pindo 5.21.0 → 5.21.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 071f26ed15db7f7eb690949907738546aad119b040538a1d33fc5e20ddf78eb1
-  data.tar.gz: 40a2fa27141ba019576ffacb6418ad534184efc6edc7e17d773a19e910f89a15
+  metadata.gz: 8fc2d66a2010bba4e00fe508252a291bac2efda4623ded2135bf707b6f93ade0
+  data.tar.gz: cfca3acb943122590ffeba33d95249c2d73143b7e51ff87e74ef5342e44dd67f
 SHA512:
-  metadata.gz: bcb1ea3adbf32a4b12d5b8f227d6d6d355938953ccc550b995ef621fb65f9e304ae2df1900e929bd1d6c8bdb09d61525293d31ac038beeb8c690237fe6080fdf
-  data.tar.gz: b2ddccffee40abb74e7460759dd21addc8ce3a465454bd90eb188bfcf2f5720731cbc9a83241bd75b0440d128667d82f4db76b10f4bcc7eda06a53b896c3e645
+  metadata.gz: 652bf861a3896a3763e38ff0f7142128dace9d221350db4a353b1f6ad22fd19dc5661ac926825438cf5dae7fdf287221b3888b8b84d6dccf6d54be024bac759b
+  data.tar.gz: bfd8a3891dc78f37fa1bccec6a67eb9dd7f6f8a4f4cac86d95788d0d64b63e938dd6385579ac3d0bc50141629bc236f2bf4a16d69f597b7036f8a1b497c03cb4

data/lib/pindo/base/aeshelper.rb

@@ -2,6 +2,7 @@
 require 'openssl'
 require 'match'
 require 'pindo/base/informative'
+require 'pindo/base/funlog'
 
 module Pindo
 
@@ -62,7 +63,10 @@ module Pindo
 
       unless password
           puts "\e[33m[DEBUG] Keychain中未找到密码，需要用户输入: #{server_name}\e[0m" if ENV['PINDO_DEBUG']
-          password = FastlaneCore::Helper.ask_password(message: "请输入证书仓库的加密密码: ", confirm: true)
+          # 收起 spinner，否则密码提示会被动画行覆盖，终端看起来像卡死
+          password = Funlog.with_paused_spinner do
+            FastlaneCore::Helper.ask_password(message: "请输入证书仓库的加密密码: ", confirm: true)
+          end
           puts "\e[33m[DEBUG] 用户输入密码成功，等待验证后保存到Keychain\e[0m" if ENV['PINDO_DEBUG']
       else
           puts "\e[32m[DEBUG] 从Keychain获取密码成功: #{server_name}\e[0m" if ENV['PINDO_DEBUG']

data/lib/pindo/base/funlog.rb

@@ -36,32 +36,59 @@ module Pindo
         @spinner_log
       end
 
+      # 临时让出终端，执行需要用户交互输入的代码块
+      #
+      # spinner 在后台线程中持续重绘同一行，会覆盖掉 fastlane、HighLine 等
+      # 交互提示（如 match passphrase、Apple ID 2FA、证书仓库密码），
+      # 导致终端看起来像卡死。执行交互代码前必须先收起 spinner。
+      #
+      # @yield 需要交互输入的代码块
+      # @return [Object] 代码块的返回值
+      def with_paused_spinner
+        return yield if @spinner_log.nil?
+
+        title = @spinner_title
+        @spinner_log.stop
+        @spinner_log = nil
 
+        begin
+          yield
+        ensure
+          fancyinfo_start(title) unless title.nil? || title.empty?
+        end
+      end
 
       def fancyinfo_start(*args)
         message = Funlog.ensure_utf8(args.join(" "))
-        
+        @spinner_title = message
+
         # 检查是否在任务上下文中
         if Funlog.in_task_context?
           # 并发模式：路由到输出管理器（只写日志文件）
           Funlog.current_output_sink.log_info(Funlog.current_task_id, message)
+        elsif Funlog.spinner_disabled?
+          # 禁用动画：只输出一次静态行，不占用终端
+          puts "   #{message}"
         else
           # 串行模式：使用 spinner
           spinner_log_handle.update(title:message)
           spinner_log_handle.auto_spin
         end
-        
+
         @spinner_log
       end
 
 
       def fancyinfo_update(*args)
          message = Funlog.ensure_utf8(args.join(" "))
+         @spinner_title = message
 
          # 检查是否在任务上下文中
          if Funlog.in_task_context?
            # 并发模式：不更新终端，只写日志
            Funlog.current_output_sink.log_info(Funlog.current_task_id, message)
+         elsif Funlog.spinner_disabled?
+           puts "   #{message}"
          else
            # 串行模式：使用 spinner
            spinner_log_handle.update(title:message)
@@ -73,25 +100,31 @@ module Pindo
 
       def fancyinfo_success(*args)
          message = Funlog.ensure_utf8(args.join(" "))
+         return finish_without_spinner("\e[32m  ✓ #{message}\e[0m") if Funlog.spinner_disabled?
+
          spinner_log_handle.update(title:message)
          spinner_log_handle.success
-         @spinner_log =nil
+         reset_spinner_state
       end
 
       def fancyinfo_error(*args)
          message = Funlog.ensure_utf8(args.join(" "))
+         return finish_without_spinner("\e[31m  ✗ #{message}\e[0m") if Funlog.spinner_disabled?
+
          spinner_log_handle.update(title:message)
          spinner_log_handle.error
-         @spinner_log =nil
+         reset_spinner_state
       end
 
       # 输出警告信息（使用spinner，黄色警告标记）
       # @param args [Array] 要输出的消息
       def fancyinfo_warning(*args)
          message = Funlog.ensure_utf8(args.join(" "))
+         return finish_without_spinner("\e[33m  ⚠ #{message}\e[0m") if Funlog.spinner_disabled?
+
          spinner_log_handle.update(title:message)
          spinner_log_handle.stop("\e[33m⚠\e[0m")
-         @spinner_log = nil
+         reset_spinner_state
       end
 
       # 输出静态成功信息（不使用spinner，对应 fancyinfo_success）
@@ -139,6 +172,21 @@ module Pindo
          end
       end
 
+      private
+
+      # 禁用动画时输出静态收尾行
+      # @param line [String] 已经带好颜色和标记的整行文本
+      def finish_without_spinner(line)
+        puts line
+        reset_spinner_state
+      end
+
+      # 清空 spinner 状态，等待下一次 fancyinfo_start 重新创建
+      def reset_spinner_state
+        @spinner_log = nil
+        @spinner_title = nil
+      end
+
     #-------------------------------------------------------------------------#
     #-------------------------------------------------------------------------#
     # @!group Singleton
@@ -185,6 +233,19 @@ module Pindo
         !current_output_sink.nil? && !current_task_id.nil?
       end
 
+      # 检查是否禁用了 spinner 动画
+      # @return [Boolean] PINDO_NO_SPINNER=1 时禁用
+      def spinner_disabled?
+        ENV['PINDO_NO_SPINNER'] == '1'
+      end
+
+      # 临时让出终端执行交互输入，详见实例方法说明
+      # @yield 需要交互输入的代码块
+      # @return [Object] 代码块的返回值
+      def with_paused_spinner(&block)
+        instance.with_paused_spinner(&block)
+      end
+
       # ============================================
       # 类方法委托，简化调用方式
       # 使用 Funlog.info("消息") 代替 Funlog.instance.info("消息")

data/lib/pindo/module/cert/keychain_helper.rb

@@ -1,20 +1,21 @@
 
 require 'open3'
 require 'security'
+require 'pindo/base/funlog'
 
 module Pindo
 
   class KeychainHelper
     class << self
 
-      def import_file(path, keychain_path, keychain_password: nil, certificate_password: "", skip_set_partition_list: false, output: false)
+      def import_file(path, keychain_path, keychain_password: nil, certificate_password: "", skip_set_partition_list: false, output: false, strict: false)
         # puts path
 
         # puts "Could not find file '#{path}'" unless File.exist?(path)
 
         password_part = " -P #{certificate_password.shellescape}"
 
-        command = "security import #{path.shellescape} -k '#{keychain_path.shellescape}'"
+        command = "security import #{path.shellescape} -k #{keychain_path.shellescape}"
         command << password_part
         command << " -T /usr/bin/codesign" # to not be asked for permission when running a tool like `gym` (before Sierra)
         command << " -T /usr/bin/security"
@@ -30,20 +31,22 @@ module Pindo
           # UI.command_output(stdout.read.to_s) if output
           # puts "123"
           # Set partition list only if success since it can be a time consuming process if a lot of keys are installed
-          if thrd.value.success? && !skip_set_partition_list
+          if thrd.value.success?
             # puts "安装成功!"
-            keychain_password ||= resolve_keychain_password(keychain_path)
-            set_partition_list(path, keychain_path, keychain_password: keychain_password, output: output)
+            unless skip_set_partition_list
+              keychain_password ||= resolve_keychain_password(keychain_path)
+              set_partition_list(path, keychain_path, keychain_password: keychain_password, output: output, strict: strict)
+            end
           else
             # Output verbose if file is already installed since not an error otherwise we will show the whole error
             err = stderr.read.to_s.strip
 
             if err.include?("SecKeychainItemImport") && err.include?("The specified item already exists in the keychain")
+              raise Informative, "钥匙串已存在相关材料，无法确认私钥访问权限；请检查签名身份及访问配置", cause: nil if strict
               # UI.verbose("'}' is already installed on this machine")
               # puts "证书key已经存在，安装完成!"
             else
-              # puts err
-              # raise Informative, err
+              raise Informative, "钥匙串导入失败（访问权限、钥匙串状态或 P12 格式不受支持）", cause: nil if strict
             end
           end
         end
@@ -56,7 +59,7 @@ module Pindo
         return result
       end
 
-      def set_partition_list(path, keychain_path, keychain_password: nil, output: false)
+      def set_partition_list(path, keychain_path, keychain_password: nil, output: false, strict: false)
         # When security supports partition lists, also add the partition IDs
         # See https://openradar.appspot.com/28524119
         if help_backticks('security -h | grep set-key-partition-list', print: false).length > 0
@@ -79,6 +82,7 @@ module Pindo
           Open3.popen3(command) do |stdin, stdout, stderr, thrd|
             unless thrd.value.success?
               err = stderr.read.to_s.strip
+              raise Informative, "钥匙串访问配置失败，请检查 macOS 钥匙串密码", cause: nil if strict
 
               # Inform user when no/wrong password was used as its needed to prevent UI permission popup from Xcode when signing
               if err.include?("SecKeychainItemSetAccessWithPassword")
@@ -130,7 +134,10 @@ module Pindo
             # UI.important("Enter the password for #{keychain_path}")
             # UI.important("This passphrase will be stored in your local keychain with the name #{server} and used in future runs")
             # UI.important("This prompt can be avoided by specifying the 'keychain_password' option or 'MATCH_KEYCHAIN_PASSWORD' environment variable")
-            keychain_password = FastlaneCore::Helper.ask_password(message: "Password for #{keychain_name} keychain: ", confirm: true, confirmation_message: "Type password for #{keychain_name} keychain again: ")
+            # 收起 spinner，否则密码提示会被动画行覆盖，终端看起来像卡死
+            keychain_password = Funlog.with_paused_spinner do
+              FastlaneCore::Helper.ask_password(message: "Password for #{keychain_name} keychain: ", confirm: true, confirmation_message: "Type password for #{keychain_name} keychain again: ")
+            end
             Security::InternetPassword.add(server, "", keychain_password)
           # else
             # UI.important("Keychain password for #{keychain_path} was not specified and not found in your keychain. Specify the 'keychain_password' option to prevent the UI permission popup when code signing")

data/lib/pindo/module/cert/mode/custom_https_cert_operator.rb

@@ -6,6 +6,9 @@ require 'pindo/module/cert/keychain_helper'
 require 'pindo/module/cert/provisioning_helper'
 require 'pindo/module/utils/file_downloader'
 require 'jpsclient'
+require 'json'
+require 'digest'
+require 'pindo/module/cert/p12_material'
 
 module Pindo
   module CertProcess
@@ -51,7 +54,8 @@ module Pindo
             bundle_id_array: bundle_id_array,
             cert_type: cert_type,
             platform_type: platform_type,
-            temp_dir: temp_dir
+            temp_dir: temp_dir,
+            signing_certificate: cert_info[:certificate]
           )
 
           # 6. 验证并保存证书信息，提取 Team ID
@@ -78,14 +82,7 @@ module Pindo
           provisioning_info_array
 
         ensure
-          # 清理临时目录（调试模式下保留）
-          if temp_dir && Dir.exist?(temp_dir)
-            if debug_mode?
-              Funlog.instance.info("调试模式：临时目录已保留: #{temp_dir}")
-            else
-              FileUtils.remove_entry_secure(temp_dir)
-            end
-          end
+          FileUtils.remove_entry_secure(temp_dir) if temp_dir && Dir.exist?(temp_dir)
         end
       end
 
@@ -118,6 +115,17 @@ module Pindo
         end
       end
 
+      # JPS_DEBUG 会打印原始响应（含授权下载 URL）；证书接口必须禁用。
+      def certificate_api(method, **parameters)
+        previous_debug = ENV['JPS_DEBUG']
+        ENV['JPS_DEBUG'] = '0'
+        @jps_client.public_send(method, **parameters)
+      rescue ::StandardError
+        raise Informative, "证书接口请求失败，请检查接口权限和网络", cause: nil
+      ensure
+        previous_debug.nil? ? ENV.delete('JPS_DEBUG') : ENV['JPS_DEBUG'] = previous_debug
+      end
+
       # 下载并安装证书
       def download_and_install_certificates(apple_id:, bundle_id_array:, cert_type:, platform_type:, temp_dir:)
         # 映射到 JPS API 参数
@@ -130,7 +138,7 @@ module Pindo
 
         Funlog.instance.info("查询证书: apple_id=#{apple_id}, platform=#{platform}, profile_type=#{profile_type}") if debug_mode?
 
-        result = @jps_client.get_apple_cert_list(
+        result = certificate_api(:get_apple_cert_list,
           apple_dev_account: apple_id,
           bundle_id: main_bundle_id,
           platform: platform,
@@ -152,8 +160,7 @@ module Pindo
         cert_url = cert_data['cerKeyUrl']           # API 返回字段: cerKeyUrl
         cert_p12_url = cert_data['privateKeyUrl']   # API 返回字段: privateKeyUrl
         cert_name = cert_data['name']               # API 返回字段: name
-        # 注意：API 没有返回 certPassword，使用空字符串（与 Git 模式一致）
-        cert_password = ''
+
 
         Funlog.instance.info("找到证书: #{cert_name}") if debug_mode?
 
@@ -176,18 +183,21 @@ module Pindo
         download_file_from_url(url: cert_p12_url, dest_path: key_path)
         Funlog.instance.info("私钥文件路径: #{key_path}") if debug_mode?
 
+        cert_password = p12_export_password(key_path)
+        material = P12Material.load(cert_path: cert_path, key_path: key_path, password: cert_password)
+
         # 安装证书到 Keychain（明文，无需 AES 解密）
         install_certificate_to_keychain(cert_path: cert_path, key_path: key_path, cert_password: cert_password)
 
         return {
           cert_path: cert_path,
-          cert_password: cert_password,
+          certificate: material.certificate,
           cert_name: cert_name
         }
       end
 
       # 下载并安装描述文件
-      def download_and_install_profiles(apple_id:, bundle_id_array:, cert_type:, platform_type:, temp_dir:)
+      def download_and_install_profiles(apple_id:, bundle_id_array:, cert_type:, platform_type:, temp_dir:, signing_certificate:)
         # 映射到 JPS API 参数
         jps_params = map_to_jps_api_params(cert_type: cert_type, platform_type: platform_type)
         platform = jps_params[:platform]
@@ -205,7 +215,7 @@ module Pindo
 
         # 一次性查询所有 bundle_id 的描述文件
         Funlog.instance.info("查询描述文件: bundle_ids=#{bundle_ids.join(', ')}") if debug_mode?
-        result = @jps_client.get_apple_profile_list(
+        result = certificate_api(:get_apple_profile_list,
           apple_dev_account: apple_id,
           bundle_ids: bundle_ids,  # 修改为 bundle_ids，传递数组
           platform: platform,
@@ -252,16 +262,8 @@ module Pindo
           }
         end
 
-        # 并行下载
-        batch_result = Pindo::FileDownloader.download_batch(
-          tasks: download_tasks,
-          max_threads: 4,
-          silent: !debug_mode?
-        )
-
-        # 检查下载结果
-        if batch_result[:failed] > 0
-          raise Informative, "部分描述文件下载失败 (#{batch_result[:failed]}/#{batch_result[:total]})"
+        download_tasks.each do |task|
+          download_file_from_url(**task)
         end
 
         Funlog.instance.fancyinfo_success("所有描述文件下载完成") unless debug_mode?
@@ -285,6 +287,8 @@ module Pindo
           # 解析描述文件元数据以获取 bundle_id
           profile_info = parse_provisioning_profile(profile_path: temp_profile_path, silent: true)
 
+          validate_profile_certificate!(profile_info, signing_certificate)
+
           # 从解析结果中获取实际的 bundle_id
           actual_bundle_id = profile_bundle_id || extract_bundle_id_from_profile(profile_info)
 
@@ -336,8 +340,8 @@ module Pindo
           }
 
           # 提取签名身份
-          if parsed_data['DeveloperCertificates'] && parsed_data['DeveloperCertificates'].first
-            cert_info = Pindo::CertHelper.send(:get_cert_info, parsed_data["DeveloperCertificates"].first.string).to_h
+          if signing_certificate
+            cert_info = Pindo::CertHelper.send(:get_cert_info, signing_certificate.to_der).to_h
             provisioning_info['signing_identity'] = cert_info["Common Name"]
           end
 
@@ -360,51 +364,89 @@ module Pindo
         return provisioning_info_array
       end
 
-      # 从 URL 下载文件（带重试机制）
+      # 安静下载敏感材料，强制 TLS 验证和受限权限
       def download_file_from_url(url:, dest_path:, silent: false)
-        success = Pindo::FileDownloader.download(
-          url: url,
-          dest_path: dest_path,
-          silent: silent || !debug_mode?
-        )
-
-        unless success
-          raise Informative, "下载文件失败"
+        uri = URI.parse(url.to_s)
+        raise Informative, "证书下载地址必须使用 HTTPS" unless uri.is_a?(URI::HTTPS)
+        URI.open(uri, ssl_verify_mode: OpenSSL::SSL::VERIFY_PEER,
+                 open_timeout: 10, read_timeout: 30) do |remote|
+          File.open(dest_path, File::WRONLY | File::CREAT | File::TRUNC, 0o600) do |file|
+            IO.copy_stream(remote, file)
+          end
         end
+      rescue ::StandardError
+        raise Informative, "证书材料下载失败，请检查下载权限与网络", cause: nil
       end
 
-      # 安装证书到 Keychain（与 Git 模式逻辑相同，跳过 AES 解密）
-      def install_certificate_to_keychain(cert_path:, key_path:, cert_password:)
-        # 只在调试模式下显示安装进度
-        Funlog.instance.fancyinfo_start("正在安装证书...") if debug_mode?
+      # 密码只按当前 P12 的内容指纹查找；不缓存、不读取 API 猜测字段。
+      def p12_export_password(key_path)
+        source = ENV['PINDO_P12_PASSWORD_FILE']
+        return '' if source.nil? || source.empty?
 
-        # 注意：HTTPS 模式的证书是明文，直接安装，无需 AES 解密
-        # 证书验证
-        unless Pindo::CertHelper.is_cert_valid?(cert_path)
-          raise Informative, "证书已经过期，请重新生成新证书!"
+        File.open(source, File::RDONLY | File::NOFOLLOW) do |file|
+          stat = file.stat
+          unless stat.file? && stat.uid == Process.uid && [0o600, 0o400].include?(stat.mode & 0o777)
+            raise Informative, "P12 密码文件必须属于当前用户且权限为 0600 或 0400"
+          end
+          passwords = JSON.parse(file.read)
+          fingerprint = Digest::SHA256.file(key_path).hexdigest
+          password = passwords.fetch(fingerprint, '')
+          raise TypeError unless password.is_a?(String)
+          password
         end
+      rescue ::StandardError
+        raise Informative, "无法读取 P12 密码文件；请检查权限和 SHA-256 密码映射", cause: nil
+      end
 
-        if Pindo::CertHelper.isMac?
-          keychain_name = "login.keychain"
-
-          # 检查证书是否已安装
-          if certificate_installed?(cert_path)
-            Funlog.instance.fancyinfo_success("证书已安装") if debug_mode?
-          else
-            # 获取 Keychain 密码
-            keychain_password = Pindoconfig.instance.cert_key_password
-            keychain = 'login.keychain'
-            keychain_path = FastlaneCore::Helper.keychain_path(keychain)
+      def validate_profile_certificate!(profile, certificate)
+        certificates = profile['DeveloperCertificates'] || []
+        matched = certificates.any? do |entry|
+          der = entry.respond_to?(:string) ? entry.string : entry
+          OpenSSL::X509::Certificate.new(der).to_der == certificate.to_der
+        end
+        raise Informative, "描述文件不包含本次 P12 的签名证书，请更新描述文件" unless matched
+      rescue OpenSSL::X509::CertificateError, TypeError
+        raise Informative, "描述文件中的签名证书无效", cause: nil
+      end
 
-            # 安装证书和私钥（与 CustomGitCertOperator 一致）
-            KeychainHelper.import_file(cert_path, keychain_path, keychain_password: keychain_password, certificate_password: '')
-            KeychainHelper.import_file(key_path, keychain_path, keychain_password: keychain_password, certificate_password: '')
+      def signing_identity_installed?(cert_path, keychain_path)
+        fingerprint = FastlaneCore::CertChecker.sha1_fingerprint(cert_path)
+        output, _error, status = Open3.capture3('security', 'find-identity', '-v', '-p', 'codesigning', keychain_path)
+        raise Informative, "无法检查钥匙串签名身份" unless status.success?
+        output.include?(fingerprint)
+      end
 
-            Funlog.instance.fancyinfo_success("证书安装完成") if debug_mode?
+      def install_certificate_to_keychain(cert_path:, key_path:, cert_password:)
+        material = P12Material.load(cert_path: cert_path, key_path: key_path, password: cert_password)
+        unless Pindo::CertHelper.is_cert_valid?(cert_path)
+          raise Informative, "证书已经过期，请重新生成新证书!"
+        end
+        raise Informative, "非Mac电脑不支持安装证书!" unless Pindo::CertHelper.isMac?
+
+        keychain_path = FastlaneCore::Helper.keychain_path('login.keychain')
+        return if signing_identity_installed?(cert_path, keychain_path)
+
+        keychain_password = Pindoconfig.instance.cert_key_password
+        if material.is_a?(P12Material::PemMaterial)
+          # security 需要完整的证书与私钥；在受限目录中将 PEM 封装为 P12。
+          Dir.mktmpdir('pindo_pem_import_') do |directory|
+            import_path = File.join(directory, 'identity.p12')
+            p12 = OpenSSL::PKCS12.create(cert_password, 'pindo', material.key, material.certificate)
+            File.open(import_path, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write(p12.to_der) }
+            KeychainHelper.import_file(import_path, keychain_path,
+              keychain_password: keychain_password, certificate_password: cert_password, strict: true)
           end
         else
-          Funlog.instance.fancyinfo_error("非Mac电脑不支持安装证书!")
+          KeychainHelper.import_file(key_path, keychain_path,
+            keychain_password: keychain_password, certificate_password: cert_password, strict: true)
+        end
+        unless signing_identity_installed?(cert_path, keychain_path)
+          raise Informative, "钥匙串未出现证书与私钥组成的签名身份，请检查钥匙串访问权限"
         end
+      rescue Informative
+        raise
+      rescue ::StandardError
+        raise Informative, "证书私钥导入失败，请检查钥匙串密码和访问权限", cause: nil
       end
 
       # 安装描述文件（与 Git 模式逻辑相同，跳过 AES 解密）

data/lib/pindo/module/cert/mode/match_git_cert_operator.rb

@@ -1,4 +1,5 @@
 require 'match'
+require 'pindo/base/funlog'
 require 'pindo/config/pindoconfig'
 require 'pindo/config/ios_config_parser'
 require 'pindo/module/cert/mode/base_cert_operator'
@@ -144,7 +145,8 @@ module Pindo
         ENV["GIT_CONFIG_VALUE_#{index}"] = '/dev/null'
         ENV['GIT_CONFIG_COUNT'] = (index + 1).to_s
 
-        Match::Runner.new.run(config)
+        # 收起 spinner：match 过程中会提示输入仓库 passphrase、Apple ID 密码和 2FA 验证码
+        Funlog.with_paused_spinner { Match::Runner.new.run(config) }
       ensure
         saved_env.each { |key, value| ENV[key] = value } if saved_env
       end

data/lib/pindo/module/cert/p12_material.rb

@@ -0,0 +1,68 @@
+require 'openssl'
+
+module Pindo
+  module CertProcess
+    # Validate the freshly downloaded material before touching a user's keychain.
+    class P12Material
+      PemMaterial = Struct.new(:key, :certificate)
+
+      def self.load(cert_path:, key_path:, password:)
+        certificate = OpenSSL::X509::Certificate.new(File.binread(cert_path))
+        content = File.binread(key_path)
+        material = if content.include?('-----BEGIN ')
+                     parse_pem(content, password, certificate)
+                   else
+                     parse(key_path, password)
+                   end
+        unless material.key
+          raise Informative, 'P12 私钥缺失，请重新导出包含私钥的 P12', cause: nil
+        end
+        unless material.certificate
+          raise Informative, 'P12 证书缺失，请重新导出包含证书的 P12', cause: nil
+        end
+
+        unless material.certificate.to_der == certificate.to_der && certificate.check_private_key(material.key)
+          raise Informative, '私钥或证书与下载的 CER 证书不匹配，请更新同一套证书材料', cause: nil
+        end
+        material
+      rescue OpenSSL::X509::CertificateError, OpenSSL::PKey::PKeyError
+        raise Informative, '证书或私钥格式无效，请重新导出证书材料', cause: nil
+      rescue SystemCallError, IOError
+        raise Informative, '无法读取证书材料，请重新下载', cause: nil
+      end
+
+      def self.parse_pem(content, password, certificate)
+        unless content.match?(/-----BEGIN (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----/)
+          raise Informative, 'PEM 私钥缺失，请提供包含私钥的 PEM 文件', cause: nil
+        end
+        key = OpenSSL::PKey.read(content, password.to_s)
+        unless key.respond_to?(:private?) && key.private?
+          raise Informative, 'PEM 私钥缺失，请提供包含私钥的 PEM 文件', cause: nil
+        end
+        PemMaterial.new(key, certificate)
+      rescue OpenSSL::PKey::PKeyError => error
+        if error.message.match?(/unsupported|unknown cipher|unknown pbe|fetch failed|disabled|not supported/i)
+          raise Informative, 'PEM 加密算法不兼容当前 OpenSSL，请以现代算法重新导出', cause: nil
+        elsif content.include?('ENCRYPTED')
+          raise Informative, 'PEM 私钥解密失败，请检查导出密码及文件完整性', cause: nil
+        else
+          raise Informative, 'PEM 私钥格式无效或文件已损坏', cause: nil
+        end
+      end
+      private_class_method :parse_pem
+
+      def self.parse(key_path, password)
+        OpenSSL::PKCS12.new(File.binread(key_path), password)
+      rescue OpenSSL::PKCS12::PKCS12Error => error
+        if error.message.match?(/unsupported|unknown cipher|unknown pbe|fetch failed|disabled|not supported/i)
+          raise Informative, 'P12 加密算法不兼容当前 OpenSSL；请使用兼容旧算法的工具读取后，以现代加密算法重新导出 P12', cause: nil
+        elsif error.message.match?(/mac verify|invalid password|cipherfinal|bad decrypt/i)
+          raise Informative, 'P12 导出密码错误或文件完整性校验失败，请核对该文件对应的导出密码', cause: nil
+        else
+          raise Informative, 'P12 文件格式无效或已损坏，请重新导出（不能据此判定为密码错误）', cause: nil
+        end
+      end
+      private_class_method :parse
+    end
+  end
+end

data/lib/pindo/module/xcode/scene_lifecycle_guard.rb

@@ -0,0 +1,129 @@
+require 'find'
+require 'open3'
+require 'xcodeproj'
+require 'pindo/base/funlog'
+require 'pindo/base/informative'
+
+module Pindo
+  # iOS 27 起，链接 iOS 27 SDK 却未采用 UIScene 生命周期的 App 启动即被 UIKit 终止
+  # （EXC_BREAKPOINT：_UIApplicationEvaluateRuntimeIssueForNoSceneLifecycleAdoption）。
+  # 在 gym 之前拦截，避免导出装上就崩的 IPA。Info.plist 路径解析复用 XcodeBuildHelper，
+  # 由调用方 xcode_build_helper.rb 负责加载。
+  module SceneLifecycleGuard
+    REQUIRED_SDK_MAJOR = 27
+
+    SCENE_MANIFEST_GENERATION_SETTING = 'INFOPLIST_KEY_UIApplicationSceneManifest_Generation'.freeze
+
+    # Apple 把 AppDelegate 实现 application:configurationForConnectingSceneSession:options:
+    # （Swift 为 configurationForConnecting）也算作采用；只认方法实现，不认调用和注释
+    SCENE_CONFIGURATION_PATTERN = Regexp.union(
+      /-\s*\(\s*UISceneConfiguration\s*\*\s*\)\s*application\s*:[^;{]*configurationForConnectingSceneSession\s*:/,
+      /func\s+application\s*\([^)]*configurationForConnecting\b/
+    ).freeze
+
+    SOURCE_EXTENSIONS = %w[.m .mm .swift].freeze
+
+    EXCLUDED_DIRECTORY_NAMES = %w[.git Pods build DerivedData].freeze
+
+    class << self
+      # @param project_dir [String] 工程目录（绝对路径）
+      # @param project_fullname [String] .xcodeproj 路径
+      # @raise [Informative] 使用 iOS 27+ SDK 构建且主 App target 未采用 UIScene 生命周期
+      def check!(project_dir:, project_fullname:)
+        project_obj = Xcodeproj::Project.open(project_fullname)
+        app_target = main_app_target(project_obj)
+        return if app_target.nil? || macos_target?(app_target)
+
+        sdk_version = iphoneos_sdk_version
+        if sdk_version.nil?
+          Funlog.instance.fancyinfo_warning("无法获取 iOS SDK 版本，跳过 UIScene 生命周期检查")
+          return
+        end
+        return if sdk_version.split('.').first.to_i < REQUIRED_SDK_MAJOR
+
+        release_config = release_configuration(app_target)
+        info_plist_path = XcodeBuildHelper.resolve_info_plist_path(
+          project_dir, release_config.build_settings['INFOPLIST_FILE'], target: app_target
+        )
+        return if scene_manifest_declared?(info_plist_path)
+        return if scene_manifest_generated?(release_config)
+        return if delegate_provides_scene_configuration?(project_dir)
+
+        raise Informative, adoption_error_message(sdk_version, info_plist_path)
+      end
+
+      # 构建将使用的 iphoneos SDK 版本（随 xcode-select / DEVELOPER_DIR），取不到返回 nil
+      def iphoneos_sdk_version
+        stdout, _stderr, status = Open3.capture3('xcrun', '--sdk', 'iphoneos', '--show-sdk-version')
+        version = stdout.strip
+        status.success? && version.match?(/\A\d+(\.\d+)*\z/) ? version : nil
+      rescue SystemCallError
+        nil
+      end
+
+      private
+
+      def main_app_target(project_obj)
+        application_uti = Xcodeproj::Constants::PRODUCT_TYPE_UTI[:application]
+        project_obj.targets.find do |target|
+          target.respond_to?(:product_type) && target.product_type == application_uti
+        end
+      end
+
+      def release_configuration(target)
+        target.build_configurations.find { |config| config.name == 'Release' } || target.build_configurations.first
+      end
+
+      def macos_target?(target)
+        release_configuration(target).resolve_build_setting('SDKROOT').to_s.start_with?('macosx')
+      end
+
+      def scene_manifest_declared?(info_plist_path)
+        return false if info_plist_path.nil?
+
+        manifest = Xcodeproj::Plist.read_from_path(info_plist_path)['UIApplicationSceneManifest']
+        configurations = manifest.is_a?(Hash) ? manifest['UISceneConfigurations'] : nil
+        return false unless configurations.is_a?(Hash)
+
+        configurations.values.any? { |roles| roles.is_a?(Array) && !roles.empty? }
+      end
+
+      # Xcode 只在 GENERATE_INFOPLIST_FILE = YES 时采用 INFOPLIST_KEY_* 设置
+      def scene_manifest_generated?(release_config)
+        settings = release_config.build_settings
+        settings['GENERATE_INFOPLIST_FILE'].to_s.casecmp?('YES') &&
+          settings[SCENE_MANIFEST_GENERATION_SETTING].to_s.casecmp?('YES')
+      end
+
+      def delegate_provides_scene_configuration?(project_dir)
+        each_source_file(project_dir).any? do |path|
+          File.binread(path).match?(SCENE_CONFIGURATION_PATTERN)
+        end
+      end
+
+      def each_source_file(project_dir)
+        return enum_for(:each_source_file, project_dir) unless block_given?
+
+        Find.find(project_dir) do |path|
+          if File.directory?(path)
+            Find.prune if path != project_dir && EXCLUDED_DIRECTORY_NAMES.include?(File.basename(path))
+          elsif SOURCE_EXTENSIONS.include?(File.extname(path))
+            yield path
+          end
+        end
+      end
+
+      def adoption_error_message(sdk_version, info_plist_path)
+        [
+          "使用 iOS SDK #{sdk_version} 构建的 App 未采用 UIScene 生命周期，在 iOS 27 上启动即崩溃" \
+            "（EXC_BREAKPOINT：_UIApplicationEvaluateRuntimeIssueForNoSceneLifecycleAdoption）。",
+          "Unity 导出工程：把 GoodUnityBuild 升级到 1.17.0 及以上后重新导出" \
+            "（自动加入 GoodUnitySceneDelegate 与 Info.plist UIApplicationSceneManifest）。",
+          "原生工程：添加 scene delegate 并在 Info.plist 声明 UIApplicationSceneManifest，" \
+            "或由 AppDelegate 实现 application:configurationForConnectingSceneSession:options:。",
+          "检查的 Info.plist：#{info_plist_path || '未找到'}"
+        ].join("\n")
+      end
+    end
+  end
+end

data/lib/pindo/module/xcode/xcode_build_helper.rb

@@ -1,6 +1,7 @@
 require 'fileutils'
 require 'xcodeproj'
 require 'json'
+require 'pindo/module/xcode/scene_lifecycle_guard'
 
 module Pindo
 
@@ -676,6 +677,7 @@ module Pindo
         # @param icloud_id [String, nil] iCloud ID（可选）
         # @return [String, nil] 生成的 IPA 文件路径，失败返回 nil
         def build_project(project_dir:, icloud_id: nil)
+            project_dir = File.expand_path(project_dir)
             project_fullname = Dir.glob(File.join(project_dir, "/*.xcodeproj")).max_by { |f| File.mtime(f) }
 
             if project_fullname.nil?
@@ -686,6 +688,9 @@ module Pindo
             # 修复 Xcode 16 链接器兼容性问题
             fix_xcode16_linker_flags(project_dir: project_dir)
 
+            # iOS 27+ SDK 构建的 App 未采用 UIScene 生命周期会启动即崩，gym 之前拦截
+            SceneLifecycleGuard.check!(project_dir: project_dir, project_fullname: project_fullname)
+
             # 清理旧的 build 目录 (使用绝对路径)
             build_dir = File.join(project_dir, "build")
             FileUtils.rm_rf(build_dir) if File.exist?(build_dir)
@@ -705,6 +710,15 @@ module Pindo
             config = FastlaneCore::Configuration.create(Gym::Options.available_options, gym_options)
             Gym::Manager.new.work(config)
 
+            # An external Unity export may replace the caller's directory while gym runs.
+            # Xcodeproj::Project.open reads Pathname.pwd even for absolute paths.
+            # Rebind only an invalid cwd; leave valid callers/concurrent tasks unchanged.
+            begin
+                Dir.pwd
+            rescue Errno::ENOENT
+                Dir.chdir(project_dir)
+            end
+
             # 检测平台类型
             require 'xcodeproj'
             project_obj = Xcodeproj::Project.open(project_fullname)

data/lib/pindo/version.rb

@@ -6,7 +6,7 @@ require 'time'
 
 module Pindo
 
-  VERSION = "5.21.0"
+  VERSION = "5.21.2"
 
   class VersionCheck
     RUBYGEMS_API = 'https://rubygems.org/api/v1/gems/pindo.json'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pindo
 version: !ruby/object:Gem::Version
-  version: 5.21.0
+  version: 5.21.2
 platform: ruby
 authors:
 - wade
@@ -404,6 +404,7 @@ files:
 - lib/pindo/module/cert/mode/custom_git_cert_operator.rb
 - lib/pindo/module/cert/mode/custom_https_cert_operator.rb
 - lib/pindo/module/cert/mode/match_git_cert_operator.rb
+- lib/pindo/module/cert/p12_material.rb
 - lib/pindo/module/cert/pem_helper.rb
 - lib/pindo/module/cert/provisioning_helper.rb
 - lib/pindo/module/pgyer/media_url_helper.rb
@@ -485,6 +486,7 @@ files:
 - lib/pindo/module/xcode/mac_app_resign_helper.rb
 - lib/pindo/module/xcode/res/xcode_res_constant.rb
 - lib/pindo/module/xcode/res/xcode_res_handler.rb
+- lib/pindo/module/xcode/scene_lifecycle_guard.rb
 - lib/pindo/module/xcode/xcode_app_config.rb
 - lib/pindo/module/xcode/xcode_build_config.rb
 - lib/pindo/module/xcode/xcode_build_helper.rb