feat(scripts): add core:stage script and enhance code-signing certificate generation (#311)

- Added a new script "core:stage" to package.json for staging the openhuman-app.
- Enhanced the setup-dev-codesign.sh script to generate a self-signed code-signing certificate using a custom OpenSSL configuration, improving the certificate's attributes for code signing.

package.json

@@ -10,6 +10,7 @@
   "scripts": {
     "build": "yarn workspace openhuman-app build",
     "compile": "yarn workspace openhuman-app compile",
+    "core:stage": "yarn workspace openhuman-app core:stage",
     "dev": "yarn workspace openhuman-app dev",
     "dev:app": "yarn workspace openhuman-app dev:app",
     "format": "yarn workspace openhuman-app format",

scripts/setup-dev-codesign.sh

@@ -39,6 +39,21 @@ fi
 echo "[setup-dev-codesign] Creating self-signed code-signing certificate: \"$IDENTITY\""
 
 # ── Generate key + self-signed certificate ───────────────────────────────────
+cat > "$TMPDIR_CERT/openssl.conf" <<EOF
+[ req ]
+distinguished_name = req_distinguished_name
+prompt = no
+x509_extensions = v3_ca
+
+[ req_distinguished_name ]
+CN = $IDENTITY
+
+[ v3_ca ]
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
+extendedKeyUsage = codeSigning
+EOF
+
 openssl req \
   -newkey rsa:2048 \
   -nodes \
@@ -46,7 +61,7 @@ openssl req \
   -x509 \
   -days 3650 \
   -out "$CERT" \
-  -subj "/CN=$IDENTITY" \
+  -config "$TMPDIR_CERT/openssl.conf" \
   2>/dev/null
 
 # ── Bundle to PKCS12 ─────────────────────────────────────────────────────────
@@ -66,9 +81,10 @@ security import "$P12" \
   -T /usr/bin/security
 
 # ── Trust for code signing ───────────────────────────────────────────────────
+# Note: we add both basic and codeSign trust.
 security add-trusted-cert \
-  -d \
   -r trustRoot \
+  -p basic \
   -p codeSign \
   -k "$KEYCHAIN" \
   "$CERT"