From 1ae4cdbcee4f6faf4787dbb91117de42d02f0d74 Mon Sep 17 00:00:00 2001
From: Steven Enamakel <31011319+senamakel@users.noreply.github.com>
Date: Fri, 3 Apr 2026 10:13:15 -0700
Subject: [PATCH] feat(scripts): add core:stage script and enhance code-signing
 certificate generation (#311)

- Added a new script "core:stage" to package.json for staging the openhuman-app.
- Enhanced the setup-dev-codesign.sh script to generate a self-signed code-signing certificate using a custom OpenSSL configuration, improving the certificate's attributes for code signing.
---
 package.json                  |  1 +
 scripts/setup-dev-codesign.sh | 20 ++++++++++++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 726d4c739..4d1ef3e7e 100644
--- a/package.json
+++ b/package.json
@@ -10,6 +10,7 @@
   "scripts": {
     "build": "yarn workspace openhuman-app build",
     "compile": "yarn workspace openhuman-app compile",
+    "core:stage": "yarn workspace openhuman-app core:stage",
     "dev": "yarn workspace openhuman-app dev",
     "dev:app": "yarn workspace openhuman-app dev:app",
     "format": "yarn workspace openhuman-app format",
diff --git a/scripts/setup-dev-codesign.sh b/scripts/setup-dev-codesign.sh
index 08a6bc06a..7ae525ac2 100755
--- a/scripts/setup-dev-codesign.sh
+++ b/scripts/setup-dev-codesign.sh
@@ -39,6 +39,21 @@ fi
 echo "[setup-dev-codesign] Creating self-signed code-signing certificate: \"$IDENTITY\""
 
 # ── Generate key + self-signed certificate ───────────────────────────────────
+cat > "$TMPDIR_CERT/openssl.conf" <<EOF
+[ req ]
+distinguished_name = req_distinguished_name
+prompt = no
+x509_extensions = v3_ca
+
+[ req_distinguished_name ]
+CN = $IDENTITY
+
+[ v3_ca ]
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment
+extendedKeyUsage = codeSigning
+EOF
+
 openssl req \
   -newkey rsa:2048 \
   -nodes \
@@ -46,7 +61,7 @@ openssl req \
   -x509 \
   -days 3650 \
   -out "$CERT" \
-  -subj "/CN=$IDENTITY" \
+  -config "$TMPDIR_CERT/openssl.conf" \
   2>/dev/null
 
 # ── Bundle to PKCS12 ─────────────────────────────────────────────────────────
@@ -66,9 +81,10 @@ security import "$P12" \
   -T /usr/bin/security
 
 # ── Trust for code signing ───────────────────────────────────────────────────
+# Note: we add both basic and codeSign trust.
 security add-trusted-cert \
-  -d \
   -r trustRoot \
+  -p basic \
   -p codeSign \
   -k "$KEYCHAIN" \
   "$CERT"