pindo 5.19.3 → 5.19.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5a77caec349df71376df7ea433567423ae745f767297fb29377e265f123b63d8
-  data.tar.gz: 5f8040b7e13937405b635906ad34dcd4466af83292d65b823968d22fce9f3081
+  metadata.gz: e6cdbb729bb1840389cfd9e6252bc60d44d9faa010c47295eeed07a0989b3c42
+  data.tar.gz: ef3fa0cbf75139df0333a8dbf0d9f57388c93814da2fb9077673fb0e26df46e7
 SHA512:
-  metadata.gz: 9fb90c4d057aab583df7780e4e8880c47507da9c64f9b05dfb48b778c87ae1695cf33711c6b777ad6540284f97a101ba5c28f10e8d6a91dfc6243b6a4a25843f
-  data.tar.gz: 57f746e6f8a01dcebab6615d1e30de5d7b6a1eb2b221bf8db50a10c66a0aab240279064b86f89bef7e0ccace8186eaf87da42a008a2f50f2a403f0d5ee5ec593
+  metadata.gz: 3ca2fab411eed7712b8d73a7693a6cd32ae2d4ae79c94c451c5b6fb61a2b4835cc7fecc3452c96cacea273f4f7f3512f5edf848a3053a3692364a813f0f02531
+  data.tar.gz: 2de8b83dfa93049cbe1e0a1d97e2d824892a92c1b788f1bd85c135fd52082079426f4ea0dc7d10b5463e0241626dbab5c2add78ba01afe2d45349f54c0349b2a

data/lib/pindo/command/ios/autoresign.rb

@@ -17,7 +17,7 @@ module Pindo
             class Autoresign < Ios
 
                 include Appselect
-                self.summary = 'IPA包重签名工具'
+                self.summary = 'iOS IPA / macOS App 重签名工具'
 
                 # 启用缓存机制
                 def self.use_cache?
@@ -25,7 +25,7 @@ module Pindo
                 end
 
                 self.description = <<-DESC
-                    使用最新的证书重签名IPA包。
+                    使用最新的证书重签名 iOS IPA 或 macOS App。
 
                     支持功能:
 
@@ -35,6 +35,8 @@ module Pindo
 
                         * 支持指定IPA路径
 
+                        * 使用 --macos 对 macOS .app 目录进行 Developer ID / Development 重签名
+
                         * 支持上传到JPS测试平台
 
                         * 支持发送测试通知
@@ -47,6 +49,10 @@ module Pindo
 
                         $ pindo ios autoresign demo.ipa                           # 重签名指定IPA文件
 
+                        $ pindo ios autoresign Demo.app --macos                  # 重签名指定 macOS App
+
+                        $ pindo ios autoresign --app=Demo.app --macos            # 使用选项指定 macOS App
+
                         $ pindo ios autoresign --adhoc                            # 使用adhoc证书重签名
 
                         $ pindo ios autoresign --deploy                           # 使用发布bundle id
@@ -65,7 +71,7 @@ module Pindo
                 DESC
 
                 self.arguments = [
-                    CLAide::Argument.new('path/to/demo.ipa', true),
+                    CLAide::Argument.new('path/to/demo.ipa|path/to/Demo.app', true),
                 ]
 
                 def self.option_items
@@ -73,11 +79,11 @@ module Pindo
                         items = []
 
                         # 添加工具参数（ToolOptions）
-                        items.concat(Pindo::Options::ToolOptions.select(:ipa, :deploy))
+                        items.concat(Pindo::Options::ToolOptions.select(:ipa, :app, :deploy))
 
                         # 添加构建类型参数（BuildOptions）
                         items.concat(Pindo::Options::BuildOptions.select(
-                            :dev, :adhoc, :develop_id, :build_type
+                            :bundleid, :dev, :adhoc, :develop_id, :build_type
                         ))
 
                         # 添加证书相关参数（CertOptions）
@@ -106,9 +112,10 @@ module Pindo
                       @options = initialize_options(argv)
 
                       # 优先使用选项参数，如果没有则使用位置参数
-                      @args_ipa_file = @options[:ipa] || positional_ipa
+                      @args_ipa_file = @options[:app] || @options[:ipa] || positional_ipa
 
                     @args_deploy_flag = @options[:deploy]
+                    @args_bundle_id = @options[:bundleid]
 
                     # JPS 参数（从 options 中获取）
                     @args_upload_flag = @options[:upload]
@@ -154,7 +161,8 @@ module Pindo
 
                     # 处理平台类型
                     @platform_type = @options[:platform]
-                    if @args_macos_flag
+                    # --app 只用于 macOS，指定即隐含 macOS 平台，无需再显式加 --macos
+                    if @args_macos_flag || @options[:app]
                         @platform_type = 'macos'
                     end
 
@@ -165,15 +173,18 @@ module Pindo
 
                     super
                     @additional_args = argv.remainder!
+                    unless @additional_args.empty?
+                        raise Informative, "只允许指定一个安装包路径，多余参数: #{@additional_args.join(' ')}"
+                    end
                 end
 
 
                 def run
                     begin
-                        # 1. 查找 IPA 文件
+                        # 1. 查找待签名包（iOS 为 IPA，macOS 为 .app）
                         ipa_file_path = find_ipa_file()
                         unless ipa_file_path && File.exist?(ipa_file_path)
-                            raise Informative, "未找到需要重签名的 IPA 文件"
+                            raise Informative, "未找到需要重签名的安装包"
                         end
 
                         # 2. 选择 Bundle ID
@@ -187,7 +198,7 @@ module Pindo
                         app_info_obj, workflow_info = prepare_jps_config()
 
                         # 5. 计算重签名后的 IPA 文件名
-                        resigned_ipa_file = ipa_file_path.gsub(/\.ipa$/, '_resigned.ipa')
+                        resigned_ipa_file = resigned_package_path(ipa_file_path)
 
                         # 6. 创建任务
                         tasks = create_resign_tasks(
@@ -214,21 +225,25 @@ module Pindo
 
                 # 查找 IPA 文件
                 def find_ipa_file
-                      # 1. 如果通过选项或位置参数指定了 IPA 文件且存在，直接返回
-                      if @args_ipa_file && File.exist?(@args_ipa_file)
-                        puts "\n使用指定的 IPA 文件: #{@args_ipa_file}"
+                      # 1. 如果通过选项或位置参数指定了安装包，严格校验后直接返回
+                      if @args_ipa_file
+                        unless File.exist?(@args_ipa_file)
+                            raise Informative, "指定的安装包不存在: #{@args_ipa_file}"
+                        end
+                        validate_package_path!(@args_ipa_file)
+                        puts "\n使用指定的安装包: #{@args_ipa_file}"
                         puts "修改时间: #{File.mtime(@args_ipa_file)}"
                         return @args_ipa_file
                       end
 
                     # 2. 在当前目录查找最新的非 _resigned 的 IPA
                     current_dir = Dir.pwd
-                    ipa_files = Dir.glob(File.join(current_dir, "*.ipa"))
+                    pattern = macos_platform? ? "*.app" : "*.ipa"
+                    ipa_files = Dir.glob(File.join(current_dir, pattern))
 
-                    # 过滤掉 _resigned.ipa 并找到最新的
-                    ipa_file = ipa_files.max_by do |f|
-                        File.basename(f).include?("_resigned") ? Time.local(0, 1, 1) : File.mtime(f)
-                    end
+                    # 排除已经重签名的产物并找到最新安装包
+                    ipa_files.reject! { |f| File.basename(f).include?("_resigned") }
+                    ipa_file = ipa_files.max_by { |f| File.mtime(f) }
 
                     if ipa_file && File.exist?(ipa_file)
                         puts "\n自动找到 IPA 文件: #{ipa_file}"
@@ -237,12 +252,13 @@ module Pindo
                     end
 
                     # 3. 如果没有找到，从终端输入
-                    puts "\n⚠️  未找到 IPA 文件"
-                    puts "请输入 IPA 文件路径（支持相对路径或绝对路径）："
+                    package_name = macos_platform? ? "macOS .app" : "IPA"
+                    puts "\n⚠️  未找到 #{package_name}"
+                    puts "请输入 #{package_name} 路径（支持相对路径或绝对路径）："
 
-                    ipa_path = ask("IPA 文件路径: ") do |q|
-                        q.validate = /\.ipa$/i
-                        q.responses[:not_valid] = "❌ 请输入有效的 IPA 文件路径（必须以 .ipa 结尾）"
+                    ipa_path = ask("安装包路径: ") do |q|
+                        q.validate = macos_platform? ? /\.app$/i : /\.ipa$/i
+                        q.responses[:not_valid] = "❌ 请输入有效的 #{package_name} 路径"
                     end
 
                     # 去除首尾空格
@@ -251,7 +267,8 @@ module Pindo
                     # 验证文件是否存在
                     if ipa_path && !ipa_path.empty?
                         if File.exist?(ipa_path)
-                            puts "✓ 使用输入的 IPA 文件: #{ipa_path}"
+                            validate_package_path!(ipa_path)
+                            puts "✓ 使用输入的安装包: #{ipa_path}"
                             puts "  修改时间: #{File.mtime(ipa_path)}"
                             return ipa_path
                         else
@@ -262,8 +279,32 @@ module Pindo
                     nil
                 end
 
+                def macos_platform?
+                    @platform_type.to_s.downcase == 'macos'
+                end
+
+                def validate_package_path!(path)
+                    if macos_platform?
+                        unless File.directory?(path) && path.downcase.end_with?('.app')
+                            raise Informative, "--macos 模式要求输入 macOS .app 目录: #{path}"
+                        end
+                    elsif !File.file?(path) || !path.downcase.end_with?('.ipa')
+                        raise Informative, "iOS 模式要求输入 .ipa 文件: #{path}"
+                    end
+                end
+
+                def resigned_package_path(path)
+                    extension = macos_platform? ? '.app' : '.ipa'
+                    path.sub(/#{Regexp.escape(extension)}$/i, "_resigned#{extension}")
+                end
+
                 # 选择 Bundle ID（根据 build_type）
                 def select_bundle_id
+                    if @args_bundle_id && !@args_bundle_id.empty?
+                        puts "\n使用指定的 Bundle ID: #{@args_bundle_id}"
+                        return @args_bundle_id
+                    end
+
                     if @args_deploy_flag || @build_type != 'development'
                         get_selected_deploy_bundleid()
                     else
@@ -274,8 +315,9 @@ module Pindo
                 # 拉取应用配置
                 def pull_app_config(bundle_id)
                     require 'pindo/config/build_info_manager'
+                    repo_name = bundle_id.sub(/\.\*$/, '')
                     Pindo::BuildInfoManager.share_instance.pull_appconfig_with_reponame(
-                        repo_name: bundle_id,
+                        repo_name: repo_name,
                         target_dir: Dir.pwd
                     )
                 end
@@ -283,9 +325,8 @@ module Pindo
                 # 准备 JPS 配置
                 def prepare_jps_config
                     if @args_upload_flag
-                        # 根据 Xcode 工程类型动态设置 package_type（macOS 工程使用 'mac'，否则使用 'ipa'）
-                        is_macos = Pindo::BuildHelper.share_instance.macos_project?(Dir.pwd)
-                        package_type = is_macos ? 'mac' : 'ipa'
+                        # 以平台类型为唯一判定口径，与 create_resign_tasks 的上传任务保持一致
+                        package_type = macos_platform? ? 'mac' : 'ipa'
                         app_info_obj, workflow_info = PgyerHelper.share_instace.prepare_upload(
                             working_directory: Dir.pwd,
                             conf: @args_conf,
@@ -327,7 +368,7 @@ module Pindo
                     # 2. 上传任务（仅在需要时创建）
                     if @args_upload_flag && app_info_obj
                         upload_task = Pindo::TaskSystem::JPSUploadTask.new(
-                            'ipa',
+                            macos_platform? ? 'mac' : 'ipa',
                             Dir.pwd,
                             resigned_ipa_file,
                             app_info_obj: app_info_obj,

data/lib/pindo/module/pgyer/pgyerhelper.rb

@@ -751,23 +751,7 @@ module Pindo
                 if !ipa_file_upload.nil? &&
                     File.extname(ipa_file_upload).downcase.eql?(".exe")
 
-                    windows_exe_path = File.expand_path(ipa_file_upload)
-                    windows_build_dir = File.dirname(windows_exe_path)
-                    windows_zip_dir = File.dirname(windows_build_dir)
-                    windows_build_name = File.basename(windows_exe_path, File.extname(windows_exe_path))
-                    windows_exe_name = File.basename(windows_exe_path)
-                    windows_zip_fullname = File.join(windows_zip_dir, windows_build_name + ".zip")
-
-                    if File.exist?(windows_zip_fullname)
-                        FileUtils.rm_rf(windows_zip_fullname)
-                    end
-
-                    Zip::File.open(windows_zip_fullname, Zip::File::CREATE) do |zipfile|
-                        Dir.chdir(windows_build_dir) do
-                            zipfile.add(windows_exe_name, windows_exe_name)
-                        end
-                    end
-                    ipa_file_upload = windows_zip_fullname
+                    ipa_file_upload = package_windows_exe_for_upload(ipa_file_upload)
                 end
                 unless !ipa_file_upload.nil? && File.exist?(ipa_file_upload)
                     return
@@ -898,6 +882,25 @@ module Pindo
 
         end
 
+        def package_windows_exe_for_upload(exe_file_upload)
+            windows_exe_path = File.expand_path(exe_file_upload)
+            windows_build_dir = File.dirname(windows_exe_path)
+            windows_zip_dir = File.dirname(windows_build_dir)
+            windows_build_name = File.basename(windows_exe_path, File.extname(windows_exe_path))
+            windows_exe_name = File.basename(windows_exe_path)
+            windows_zip_fullname = File.join(windows_zip_dir, windows_build_name + ".zip")
+
+            if File.exist?(windows_zip_fullname)
+                FileUtils.rm_rf(windows_zip_fullname)
+            end
+
+            Zip::File.open(windows_zip_fullname, Zip::File::CREATE) do |zipfile|
+                zipfile.add(windows_exe_name, windows_exe_path)
+            end
+
+            windows_zip_fullname
+        end
+
         # 上传 media 文件（图片、视频等）到 JPS
         # 上传成功后自动更新 commit_log 记录
         #

data/lib/pindo/module/resign/ipa_resign_adapter.rb

@@ -0,0 +1,14 @@
+require 'pindo/module/xcode/ipa_resign_helper'
+
+module Pindo
+  module Resign
+    class IpaResignAdapter
+      def resign(package_path:, bundle_id:, **_options)
+        Pindo::IpaResignHelper.resign_ipa(
+          ipa_file_path: package_path,
+          bundle_id: bundle_id
+        )
+      end
+    end
+  end
+end

data/lib/pindo/module/resign/mac_app_resign_adapter.rb

@@ -0,0 +1,16 @@
+require 'pindo/module/xcode/mac_app_resign_helper'
+
+module Pindo
+  module Resign
+    class MacAppResignAdapter
+      def resign(package_path:, bundle_id:, signing_identity:, profiles:, **_options)
+        Pindo::MacAppResignHelper.resign_app(
+          app_path: package_path,
+          bundle_id: bundle_id,
+          signing_identity: signing_identity,
+          profiles: profiles
+        )
+      end
+    end
+  end
+end

data/lib/pindo/module/task/model/resign/ipa_local_resign_task.rb

@@ -3,6 +3,8 @@ require 'pindo/module/task/task_config'
 require 'pindo/module/cert/cert_helper'
 require 'pindo/config/ios_config_parser'
 require 'pindo/module/xcode/ipa_resign_helper'
+require 'pindo/module/resign/ipa_resign_adapter'
+require 'pindo/module/resign/mac_app_resign_adapter'
 
 module Pindo
   module TaskSystem
@@ -62,7 +64,7 @@ module Pindo
         # 设置任务优先级
         options[:priority] ||= TaskPriority::HIGH
 
-        super("重签名 IPA", options)
+        super("本地重签名", options)
       end
 
       # 验证任务参数
@@ -95,14 +97,16 @@ module Pindo
 
       # 执行重签名
       def do_work
-        # 1. 确定要重签名的 IPA 文件
+        # 1. 确定要重签名的安装包
         ipa_to_resign = determine_ipa_file
         unless ipa_to_resign && File.exist?(ipa_to_resign)
-          raise "未找到需要重签名的 IPA 文件"
+          raise "未找到需要重签名的安装包"
         end
 
+        validate_package_type!(ipa_to_resign)
+
         puts "\n▶ 重签名信息"
-        puts "  IPA: #{File.basename(ipa_to_resign)}"
+        puts "  安装包: #{File.basename(ipa_to_resign)}"
         puts "  Bundle ID: #{@bundle_id}"
         puts "  类型: #{@build_type}"
         cert_info = []
@@ -114,17 +118,23 @@ module Pindo
         load_config_if_needed
 
         # 3. 安装证书
-        install_certificate
+        provisioning_info_array = install_certificate
 
         # 4. 执行重签名
-        resigned_ipa = Pindo::IpaResignHelper.resign_ipa(
-          ipa_file_path: ipa_to_resign,
-          bundle_id: @bundle_id
+        signing_identity = Array(provisioning_info_array)
+          .map { |item| item['signing_identity'] }
+          .compact
+          .first
+        resigned_ipa = resign_adapter.resign(
+          package_path: ipa_to_resign,
+          bundle_id: @bundle_id,
+          signing_identity: signing_identity,
+          profiles: provisioning_info_array
         )
 
         # 5. 验证重签名结果
         unless resigned_ipa && File.exist?(resigned_ipa)
-          raise "重签名失败：未生成重签名后的 IPA 文件"
+          raise "重签名失败：未生成重签名后的安装包"
         end
 
         puts "✅ 重签名完成: #{File.basename(resigned_ipa)}\n"
@@ -146,13 +156,36 @@ module Pindo
         end
       end
 
+      def macos_platform?
+        @platform_type.to_s.downcase == 'macos'
+      end
+
+      def validate_package_type!(path)
+        valid = if macos_platform?
+                  File.directory?(path) && path.downcase.end_with?('.app')
+                else
+                  File.file?(path) && path.downcase.end_with?('.ipa')
+                end
+        expected = macos_platform? ? 'macOS .app 目录' : '.ipa 文件'
+        raise "当前平台要求输入 #{expected}: #{path}" unless valid
+      end
+
+      def resign_adapter
+        if macos_platform?
+          Pindo::Resign::MacAppResignAdapter.new
+        else
+          Pindo::Resign::IpaResignAdapter.new
+        end
+      end
+
       # 查找最新的 IPA 文件（排除 _resigned.ipa）
       def find_latest_ipa_file
         unless File.directory?(@ipa_path)
           return nil
         end
 
-        ipa_files = Dir.glob(File.join(@ipa_path, "*.ipa"))
+        pattern = macos_platform? ? '*.app' : '*.ipa'
+        ipa_files = Dir.glob(File.join(@ipa_path, pattern))
 
         # 过滤掉 _resigned.ipa 文件
         ipa_files = ipa_files.reject { |f| File.basename(f).include?("_resigned") }
@@ -204,6 +237,7 @@ module Pindo
         unless provisioning_info_array && !provisioning_info_array.empty?
           raise "证书获取失败：未找到有效的证书信息"
         end
+        provisioning_info_array
       end
     end
   end

data/lib/pindo/module/xcode/mac_app_resign_helper.rb

@@ -0,0 +1,243 @@
+require 'fileutils'
+require 'find'
+require 'open3'
+require 'tmpdir'
+
+module Pindo
+  class MacAppResignHelper
+    BUNDLE_EXTENSIONS = %w[.app .appex .framework .xpc .bundle .plugin].freeze
+    # 需要内嵌描述文件的可执行 bundle（含独立 Bundle ID），
+    # .framework / .bundle / .plugin 属于共享代码，不单独内嵌 profile。
+    PROFILE_BUNDLE_EXTENSIONS = %w[.app .appex .xpc].freeze
+    MACHO_MAGICS = [
+      "\xFE\xED\xFA\xCE", "\xCE\xFA\xED\xFE", "\xFE\xED\xFA\xCF",
+      "\xCF\xFA\xED\xFE", "\xCA\xFE\xBA\xBE", "\xBE\xBA\xFE\xCA",
+      "\xCA\xFE\xBA\xBF", "\xBF\xBA\xFE\xCA"
+    ].map(&:b).freeze
+
+    class << self
+      def resign_app(app_path:, bundle_id:, signing_identity:, profiles: [])
+        validate_input!(app_path, signing_identity)
+        output_path = resigned_path(app_path)
+        FileUtils.rm_rf(output_path)
+        FileUtils.cp_r(app_path, output_path, preserve: true)
+
+        resolved_bundle_id = resolve_bundle_id(output_path, bundle_id)
+        puts "\n▶ macOS App 重签名"
+        puts "  输入: #{app_path}"
+        puts "  输出: #{output_path}"
+        puts "  Bundle ID: #{bundle_id} → #{resolved_bundle_id}" if bundle_id != resolved_bundle_id
+        puts "  Bundle ID: #{resolved_bundle_id}" if bundle_id == resolved_bundle_id
+        puts "  签名身份: #{signing_identity}"
+        update_main_bundle_id(output_path, resolved_bundle_id)
+
+        Dir.mktmpdir('pindo-macos-entitlements-') do |tmp_dir|
+          nested_paths = signable_paths(output_path)
+          puts "  嵌套组件: #{nested_paths.length} 个"
+          nested_paths.each_with_index do |path, index|
+            puts "  [#{index + 1}/#{nested_paths.length}] 签名: #{relative_path(path, output_path)}"
+            sign_component(path, output_path, signing_identity, profiles, tmp_dir, index)
+          end
+          puts "  签名主 App: #{File.basename(output_path)}"
+          sign_component(output_path, output_path, signing_identity, profiles, tmp_dir, 'main',
+                         bundle_id: resolved_bundle_id)
+        end
+
+        puts "  验证签名: codesign --verify --strict"
+        verify!(output_path)
+        puts "  ✓ macOS App 签名验证通过"
+        output_path
+      rescue StandardError
+        FileUtils.rm_rf(output_path) if output_path && File.exist?(output_path)
+        raise
+      end
+
+      private
+
+      def validate_input!(app_path, signing_identity)
+        unless File.directory?(app_path) && app_path.downcase.end_with?('.app')
+          raise Informative, "macOS 重签名要求输入 .app 目录: #{app_path}"
+        end
+        if signing_identity.to_s.strip.empty?
+          raise Informative, 'macOS 重签名未找到有效的 signing identity'
+        end
+        info_plist = File.join(app_path, 'Contents', 'Info.plist')
+        raise Informative, "不是有效的 macOS App，缺少 #{info_plist}" unless File.file?(info_plist)
+      end
+
+      def resigned_path(app_path)
+        app_path.sub(/\.app$/i, '_resigned.app')
+      end
+
+      def update_main_bundle_id(app_path, bundle_id)
+        return if bundle_id.to_s.empty?
+
+        plist = File.join(app_path, 'Contents', 'Info.plist')
+        success = system('/usr/libexec/PlistBuddy', '-c', "Set :CFBundleIdentifier #{bundle_id}", plist)
+        raise Informative, "修改 macOS App Bundle ID 失败: #{plist}" unless success
+      end
+
+      def resolve_bundle_id(app_path, bundle_id)
+        return bundle_id unless bundle_id.to_s.include?('*')
+
+        plist = File.join(app_path, 'Contents', 'Info.plist')
+        candidate = plist_value(plist, 'CFBundleName')
+        candidate = plist_value(plist, 'CFBundleDisplayName') if candidate.to_s.empty?
+        candidate = File.basename(app_path, '.app') if candidate.to_s.empty?
+        suffix = candidate.to_s.downcase.gsub(/[^a-z0-9-]+/, '-')
+          .gsub(/\A-+|-+\z/, '')
+        suffix = 'app' if suffix.empty?
+        bundle_id.sub('*', suffix)
+      end
+
+      def plist_value(plist, key)
+        stdout, _stderr, status = Open3.capture3(
+          '/usr/libexec/PlistBuddy', '-c', "Print :#{key}", plist
+        )
+        status.success? ? stdout.strip : nil
+      end
+
+      # 对单个可签名组件重签名。
+      # 对需要描述文件的 bundle（.app/.appex/.xpc）：内嵌匹配的 profile，并
+      # 优先使用 profile 内的 entitlements（含新的 team-identifier /
+      # application-identifier），从根本上避免沿用旧二进制里的旧身份。
+      # Developer ID 场景（profiles 为空）回退到从旧二进制导出的 entitlements。
+      def sign_component(path, app_root, identity, profiles, tmp_dir, index, bundle_id: nil)
+        entitlements =
+          if profile_required?(path)
+            component_bundle_id = bundle_id || bundle_identifier(path)
+            profile_path = matched_profile_path(component_bundle_id, profiles)
+            if profile_path
+              embed_profile_file(path, profile_path)
+              puts "      描述文件: #{File.basename(profile_path)}"
+              profile_entitlements(profile_path, tmp_dir, index) ||
+                extract_entitlements(path, tmp_dir, index)
+            elsif !Array(profiles).empty?
+              raise Informative,
+                    "未找到匹配 #{component_bundle_id} 的描述文件，无法重签名: #{relative_path(path, app_root)}"
+            else
+              extract_entitlements(path, tmp_dir, index)
+            end
+          else
+            extract_entitlements(path, tmp_dir, index)
+          end
+        codesign(path, identity, entitlements)
+      end
+
+      # 仅 .app/.appex/.xpc 这类含 Info.plist 的可执行 bundle 需要描述文件。
+      def profile_required?(path)
+        return false unless File.directory?(path)
+        return false unless PROFILE_BUNDLE_EXTENSIONS.include?(File.extname(path).downcase)
+
+        !bundle_info_plist(path).nil?
+      end
+
+      def bundle_info_plist(bundle_path)
+        [
+          File.join(bundle_path, 'Contents', 'Info.plist'),
+          File.join(bundle_path, 'Info.plist'),
+          File.join(bundle_path, 'Resources', 'Info.plist')
+        ].find { |candidate| File.file?(candidate) }
+      end
+
+      def bundle_identifier(bundle_path)
+        plist = bundle_info_plist(bundle_path)
+        plist && plist_value(plist, 'CFBundleIdentifier')
+      end
+
+      def matched_profile_path(bundle_id, profiles)
+        profile = Array(profiles).find do |item|
+          profile_bundle_id = item['bundle_id'].to_s
+          profile_bundle_id == bundle_id ||
+            (profile_bundle_id.end_with?('.*') &&
+              bundle_id.to_s.start_with?(profile_bundle_id.delete_suffix('*')))
+        end
+        profile_path = profile && profile['profile_path']
+        profile_path if profile_path && File.file?(profile_path)
+      end
+
+      def embed_profile_file(bundle_path, profile_path)
+        contents_dir = File.join(bundle_path, 'Contents')
+        dest_dir = File.directory?(contents_dir) ? contents_dir : bundle_path
+        FileUtils.cp(profile_path, File.join(dest_dir, 'embedded.provisionprofile'))
+      end
+
+      # 从描述文件解出 Entitlements，写成独立 plist 供 codesign --entitlements 使用。
+      def profile_entitlements(profile_path, tmp_dir, index)
+        decoded, _stderr, status = Open3.capture3(
+          '/usr/bin/security', 'cms', '-D', '-i', profile_path
+        )
+        return nil unless status.success?
+
+        profile_plist = File.join(tmp_dir, "profile-#{index}.plist")
+        File.write(profile_plist, decoded)
+        entitlements_xml, _err, extract_status = Open3.capture3(
+          '/usr/bin/plutil', '-extract', 'Entitlements', 'xml1', '-o', '-', profile_plist
+        )
+        return nil unless extract_status.success? && entitlements_xml.include?('<plist')
+
+        entitlements_path = File.join(tmp_dir, "profile-entitlements-#{index}.plist")
+        File.write(entitlements_path, entitlements_xml)
+        entitlements_path
+      end
+
+      def relative_path(path, app_path)
+        path.delete_prefix("#{app_path}/")
+      end
+
+      # Sign deepest nested code first. The main app is deliberately excluded
+      # here and signed last by resign_app.
+      def signable_paths(app_path)
+        paths = []
+        Find.find(app_path) do |path|
+          next if path == app_path
+          if File.directory?(path) && BUNDLE_EXTENSIONS.include?(File.extname(path).downcase)
+            paths << path
+          elsif File.file?(path) && (File.extname(path).downcase == '.dylib' || macho?(path))
+            paths << path
+          end
+        end
+        paths.uniq.sort_by { |path| [-path.count(File::SEPARATOR), File.directory?(path) ? 1 : 0] }
+      end
+
+      def macho?(path)
+        File.open(path, 'rb') { |file| MACHO_MAGICS.include?(file.read(4)) }
+      rescue Errno::EACCES, Errno::ENOENT
+        false
+      end
+
+      def extract_entitlements(path, tmp_dir, index)
+        stdout, _stderr, status = Open3.capture3(
+          '/usr/bin/codesign', '-d', '--entitlements', ':-', path
+        )
+        return nil unless status.success? && stdout.include?('<plist')
+
+        entitlements_path = File.join(tmp_dir, "#{index}.plist")
+        File.write(entitlements_path, stdout)
+        entitlements_path
+      end
+
+      def codesign(path, identity, entitlements)
+        command = [
+          '/usr/bin/codesign', '--force', '--sign', identity,
+          '--timestamp', '--options', 'runtime'
+        ]
+        command.concat(['--entitlements', entitlements]) if entitlements
+        command << path
+        _stdout, stderr, status = Open3.capture3(*command)
+        return if status.success?
+
+        raise Informative, "codesign 失败: #{path}\n#{stderr.strip}"
+      end
+
+      def verify!(app_path)
+        _stdout, stderr, status = Open3.capture3(
+          '/usr/bin/codesign', '--verify', '--strict', '--verbose=2', app_path
+        )
+        return if status.success?
+
+        raise Informative, "macOS App 签名验证失败: #{app_path}\n#{stderr.strip}"
+      end
+    end
+  end
+end

data/lib/pindo/options/core/option_value_parser.rb

@@ -41,13 +41,23 @@ module Pindo
       # @param item [OptionItem] 参数定义
       # @return [Object, nil] 提取的值
       def self.extract_from_argv(argv, item)
+        option_names = [item.key.to_s] + item.aliases.map(&:to_s)
+
         if item.boolean?
           # Boolean 类型：使用 flag?
-          argv.flag?(item.key.to_s, nil)
+          option_names.each do |option_name|
+            value = argv.flag?(option_name, nil)
+            return value unless value.nil?
+          end
         else
           # 其他类型：使用 option
-          argv.option(item.key.to_s, nil)
+          option_names.each do |option_name|
+            value = argv.option(option_name, nil)
+            return value unless value.nil?
+          end
         end
+
+        nil
       end
     end
   end

data/lib/pindo/options/groups/jps_options.rb

@@ -115,9 +115,10 @@ module Pindo
           file: OptionItem.new(
             key: :file,
             name: '上传文件',
-            description: '指定要上传的文件路径（支持 ipa/apk/app/exe/html）',
+            description: '指定要上传的文件路径（支持 ipa/apk/app/exe/html；兼容 --ipa 别名）',
             type: String,
             env_name: 'PINDO_JPS_FILE',
+            aliases: [:ipa],
             optional: true,
             example: 'pindo jps upload --file=path/to/app.ipa'
           ),

data/lib/pindo/options/groups/tool_options.rb

@@ -28,6 +28,24 @@ module Pindo
             example: 'pindo ios autoresign --ipa=path/to/demo.ipa'
           ),
 
+          app: OptionItem.new(
+            key: :app,
+            name: 'macOS App',
+            description: '指定要重签名的 macOS .app 目录',
+            type: String,
+            env_name: 'PINDO_APP_FILE',
+            optional: true,
+            verify_block: proc do |value|
+              unless value.downcase.end_with?('.app')
+                raise "App 路径格式错误: #{value}，必须以 .app 结尾"
+              end
+              unless File.directory?(value)
+                raise "App 目录不存在: #{value}"
+              end
+            end,
+            example: 'pindo ios autoresign --macos --app=path/to/Demo.app'
+          ),
+
           apk: OptionItem.new(
             key: :apk,
             name: 'APK 文件',

data/lib/pindo/version.rb

@@ -6,7 +6,7 @@ require 'time'
 
 module Pindo
 
-  VERSION = "5.19.3"
+  VERSION = "5.19.4"
 
   class VersionCheck
     RUBYGEMS_API = 'https://rubygems.org/api/v1/gems/pindo.json'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pindo
 version: !ruby/object:Gem::Version
-  version: 5.19.3
+  version: 5.19.4
 platform: ruby
 authors:
 - wade
@@ -406,6 +406,8 @@ files:
 - lib/pindo/module/cert/pem_helper.rb
 - lib/pindo/module/cert/provisioning_helper.rb
 - lib/pindo/module/pgyer/pgyerhelper.rb
+- lib/pindo/module/resign/ipa_resign_adapter.rb
+- lib/pindo/module/resign/mac_app_resign_adapter.rb
 - lib/pindo/module/task/core/concurrent_execution_strategy.rb
 - lib/pindo/module/task/core/dependency_checker.rb
 - lib/pindo/module/task/core/execution_strategy.rb
@@ -477,6 +479,7 @@ files:
 - lib/pindo/module/xcode/applovin_xcode_helper.rb
 - lib/pindo/module/xcode/cocoapods_helper.rb
 - lib/pindo/module/xcode/ipa_resign_helper.rb
+- lib/pindo/module/xcode/mac_app_resign_helper.rb
 - lib/pindo/module/xcode/res/xcode_res_constant.rb
 - lib/pindo/module/xcode/res/xcode_res_handler.rb
 - lib/pindo/module/xcode/xcode_app_config.rb