aleleba/vectorcraft
1
0
Fork 0
mirror of https://github.com/storytold/vectorcraft.git synced 2026-10-28 11:47:21 -06:00
Code Issues Packages Projects Releases Wiki Activity

Security: private temp paths for the signing certificate and test output; web font licences stay inside the checkout (#3871)

Browse Source 
* Audit: private temp paths for the signing certificate and testkit output; confine web font licences to the checkout

* testkit: refuse a pre-made private temp directory this user cannot write to
This commit is contained in:
Dylan M. Taylor
2026-10-23 21:52:17 -04:00
committed by GitHub
parent 2541fd8efd
commit dad86afeee
3 changed files with 38 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packaging/macos/import-cert.sh
+4 -2
View File
@@ -19,10 +19,12 @@ fi
TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
KEYCHAIN="$TMP/vectorcraft-signing.keychain-db"
CERT="$TMP/vectorcraft-signing.p12"
# A fresh private directory, so a pre-made symlink in a shared $TMP cannot redirect the secret.
CERT_DIR="$(mktemp -d "$TMP/vectorcraft-signing.XXXXXX")"
CERT="$CERT_DIR/vectorcraft-signing.p12"
KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"
trap 'rm -f "$CERT"' EXIT
trap 'rm -rf "$CERT_DIR"' EXIT
printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT"
security create-keychain -p "$KC_PASS" "$KEYCHAIN"
security set-keychain-settings -lut 21600 "$KEYCHAIN"