pindo 5.21.2 → 5.21.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8fc2d66a2010bba4e00fe508252a291bac2efda4623ded2135bf707b6f93ade0
-  data.tar.gz: cfca3acb943122590ffeba33d95249c2d73143b7e51ff87e74ef5342e44dd67f
+  metadata.gz: a600e7bb32da7ea1ef2ed73200663b344ad302d9ead4279ed6c5973caa168e4a
+  data.tar.gz: f56d3755cf9844773d98afe6778becf92dc8ea40f7c5fc96a55635ac332a079d
 SHA512:
-  metadata.gz: 652bf861a3896a3763e38ff0f7142128dace9d221350db4a353b1f6ad22fd19dc5661ac926825438cf5dae7fdf287221b3888b8b84d6dccf6d54be024bac759b
-  data.tar.gz: bfd8a3891dc78f37fa1bccec6a67eb9dd7f6f8a4f4cac86d95788d0d64b63e938dd6385579ac3d0bc50141629bc236f2bf4a16d69f597b7036f8a1b497c03cb4
+  metadata.gz: 5bad05ce63824706c5bd0b1b2a2e127d6122e81d2ba60dcb8d56cee2d25787de2359cdc2b3f389ca10255008c0edc30230ccf4fc58aaf4ff09b7329cf2b98a0b
+  data.tar.gz: a7dfdebb7fbc7f0d28de181c4136e30c780da7913c9ed65bfff0bc471d5fd05c6e26f3808fd1238fd36572bd6d73d775599e07f62e46e49b0dfd3b44d93e25ba

data/lib/pindo/module/cert/mode/custom_https_cert_operator.rb

@@ -9,6 +9,7 @@ require 'jpsclient'
 require 'json'
 require 'digest'
 require 'pindo/module/cert/p12_material'
+require 'pindo/module/cert/p12_password_resolver'
 
 module Pindo
   module CertProcess
@@ -183,8 +184,9 @@ module Pindo
         download_file_from_url(url: cert_p12_url, dest_path: key_path)
         Funlog.instance.info("私钥文件路径: #{key_path}") if debug_mode?
 
-        cert_password = p12_export_password(key_path)
-        material = P12Material.load(cert_path: cert_path, key_path: key_path, password: cert_password)
+        cert_password, material = P12PasswordResolver.resolve(
+          cert_path: cert_path, key_path: key_path, file_password: p12_export_password(key_path)
+        )
 
         # 安装证书到 Keychain（明文，无需 AES 解密）
         install_certificate_to_keychain(cert_path: cert_path, key_path: key_path, cert_password: cert_password)
@@ -378,10 +380,10 @@ module Pindo
         raise Informative, "证书材料下载失败，请检查下载权限与网络", cause: nil
       end
 
-      # 密码只按当前 P12 的内容指纹查找；不缓存、不读取 API 猜测字段。
+      # 文件密码按当前材料内容指纹查找；nil 表示继续查找钥匙串。
       def p12_export_password(key_path)
         source = ENV['PINDO_P12_PASSWORD_FILE']
-        return '' if source.nil? || source.empty?
+        return nil if source.nil? || source.empty?
 
         File.open(source, File::RDONLY | File::NOFOLLOW) do |file|
           stat = file.stat
@@ -390,7 +392,9 @@ module Pindo
           end
           passwords = JSON.parse(file.read)
           fingerprint = Digest::SHA256.file(key_path).hexdigest
-          password = passwords.fetch(fingerprint, '')
+          raise TypeError unless passwords.is_a?(Hash)
+          return nil unless passwords.key?(fingerprint)
+          password = passwords.fetch(fingerprint)
           raise TypeError unless password.is_a?(String)
           password
         end

data/lib/pindo/module/cert/p12_material.rb

@@ -5,6 +5,7 @@ module Pindo
     # Validate the freshly downloaded material before touching a user's keychain.
     class P12Material
       PemMaterial = Struct.new(:key, :certificate)
+      class PasswordError < Informative; end
 
       def self.load(cert_path:, key_path:, password:)
         certificate = OpenSSL::X509::Certificate.new(File.binread(cert_path))
@@ -44,7 +45,7 @@ module Pindo
         if error.message.match?(/unsupported|unknown cipher|unknown pbe|fetch failed|disabled|not supported/i)
           raise Informative, 'PEM 加密算法不兼容当前 OpenSSL，请以现代算法重新导出', cause: nil
         elsif content.include?('ENCRYPTED')
-          raise Informative, 'PEM 私钥解密失败，请检查导出密码及文件完整性', cause: nil
+          raise PasswordError, 'PEM 私钥解密失败，请检查导出密码及文件完整性', cause: nil
         else
           raise Informative, 'PEM 私钥格式无效或文件已损坏', cause: nil
         end
@@ -57,7 +58,7 @@ module Pindo
         if error.message.match?(/unsupported|unknown cipher|unknown pbe|fetch failed|disabled|not supported/i)
           raise Informative, 'P12 加密算法不兼容当前 OpenSSL；请使用兼容旧算法的工具读取后，以现代加密算法重新导出 P12', cause: nil
         elsif error.message.match?(/mac verify|invalid password|cipherfinal|bad decrypt/i)
-          raise Informative, 'P12 导出密码错误或文件完整性校验失败，请核对该文件对应的导出密码', cause: nil
+          raise PasswordError, 'P12 导出密码错误或文件完整性校验失败，请核对该文件对应的导出密码', cause: nil
         else
           raise Informative, 'P12 文件格式无效或已损坏，请重新导出（不能据此判定为密码错误）', cause: nil
         end

data/lib/pindo/module/cert/p12_password_resolver.rb

@@ -0,0 +1,110 @@
+require 'digest'
+require 'open3'
+require 'pindo/base/funlog'
+require 'pindo/module/cert/p12_material'
+
+module Pindo
+  module CertProcess
+    # Capture both output streams: security gem's system calls can expose raw errors.
+    class P12ExportPasswordStore
+      Item = Struct.new(:password)
+
+      def self.find(server:)
+        output, _error, status = Open3.capture3('security', 'find-internet-password', '-w', '-s', server, '-a', '')
+        return nil if status.exitstatus == 44
+        fail_access! unless status.success?
+
+        Item.new(output.sub(/\n\z/, ''))
+      rescue Informative
+        raise
+      rescue ::StandardError
+        fail_access!
+      end
+
+      def self.add(server, account, password)
+        _output, _error, status = Open3.capture3('security', 'add-internet-password', '-s', server, '-a', account, '-w', password)
+        fail_access! unless status.success?
+        true
+      rescue Informative
+        raise
+      rescue ::StandardError
+        fail_access!
+      end
+
+      def self.delete(server:)
+        _output, _error, status = Open3.capture3('security', 'delete-internet-password', '-s', server, '-a', '')
+        fail_access! unless status.success?
+        true
+      rescue Informative
+        raise
+      rescue ::StandardError
+        fail_access!
+      end
+
+      def self.fail_access!
+        raise Informative, '无法访问私钥导出密码钥匙串条目，请检查 macOS 钥匙串权限', cause: nil
+      end
+      private_class_method :fail_access!
+    end
+
+    # Export passwords are scoped to the exact downloaded material, not a keychain password.
+    class P12PasswordResolver
+      def self.resolve(cert_path:, key_path:, file_password:)
+        resolver = new(cert_path, key_path)
+        resolver.resolve(file_password)
+      end
+
+      def initialize(cert_path, key_path)
+        @cert_path = cert_path
+        @key_path = key_path
+        @server = "pindo_p12_export_#{Digest::SHA256.file(key_path).hexdigest}"
+      end
+
+      def resolve(file_password)
+        return validate(file_password) unless file_password.nil?
+
+        item = keychain { P12ExportPasswordStore.find(server: @server) }
+        begin
+          return validate(item ? keychain { item.password } : '')
+        rescue P12Material::PasswordError
+          keychain { P12ExportPasswordStore.delete(server: @server) } if item
+        end
+
+        password = prompt
+        result = validate(password)
+        keychain { P12ExportPasswordStore.add(@server, '', password) }
+        result
+      end
+
+      private
+
+      def validate(password)
+        material = P12Material.load(cert_path: @cert_path, key_path: @key_path, password: password)
+        [password, material]
+      end
+
+      def prompt
+        unless $stdin.tty? && $stdout.tty?
+          raise Informative, '非交互环境缺少有效的私钥导出密码，请配置 PINDO_P12_PASSWORD_FILE 或预先保存到钥匙串', cause: nil
+        end
+        password = Funlog.with_paused_spinner do
+          FastlaneCore::Helper.ask_password(message: '请输入当前证书材料的导出密码（非 macOS 钥匙串密码）：')
+        end
+        unless password.is_a?(String)
+          raise Informative, '未输入有效的私钥导出密码', cause: nil
+        end
+        password
+      rescue Informative
+        raise
+      rescue ::StandardError
+        raise Informative, '无法读取控制台导出密码', cause: nil
+      end
+
+      def keychain
+        yield
+      rescue ::StandardError
+        raise Informative, '无法读取或保存私钥导出密码，请检查 macOS 钥匙串访问权限', cause: nil
+      end
+    end
+  end
+end

data/lib/pindo/version.rb

@@ -6,7 +6,7 @@ require 'time'
 
 module Pindo
 
-  VERSION = "5.21.2"
+  VERSION = "5.21.3"
 
   class VersionCheck
     RUBYGEMS_API = 'https://rubygems.org/api/v1/gems/pindo.json'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pindo
 version: !ruby/object:Gem::Version
-  version: 5.21.2
+  version: 5.21.3
 platform: ruby
 authors:
 - wade
@@ -405,6 +405,7 @@ files:
 - lib/pindo/module/cert/mode/custom_https_cert_operator.rb
 - lib/pindo/module/cert/mode/match_git_cert_operator.rb
 - lib/pindo/module/cert/p12_material.rb
+- lib/pindo/module/cert/p12_password_resolver.rb
 - lib/pindo/module/cert/pem_helper.rb
 - lib/pindo/module/cert/provisioning_helper.rb
 - lib/pindo/module/pgyer/media_url_helper.rb