From 543fb060db366871933fb72fcdb90de2d39ebd64 Mon Sep 17 00:00:00 2001 From: TimeToBuildBob Date: Wed, 1 Jul 2026 17:05:24 +0000 Subject: [PATCH 1/2] fix(ci): resolve macOS codesign identity from imported cert --- .github/workflows/release.yml | 16 ++++++++++++++-- scripts/ci/import-macos-p12.sh | 32 ++++++++++++++++---------------- 2 files changed, 30 insertions(+), 18 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3af7b1caa..c9092255e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -368,6 +368,12 @@ jobs: run: | if [ -n "$APPLE_EMAIL" ]; then ./scripts/ci/import-macos-p12.sh + APPLE_PERSONALID=$(security find-identity -v -p codesigning "${KEY_CHAIN:-build.keychain-db}" | sed -n 's/.*"\\(.*\\)"/\\1/p' | head -1) + if [ -z "$APPLE_PERSONALID" ]; then + echo "ERROR: no codesigning identity found after importing the macOS certificate" >&2 + exit 1 + fi + export APPLE_PERSONALID fi source venv/bin/activate @@ -386,7 +392,7 @@ jobs: env: APPLE_EMAIL: ${{ secrets.APPLE_EMAIL }} APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} - APPLE_PERSONALID: ${{ secrets.APPLE_TEAMID }} + APPLE_PERSONALID: "" APPLE_TEAMID: ${{ secrets.APPLE_TEAMID }} CERTIFICATE_MACOS_P12_BASE64: ${{ secrets.CERTIFICATE_MACOS_P12_BASE64 }} CERTIFICATE_MACOS_P12_PASSWORD: ${{ secrets.CERTIFICATE_MACOS_P12_PASSWORD }} @@ -586,6 +592,12 @@ jobs: run: | if [ -n "$APPLE_EMAIL" ]; then ./scripts/ci/import-macos-p12.sh + APPLE_PERSONALID=$(security find-identity -v -p codesigning "${KEY_CHAIN:-build.keychain-db}" | sed -n 's/.*"\\(.*\\)"/\\1/p' | head -1) + if [ -z "$APPLE_PERSONALID" ]; then + echo "ERROR: no codesigning identity found after importing the macOS certificate" >&2 + exit 1 + fi + export APPLE_PERSONALID fi source venv/bin/activate @@ -604,7 +616,7 @@ jobs: env: APPLE_EMAIL: ${{ secrets.APPLE_EMAIL }} APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }} - APPLE_PERSONALID: ${{ secrets.APPLE_TEAMID }} + APPLE_PERSONALID: "" APPLE_TEAMID: ${{ secrets.APPLE_TEAMID }} CERTIFICATE_MACOS_P12_BASE64: ${{ secrets.CERTIFICATE_MACOS_P12_BASE64 }} CERTIFICATE_MACOS_P12_PASSWORD: ${{ secrets.CERTIFICATE_MACOS_P12_PASSWORD }} diff --git a/scripts/ci/import-macos-p12.sh b/scripts/ci/import-macos-p12.sh index 83ded454f..e79288929 100755 --- a/scripts/ci/import-macos-p12.sh +++ b/scripts/ci/import-macos-p12.sh @@ -1,23 +1,23 @@ #!/bin/sh -set -e +set -eu -# Source: https://www.update.rocks/blog/osx-signing-with-travis/ -export KEY_CHAIN=build.keychain -export CERTIFICATE_P12=aw_certificate.p12 +export KEY_CHAIN="${KEY_CHAIN:-build.keychain-db}" +export CERTIFICATE_P12="${CERTIFICATE_P12:-aw_certificate.p12}" -# Recreate the certificate from the secure environment variable -echo $CERTIFICATE_MACOS_P12_BASE64 | base64 --decode > $CERTIFICATE_P12 +# Recreate the certificate from the secure environment variable. +printf '%s' "$CERTIFICATE_MACOS_P12_BASE64" | base64 --decode > "$CERTIFICATE_P12" -#create a keychain -security -v create-keychain -p travis $KEY_CHAIN -# Make the keychain the default so identities are found -security -v default-keychain -s $KEY_CHAIN -# Unlock the keychain -security -v unlock-keychain -p travis $KEY_CHAIN +# Recreate the temporary keychain on every run so stale state cannot leak between jobs. +security -v delete-keychain "$KEY_CHAIN" >/dev/null 2>&1 || true +security -v create-keychain -p travis "$KEY_CHAIN" +security -v default-keychain -s "$KEY_CHAIN" +security -v unlock-keychain -p travis "$KEY_CHAIN" +security -v set-keychain-settings -lut 21600 "$KEY_CHAIN" +security -v list-keychains -d user -s "$KEY_CHAIN" login.keychain-db login.keychain -security -v import $CERTIFICATE_P12 -k $KEY_CHAIN -P $CERTIFICATE_MACOS_P12_PASSWORD -A -security -v set-key-partition-list -S apple-tool:,apple: -s -k travis $KEY_CHAIN +security -v import "$CERTIFICATE_P12" -k "$KEY_CHAIN" -P "$CERTIFICATE_MACOS_P12_PASSWORD" -A +security -v set-key-partition-list -S apple-tool:,apple: -s -k travis "$KEY_CHAIN" +security -v find-identity -v -p codesigning "$KEY_CHAIN" -# remove certs -rm -rf *.p12 +rm -f "$CERTIFICATE_P12" From 025593ae8a85bd85bb7e9a420165faf499d35bb3 Mon Sep 17 00:00:00 2001 From: Bob Date: Wed, 1 Jul 2026 17:29:48 +0000 Subject: [PATCH 2/2] fix(ci): quote macOS codesign identity --- .github/workflows/release.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c9092255e..d42be965f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -368,7 +368,7 @@ jobs: run: | if [ -n "$APPLE_EMAIL" ]; then ./scripts/ci/import-macos-p12.sh - APPLE_PERSONALID=$(security find-identity -v -p codesigning "${KEY_CHAIN:-build.keychain-db}" | sed -n 's/.*"\\(.*\\)"/\\1/p' | head -1) + APPLE_PERSONALID=$(security find-identity -v -p codesigning "${KEY_CHAIN:-build.keychain-db}" | sed -n 's/.*"\(.*\)"/\1/p' | head -1) if [ -z "$APPLE_PERSONALID" ]; then echo "ERROR: no codesigning identity found after importing the macOS certificate" >&2 exit 1 @@ -380,7 +380,7 @@ jobs: make dist/ActivityWatch.dmg if [ -n "$APPLE_EMAIL" ]; then - codesign --force --verbose --timestamp -s ${APPLE_PERSONALID} dist/ActivityWatch.dmg + codesign --force --verbose --timestamp -s "${APPLE_PERSONALID}" dist/ActivityWatch.dmg brew install akeru-inc/tap/xcnotary xcnotary precheck dist/ActivityWatch.app @@ -592,7 +592,7 @@ jobs: run: | if [ -n "$APPLE_EMAIL" ]; then ./scripts/ci/import-macos-p12.sh - APPLE_PERSONALID=$(security find-identity -v -p codesigning "${KEY_CHAIN:-build.keychain-db}" | sed -n 's/.*"\\(.*\\)"/\\1/p' | head -1) + APPLE_PERSONALID=$(security find-identity -v -p codesigning "${KEY_CHAIN:-build.keychain-db}" | sed -n 's/.*"\(.*\)"/\1/p' | head -1) if [ -z "$APPLE_PERSONALID" ]; then echo "ERROR: no codesigning identity found after importing the macOS certificate" >&2 exit 1 @@ -604,7 +604,7 @@ jobs: make dist/ActivityWatch.dmg if [ -n "$APPLE_EMAIL" ]; then - codesign --force --verbose --timestamp -s ${APPLE_PERSONALID} dist/ActivityWatch.dmg + codesign --force --verbose --timestamp -s "${APPLE_PERSONALID}" dist/ActivityWatch.dmg brew install akeru-inc/tap/xcnotary xcnotary precheck dist/ActivityWatch.app