pindo 5.21.1 → 5.21.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9b5f3575cc74dd8a938b4d669903f9a80bdd3a097919b0e28b22cb62eb90a804
-  data.tar.gz: d7317665a2b0e1175236e1818f033220827ba5debab25e05d2a0dc809780a2e7
+  metadata.gz: a600e7bb32da7ea1ef2ed73200663b344ad302d9ead4279ed6c5973caa168e4a
+  data.tar.gz: f56d3755cf9844773d98afe6778becf92dc8ea40f7c5fc96a55635ac332a079d
 SHA512:
-  metadata.gz: cbe2ea9dba2f316e0c9bffe62821f4d96beceb57de318d22e3a16c12944361c83ab49f1c1ae0db6e987c7433ce535af5523d0b30e95ac92a01646ff14825a205
-  data.tar.gz: 54d5ed72289954705f10f91bbb8281c7b9bdf543fbdc16f63d7bf863f84f4c0a606c0d5d2386aa6620d51e1349ce91de05a0fbe88aa9b8a68a45bce7a9d3d9f6
+  metadata.gz: 5bad05ce63824706c5bd0b1b2a2e127d6122e81d2ba60dcb8d56cee2d25787de2359cdc2b3f389ca10255008c0edc30230ccf4fc58aaf4ff09b7329cf2b98a0b
+  data.tar.gz: a7dfdebb7fbc7f0d28de181c4136e30c780da7913c9ed65bfff0bc471d5fd05c6e26f3808fd1238fd36572bd6d73d775599e07f62e46e49b0dfd3b44d93e25ba

data/lib/pindo/module/cert/mode/custom_https_cert_operator.rb

@@ -9,6 +9,7 @@ require 'jpsclient'
 require 'json'
 require 'digest'
 require 'pindo/module/cert/p12_material'
+require 'pindo/module/cert/p12_password_resolver'
 
 module Pindo
   module CertProcess
@@ -183,8 +184,9 @@ module Pindo
         download_file_from_url(url: cert_p12_url, dest_path: key_path)
         Funlog.instance.info("私钥文件路径: #{key_path}") if debug_mode?
 
-        cert_password = p12_export_password(key_path)
-        material = P12Material.load(cert_path: cert_path, key_path: key_path, password: cert_password)
+        cert_password, material = P12PasswordResolver.resolve(
+          cert_path: cert_path, key_path: key_path, file_password: p12_export_password(key_path)
+        )
 
         # 安装证书到 Keychain（明文，无需 AES 解密）
         install_certificate_to_keychain(cert_path: cert_path, key_path: key_path, cert_password: cert_password)
@@ -378,10 +380,10 @@ module Pindo
         raise Informative, "证书材料下载失败，请检查下载权限与网络", cause: nil
       end
 
-      # 密码只按当前 P12 的内容指纹查找；不缓存、不读取 API 猜测字段。
+      # 文件密码按当前材料内容指纹查找；nil 表示继续查找钥匙串。
       def p12_export_password(key_path)
         source = ENV['PINDO_P12_PASSWORD_FILE']
-        return '' if source.nil? || source.empty?
+        return nil if source.nil? || source.empty?
 
         File.open(source, File::RDONLY | File::NOFOLLOW) do |file|
           stat = file.stat
@@ -390,7 +392,9 @@ module Pindo
           end
           passwords = JSON.parse(file.read)
           fingerprint = Digest::SHA256.file(key_path).hexdigest
-          password = passwords.fetch(fingerprint, '')
+          raise TypeError unless passwords.is_a?(Hash)
+          return nil unless passwords.key?(fingerprint)
+          password = passwords.fetch(fingerprint)
           raise TypeError unless password.is_a?(String)
           password
         end
@@ -417,7 +421,7 @@ module Pindo
       end
 
       def install_certificate_to_keychain(cert_path:, key_path:, cert_password:)
-        P12Material.load(cert_path: cert_path, key_path: key_path, password: cert_password)
+        material = P12Material.load(cert_path: cert_path, key_path: key_path, password: cert_password)
         unless Pindo::CertHelper.is_cert_valid?(cert_path)
           raise Informative, "证书已经过期，请重新生成新证书!"
         end
@@ -427,8 +431,19 @@ module Pindo
         return if signing_identity_installed?(cert_path, keychain_path)
 
         keychain_password = Pindoconfig.instance.cert_key_password
-        KeychainHelper.import_file(key_path, keychain_path,
-          keychain_password: keychain_password, certificate_password: cert_password, strict: true)
+        if material.is_a?(P12Material::PemMaterial)
+          # security 需要完整的证书与私钥；在受限目录中将 PEM 封装为 P12。
+          Dir.mktmpdir('pindo_pem_import_') do |directory|
+            import_path = File.join(directory, 'identity.p12')
+            p12 = OpenSSL::PKCS12.create(cert_password, 'pindo', material.key, material.certificate)
+            File.open(import_path, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write(p12.to_der) }
+            KeychainHelper.import_file(import_path, keychain_path,
+              keychain_password: keychain_password, certificate_password: cert_password, strict: true)
+          end
+        else
+          KeychainHelper.import_file(key_path, keychain_path,
+            keychain_password: keychain_password, certificate_password: cert_password, strict: true)
+        end
         unless signing_identity_installed?(cert_path, keychain_path)
           raise Informative, "钥匙串未出现证书与私钥组成的签名身份，请检查钥匙串访问权限"
         end

data/lib/pindo/module/cert/p12_material.rb

@@ -4,8 +4,17 @@ module Pindo
   module CertProcess
     # Validate the freshly downloaded material before touching a user's keychain.
     class P12Material
+      PemMaterial = Struct.new(:key, :certificate)
+      class PasswordError < Informative; end
+
       def self.load(cert_path:, key_path:, password:)
-        material = parse(key_path, password)
+        certificate = OpenSSL::X509::Certificate.new(File.binread(cert_path))
+        content = File.binread(key_path)
+        material = if content.include?('-----BEGIN ')
+                     parse_pem(content, password, certificate)
+                   else
+                     parse(key_path, password)
+                   end
         unless material.key
           raise Informative, 'P12 私钥缺失，请重新导出包含私钥的 P12', cause: nil
         end
@@ -13,9 +22,8 @@ module Pindo
           raise Informative, 'P12 证书缺失，请重新导出包含证书的 P12', cause: nil
         end
 
-        certificate = OpenSSL::X509::Certificate.new(File.binread(cert_path))
         unless material.certificate.to_der == certificate.to_der && certificate.check_private_key(material.key)
-          raise Informative, 'P12 私钥或证书与下载的 CER 证书不匹配，请更新同一套证书材料', cause: nil
+          raise Informative, '私钥或证书与下载的 CER 证书不匹配，请更新同一套证书材料', cause: nil
         end
         material
       rescue OpenSSL::X509::CertificateError, OpenSSL::PKey::PKeyError
@@ -24,13 +32,33 @@ module Pindo
         raise Informative, '无法读取证书材料，请重新下载', cause: nil
       end
 
+      def self.parse_pem(content, password, certificate)
+        unless content.match?(/-----BEGIN (?:RSA |EC |DSA |ENCRYPTED )?PRIVATE KEY-----/)
+          raise Informative, 'PEM 私钥缺失，请提供包含私钥的 PEM 文件', cause: nil
+        end
+        key = OpenSSL::PKey.read(content, password.to_s)
+        unless key.respond_to?(:private?) && key.private?
+          raise Informative, 'PEM 私钥缺失，请提供包含私钥的 PEM 文件', cause: nil
+        end
+        PemMaterial.new(key, certificate)
+      rescue OpenSSL::PKey::PKeyError => error
+        if error.message.match?(/unsupported|unknown cipher|unknown pbe|fetch failed|disabled|not supported/i)
+          raise Informative, 'PEM 加密算法不兼容当前 OpenSSL，请以现代算法重新导出', cause: nil
+        elsif content.include?('ENCRYPTED')
+          raise PasswordError, 'PEM 私钥解密失败，请检查导出密码及文件完整性', cause: nil
+        else
+          raise Informative, 'PEM 私钥格式无效或文件已损坏', cause: nil
+        end
+      end
+      private_class_method :parse_pem
+
       def self.parse(key_path, password)
         OpenSSL::PKCS12.new(File.binread(key_path), password)
       rescue OpenSSL::PKCS12::PKCS12Error => error
         if error.message.match?(/unsupported|unknown cipher|unknown pbe|fetch failed|disabled|not supported/i)
           raise Informative, 'P12 加密算法不兼容当前 OpenSSL；请使用兼容旧算法的工具读取后，以现代加密算法重新导出 P12', cause: nil
         elsif error.message.match?(/mac verify|invalid password|cipherfinal|bad decrypt/i)
-          raise Informative, 'P12 导出密码错误或文件完整性校验失败，请核对该文件对应的导出密码', cause: nil
+          raise PasswordError, 'P12 导出密码错误或文件完整性校验失败，请核对该文件对应的导出密码', cause: nil
         else
           raise Informative, 'P12 文件格式无效或已损坏，请重新导出（不能据此判定为密码错误）', cause: nil
         end

data/lib/pindo/module/cert/p12_password_resolver.rb

@@ -0,0 +1,110 @@
+require 'digest'
+require 'open3'
+require 'pindo/base/funlog'
+require 'pindo/module/cert/p12_material'
+
+module Pindo
+  module CertProcess
+    # Capture both output streams: security gem's system calls can expose raw errors.
+    class P12ExportPasswordStore
+      Item = Struct.new(:password)
+
+      def self.find(server:)
+        output, _error, status = Open3.capture3('security', 'find-internet-password', '-w', '-s', server, '-a', '')
+        return nil if status.exitstatus == 44
+        fail_access! unless status.success?
+
+        Item.new(output.sub(/\n\z/, ''))
+      rescue Informative
+        raise
+      rescue ::StandardError
+        fail_access!
+      end
+
+      def self.add(server, account, password)
+        _output, _error, status = Open3.capture3('security', 'add-internet-password', '-s', server, '-a', account, '-w', password)
+        fail_access! unless status.success?
+        true
+      rescue Informative
+        raise
+      rescue ::StandardError
+        fail_access!
+      end
+
+      def self.delete(server:)
+        _output, _error, status = Open3.capture3('security', 'delete-internet-password', '-s', server, '-a', '')
+        fail_access! unless status.success?
+        true
+      rescue Informative
+        raise
+      rescue ::StandardError
+        fail_access!
+      end
+
+      def self.fail_access!
+        raise Informative, '无法访问私钥导出密码钥匙串条目，请检查 macOS 钥匙串权限', cause: nil
+      end
+      private_class_method :fail_access!
+    end
+
+    # Export passwords are scoped to the exact downloaded material, not a keychain password.
+    class P12PasswordResolver
+      def self.resolve(cert_path:, key_path:, file_password:)
+        resolver = new(cert_path, key_path)
+        resolver.resolve(file_password)
+      end
+
+      def initialize(cert_path, key_path)
+        @cert_path = cert_path
+        @key_path = key_path
+        @server = "pindo_p12_export_#{Digest::SHA256.file(key_path).hexdigest}"
+      end
+
+      def resolve(file_password)
+        return validate(file_password) unless file_password.nil?
+
+        item = keychain { P12ExportPasswordStore.find(server: @server) }
+        begin
+          return validate(item ? keychain { item.password } : '')
+        rescue P12Material::PasswordError
+          keychain { P12ExportPasswordStore.delete(server: @server) } if item
+        end
+
+        password = prompt
+        result = validate(password)
+        keychain { P12ExportPasswordStore.add(@server, '', password) }
+        result
+      end
+
+      private
+
+      def validate(password)
+        material = P12Material.load(cert_path: @cert_path, key_path: @key_path, password: password)
+        [password, material]
+      end
+
+      def prompt
+        unless $stdin.tty? && $stdout.tty?
+          raise Informative, '非交互环境缺少有效的私钥导出密码，请配置 PINDO_P12_PASSWORD_FILE 或预先保存到钥匙串', cause: nil
+        end
+        password = Funlog.with_paused_spinner do
+          FastlaneCore::Helper.ask_password(message: '请输入当前证书材料的导出密码（非 macOS 钥匙串密码）：')
+        end
+        unless password.is_a?(String)
+          raise Informative, '未输入有效的私钥导出密码', cause: nil
+        end
+        password
+      rescue Informative
+        raise
+      rescue ::StandardError
+        raise Informative, '无法读取控制台导出密码', cause: nil
+      end
+
+      def keychain
+        yield
+      rescue ::StandardError
+        raise Informative, '无法读取或保存私钥导出密码，请检查 macOS 钥匙串访问权限', cause: nil
+      end
+    end
+  end
+end

data/lib/pindo/version.rb

@@ -6,7 +6,7 @@ require 'time'
 
 module Pindo
 
-  VERSION = "5.21.1"
+  VERSION = "5.21.3"
 
   class VersionCheck
     RUBYGEMS_API = 'https://rubygems.org/api/v1/gems/pindo.json'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pindo
 version: !ruby/object:Gem::Version
-  version: 5.21.1
+  version: 5.21.3
 platform: ruby
 authors:
 - wade
@@ -405,6 +405,7 @@ files:
 - lib/pindo/module/cert/mode/custom_https_cert_operator.rb
 - lib/pindo/module/cert/mode/match_git_cert_operator.rb
 - lib/pindo/module/cert/p12_material.rb
+- lib/pindo/module/cert/p12_password_resolver.rb
 - lib/pindo/module/cert/pem_helper.rb
 - lib/pindo/module/cert/provisioning_helper.rb
 - lib/pindo/module/pgyer/media_url_helper.rb