From 2e528fe32c4e8ba91e84162ca1cad4717680150d Mon Sep 17 00:00:00 2001 From: Steven Enamakel Date: Mon, 30 Mar 2026 18:32:37 -0700 Subject: [PATCH] feat(release): enhance macOS signing process in release workflow - Added steps to ensure the signing identity is available by creating and managing a keychain for certificate import. - Implemented security commands to unlock the keychain and import the signing certificate, improving the reliability of the signing process. - Cleaned up temporary certificate files after use to maintain a secure environment. --- .github/workflows/release.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index df2cdaefa..8b6cc8269 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -510,6 +510,21 @@ jobs: APP_PATH="${{ steps.locate-app.outputs.app_path }}" ENTITLEMENTS="app/src-tauri/entitlements.sidecar.plist" + # Ensure signing identity is available — re-import cert into a keychain + # in case tauri-action's keychain was cleaned up + KEYCHAIN="resign-$$.keychain-db" + KEYCHAIN_PW="$(openssl rand -base64 24)" + CERT_FILE="$(mktemp /tmp/cert-XXXXXX.p12)" + echo "$APPLE_CERTIFICATE_BASE64" | base64 --decode > "$CERT_FILE" + security create-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN" + security set-keychain-settings -lut 21600 "$KEYCHAIN" + security unlock-keychain -p "$KEYCHAIN_PW" "$KEYCHAIN" + security import "$CERT_FILE" -k "$KEYCHAIN" -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security + security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PW" "$KEYCHAIN" + security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"') + rm -f "$CERT_FILE" + echo "Signing identity imported into $KEYCHAIN" + echo "=== Re-signing binaries inside $APP_PATH with hardened runtime ===" # Determine main executable name from Info.plist