final codesigning

This commit is contained in:
Anirudh Sevugan 2025-08-07 20:27:45 -05:00 committed by GitHub
parent 256239dda9
commit 22fe95d424
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -52,14 +52,9 @@ jobs:
# Write the plain text PEM secret directly to a file
echo "$CERT_PEM" > cert.pem
# Use openssl to convert the PEM to a PKCS12 (.p12) file with an empty password for the .p12 file itself.
# The -passout option is critical here. It explicitly sets the export password.
# The -password pass: is for an unencrypted private key within the PEM.
openssl pkcs12 -export -out certificate.p12 -in cert.pem -passout pass: -password pass:
# Import the certificate into the temporary keychain
# The `-P` flag must match the password used in the openssl command (which is blank)
security import certificate.p12 -k build.keychain -P "" -T /usr/bin/codesign
# Directly import the PEM file into the temporary keychain
# The -P flag specifies a blank password for the PEM file itself.
security import cert.pem -k build.keychain -P '' -T /usr/bin/codesign
# Trust the certificate for code signing
security set-key-partition-list \