a UI prompt.
|
|
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KC_PASS" "$KEYCHAIN" >/dev/null
|
|
# Put it on the search list (keeping the login keychain) so codesign and notarytool find it.
|
|
# shellcheck disable=SC2046
|
|
security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
|
|
|
|
IDENTITY="$(security find-identity -v -p codesigning "$KEYCHAIN" | awk '/Developer ID Application/ { print $2; exit }')"
|
|
if [[ -z "$IDENTITY" ]]; then
|
|
security find-identity -v -p codesigning "$KEYCHAIN" >&2
|
|
echo "error: no 'Developer ID Application' identity in APPLE_CERTIFICATE" >&2
|
|
exit 1
|
|
fi
|
|
echo "Imported signing identity $IDENTITY"
|
|
if [[ -n "${GITHUB_ENV:-}" ]]; then
|
|
{ echo "MACOS_SIGN_IDENTITY=$IDENTITY"; echo "MACOS_KEYCHAIN=$KEYCHAIN"; } >>"$GITHUB_ENV"
|
|
else
|
|
echo "MACOS_SIGN_IDENTITY=$IDENTITY"
|
|
echo "MACOS_KEYCHAIN=$KEYCHAIN"
|
|
fi
|