66 lines
2.0 KiB
Bash
Executable File
66 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Preflight: ensure MACOS_SIGN_P12 has the full Developer ID chain
|
|
# (leaf + Developer ID G2 + Apple Root CA). Quill embeds an unsatisfiable
|
|
# designated requirement when Apple Root CA is missing — see signing.adoc.
|
|
set -euo pipefail
|
|
|
|
if [[ -z "${MACOS_SIGN_P12:-}" ]]; then
|
|
echo "MACOS_SIGN_P12 unset; skipping macOS signing preflight."
|
|
exit 0
|
|
fi
|
|
|
|
if [[ -z "${MACOS_SIGN_PASSWORD:-}" ]]; then
|
|
echo "MACOS_SIGN_PASSWORD is required when MACOS_SIGN_P12 is set." >&2
|
|
exit 1
|
|
fi
|
|
|
|
tmpdir="$(mktemp -d)"
|
|
trap 'rm -rf "${tmpdir}"' EXIT
|
|
|
|
p12_path="${tmpdir}/Certificates.p12"
|
|
# GitHub secrets may include trailing newlines; strip them before decode.
|
|
printf '%s' "${MACOS_SIGN_P12}" | tr -d '\n\r' | base64 -d >"${p12_path}"
|
|
|
|
pem_out="${tmpdir}/certs.pem"
|
|
extract_p12() {
|
|
local extra_args=("${@}")
|
|
openssl pkcs12 -in "${p12_path}" -nodes -passin "pass:${MACOS_SIGN_PASSWORD}" \
|
|
"${extra_args[@]}" -out "${pem_out}" 2>/dev/null
|
|
}
|
|
|
|
if ! extract_p12; then
|
|
# OpenSSL 3 may need -legacy for older P12 exports.
|
|
extract_p12 -legacy
|
|
fi
|
|
|
|
cert_dir="${tmpdir}/certs"
|
|
mkdir -p "${cert_dir}"
|
|
awk -v dir="${cert_dir}" '
|
|
/-----BEGIN CERTIFICATE-----/ { n++; file = sprintf("%s/cert-%02d.pem", dir, n) }
|
|
n { print > file }
|
|
' "${pem_out}"
|
|
|
|
cert_count="$(find "${cert_dir}" -name 'cert-*.pem' | wc -l | tr -d ' ')"
|
|
if [[ "${cert_count}" -ne 3 ]]; then
|
|
echo "MACOS_SIGN_P12 must contain exactly 3 certificates (leaf + G2 + Apple Root CA); found ${cert_count}." >&2
|
|
echo "Rebuild the .p12 per docs/modules/dev/pages/signing.adoc." >&2
|
|
exit 1
|
|
fi
|
|
|
|
found_apple_root=0
|
|
for cert in "${cert_dir}"/cert-*.pem; do
|
|
subject="$(openssl x509 -in "${cert}" -noout -subject 2>/dev/null || true)"
|
|
if [[ "${subject}" == *"Apple Root CA"* ]]; then
|
|
found_apple_root=1
|
|
break
|
|
fi
|
|
done
|
|
|
|
if [[ "${found_apple_root}" -ne 1 ]]; then
|
|
echo "MACOS_SIGN_P12 is missing Apple Root CA in the certificate chain." >&2
|
|
echo "Rebuild the .p12 per docs/modules/dev/pages/signing.adoc." >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "MACOS_SIGN_P12 preflight OK (3 certificates, including Apple Root CA)."
|