pindo 5.21.2 → 5.21.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8fc2d66a2010bba4e00fe508252a291bac2efda4623ded2135bf707b6f93ade0
-  data.tar.gz: cfca3acb943122590ffeba33d95249c2d73143b7e51ff87e74ef5342e44dd67f
+  metadata.gz: 9f3b56fbb1ab0c039204dd6a338a884ba5a6b0cc014d4abe0356a18bd92b9277
+  data.tar.gz: 5f1c9874bfb6ed50da8c7f02d5dc2a8fc93a15bd59eb59a6be5e904222a0fe42
 SHA512:
-  metadata.gz: 652bf861a3896a3763e38ff0f7142128dace9d221350db4a353b1f6ad22fd19dc5661ac926825438cf5dae7fdf287221b3888b8b84d6dccf6d54be024bac759b
-  data.tar.gz: bfd8a3891dc78f37fa1bccec6a67eb9dd7f6f8a4f4cac86d95788d0d64b63e938dd6385579ac3d0bc50141629bc236f2bf4a16d69f597b7036f8a1b497c03cb4
+  metadata.gz: dc8a61f2d93aae23c9f6e2986d962cf15d25dfe3bf5d88c02035f36a08dd4b04d98d1ce2f911ada41b79361fa9f6ff8b19a4c46751dce5fcbb5d30b7c87d08a5
+  data.tar.gz: b1f52d2f1e22c7c5b2d0d06ba51c57f65e240f2305dd8c4c72ad535708d27dd7f08e7dee84ea7f28a7a527930b55f20dd580ee20db69f732e9908771c595d371

data/lib/pindo/module/cert/keychain_helper.rb

@@ -34,7 +34,6 @@ module Pindo
           if thrd.value.success?
             # puts "安装成功!"
             unless skip_set_partition_list
-              keychain_password ||= resolve_keychain_password(keychain_path)
               set_partition_list(path, keychain_path, keychain_password: keychain_password, output: output, strict: strict)
             end
           else
@@ -59,100 +58,56 @@ module Pindo
         return result
       end
 
+      # 与 Match 一致：配置密码优先，否则从钥匙串读取或询问并缓存。
       def set_partition_list(path, keychain_path, keychain_password: nil, output: false, strict: false)
-        # When security supports partition lists, also add the partition IDs
-        # See https://openradar.appspot.com/28524119
-        if help_backticks('security -h | grep set-key-partition-list', print: false).length > 0
-          password_part = " -k #{keychain_password.to_s.shellescape}"
-
-          command = "security set-key-partition-list"
-          command << " -S apple-tool:,apple:,codesign:"
-          command << " -s" # This is a needed in Catalina to prevent "security: SecKeychainItemCopyAccess: A missing value was detected."
-          command << password_part
-          command << " #{keychain_path.shellescape}"
-          command << " 1> /dev/null" # always disable stdout. This can be very verbose, and leak potentially sensitive info
-
-          # Showing loading indicator as this can take some time if a lot of keys installed
-          # Helper.show_loading_indicator("Setting key partition list... (this can take a minute if there are a lot of keys installed)")
-
-          # Strip keychain password from command output
-          # sensitive_command = command.gsub(password_part, " -k ********")
-          # puts command
-          # UI.command(sensitive_command) if output
-          Open3.popen3(command) do |stdin, stdout, stderr, thrd|
-            unless thrd.value.success?
-              err = stderr.read.to_s.strip
-              raise Informative, "钥匙串访问配置失败，请检查 macOS 钥匙串密码", cause: nil if strict
-
-              # Inform user when no/wrong password was used as its needed to prevent UI permission popup from Xcode when signing
-              if err.include?("SecKeychainItemSetAccessWithPassword")
-                keychain_name = File.basename(keychain_path, ".*")
-                # puts "password #{keychain_password}"
-                # puts "keychain #{keychain_name}"
-                # puts "security #{server_name(keychain_name)}"
-                Security::InternetPassword.delete(server: server_name(keychain_name))
-
-                # UI.important("")
-                # UI.important("Could not configure imported keychain item (certificate) to prevent UI permission popup when code signing\n" \
-                #          "Check if you supplied the correct `keychain_password` for keychain: `#{keychain_path}`\n" \
-                #          "#{err}")
-                # UI.important("")
-                # UI.important("Please look at the following docs to see how to set a keychain password:")
-                # UI.important(" - https://docs.fastlane.tools/actions/sync_code_signing")
-                # UI.important(" - https://docs.fastlane.tools/actions/get_certificates")
-                # puts "证书密码错误!"
-              else
-                puts err
-              end
+        warning = '未配置免弹窗签名权限；后续签名时 macOS 可能弹出系统对话框，请按提示授权。'
+        return unless help_backticks('security -h | grep set-key-partition-list', print: false).length > 0
+        keychain_password = resolve_keychain_password(keychain_path) if keychain_password.to_s.empty?
+
+        command = "security set-key-partition-list -S apple-tool:,apple:,codesign: -s"
+        command << " -k #{keychain_password.shellescape} #{keychain_path.shellescape} 1> /dev/null"
+        Open3.popen3(command) do |stdin, stdout, stderr, thread|
+          # 消费错误输出但不打印，避免泄露敏感信息。
+          error = stderr.read
+          next if thread.value.success?
+
+          if error.include?('SecKeychainItemSetAccessWithPassword')
+            # Match 会清除被拒绝的缓存；捕获输出以安静处理条目不存在的情况。
+            _output, _error, status = Open3.capture3('security', 'delete-internet-password', '-s',
+              server_name(keychain_path), '-a', '')
+            unless status.success? || status.exitstatus == 44 # errSecItemNotFound
+              FastlaneCore::UI.important('未能清除失效的钥匙串密码缓存，请检查钥匙串访问权限；下次可能仍读取旧密码。')
             end
           end
-
-          # Hiding after Open3 finishes
-          # Helper.hide_loading_indicator
-
+          FastlaneCore::UI.important(warning)
         end
       end
 
-      # https://github.com/fastlane/fastlane/issues/14196
-      # Keychain password is needed to set the partition list to
-      # prevent Xcode from prompting dialog for keychain password when signing
-      # 1. Uses keychain password from login keychain if found
-      # 2. Prompts user for keychain password and stores it in login keychain for user later
       def resolve_keychain_password(keychain_path)
-        keychain_name = File.basename(keychain_path, ".*")
-        server = server_name(keychain_name)
-
-        # Attempt to find password in keychain for keychain
+        server = server_name(keychain_path)
         item = Security::InternetPassword.find(server: server)
-        if item
-          keychain_password = item.password
-          # UI.important("Using keychain password from keychain item #{server} in #{keychain_path}")
-        end
+        return item.password if item && !item.password.to_s.empty?
 
-        if keychain_password.nil?
-          # if UI.interactive?
-            # UI.important("Enter the password for #{keychain_path}")
-            # UI.important("This passphrase will be stored in your local keychain with the name #{server} and used in future runs")
-            # UI.important("This prompt can be avoided by specifying the 'keychain_password' option or 'MATCH_KEYCHAIN_PASSWORD' environment variable")
-            # 收起 spinner，否则密码提示会被动画行覆盖，终端看起来像卡死
-            keychain_password = Funlog.with_paused_spinner do
-              FastlaneCore::Helper.ask_password(message: "Password for #{keychain_name} keychain: ", confirm: true, confirmation_message: "Type password for #{keychain_name} keychain again: ")
-            end
-            Security::InternetPassword.add(server, "", keychain_password)
-          # else
-            # UI.important("Keychain password for #{keychain_path} was not specified and not found in your keychain. Specify the 'keychain_password' option to prevent the UI permission popup when code signing")
-            # keychain_password = ""
-          # end
+        unless $stdin.tty? && FastlaneCore::UI.interactive?
+          FastlaneCore::UI.important('未配置或缓存 macOS 钥匙串密码；签名时可能需要系统授权。')
+          return ''
         end
 
-        return keychain_password
+        name = File.basename(keychain_path, '.*')
+        password = Funlog.with_paused_spinner do
+          FastlaneCore::Helper.ask_password(
+            message: "请输入 macOS #{name} 钥匙串密码（非证书导出密码，将保存到 #{server}）：",
+            confirm: true, confirmation_message: "请再次输入 #{name} 钥匙串密码：")
+        end
+        unless Security::InternetPassword.add(server, '', password)
+          FastlaneCore::UI.important('未能缓存钥匙串密码，下次运行可能需要重新输入。')
+        end
+        password
       end
 
-      # server name used for accessing the macOS keychain
-      def server_name(keychain_name)
-        ["pindo", "keychain", keychain_name].join("_")
+      def server_name(keychain_path)
+        ['pindo', 'keychain', File.basename(keychain_path, '.*')].join('_')
       end
-
       private :server_name
     end
   end

data/lib/pindo/module/cert/mode/custom_https_cert_operator.rb

@@ -9,6 +9,7 @@ require 'jpsclient'
 require 'json'
 require 'digest'
 require 'pindo/module/cert/p12_material'
+require 'pindo/module/cert/p12_password_resolver'
 
 module Pindo
   module CertProcess
@@ -183,8 +184,9 @@ module Pindo
         download_file_from_url(url: cert_p12_url, dest_path: key_path)
         Funlog.instance.info("私钥文件路径: #{key_path}") if debug_mode?
 
-        cert_password = p12_export_password(key_path)
-        material = P12Material.load(cert_path: cert_path, key_path: key_path, password: cert_password)
+        cert_password, material = P12PasswordResolver.resolve(
+          cert_path: cert_path, key_path: key_path, file_password: p12_export_password(key_path)
+        )
 
         # 安装证书到 Keychain（明文，无需 AES 解密）
         install_certificate_to_keychain(cert_path: cert_path, key_path: key_path, cert_password: cert_password)
@@ -378,10 +380,10 @@ module Pindo
         raise Informative, "证书材料下载失败，请检查下载权限与网络", cause: nil
       end
 
-      # 密码只按当前 P12 的内容指纹查找；不缓存、不读取 API 猜测字段。
+      # 文件密码按当前材料内容指纹查找；nil 表示继续查找钥匙串。
       def p12_export_password(key_path)
         source = ENV['PINDO_P12_PASSWORD_FILE']
-        return '' if source.nil? || source.empty?
+        return nil if source.nil? || source.empty?
 
         File.open(source, File::RDONLY | File::NOFOLLOW) do |file|
           stat = file.stat
@@ -390,7 +392,9 @@ module Pindo
           end
           passwords = JSON.parse(file.read)
           fingerprint = Digest::SHA256.file(key_path).hexdigest
-          password = passwords.fetch(fingerprint, '')
+          raise TypeError unless passwords.is_a?(Hash)
+          return nil unless passwords.key?(fingerprint)
+          password = passwords.fetch(fingerprint)
           raise TypeError unless password.is_a?(String)
           password
         end

data/lib/pindo/module/cert/p12_material.rb

@@ -5,6 +5,7 @@ module Pindo
     # Validate the freshly downloaded material before touching a user's keychain.
     class P12Material
       PemMaterial = Struct.new(:key, :certificate)
+      class PasswordError < Informative; end
 
       def self.load(cert_path:, key_path:, password:)
         certificate = OpenSSL::X509::Certificate.new(File.binread(cert_path))
@@ -44,7 +45,7 @@ module Pindo
         if error.message.match?(/unsupported|unknown cipher|unknown pbe|fetch failed|disabled|not supported/i)
           raise Informative, 'PEM 加密算法不兼容当前 OpenSSL，请以现代算法重新导出', cause: nil
         elsif content.include?('ENCRYPTED')
-          raise Informative, 'PEM 私钥解密失败，请检查导出密码及文件完整性', cause: nil
+          raise PasswordError, 'PEM 私钥解密失败，请检查导出密码及文件完整性', cause: nil
         else
           raise Informative, 'PEM 私钥格式无效或文件已损坏', cause: nil
         end
@@ -57,7 +58,7 @@ module Pindo
         if error.message.match?(/unsupported|unknown cipher|unknown pbe|fetch failed|disabled|not supported/i)
           raise Informative, 'P12 加密算法不兼容当前 OpenSSL；请使用兼容旧算法的工具读取后，以现代加密算法重新导出 P12', cause: nil
         elsif error.message.match?(/mac verify|invalid password|cipherfinal|bad decrypt/i)
-          raise Informative, 'P12 导出密码错误或文件完整性校验失败，请核对该文件对应的导出密码', cause: nil
+          raise PasswordError, 'P12 导出密码错误或文件完整性校验失败，请核对该文件对应的导出密码', cause: nil
         else
           raise Informative, 'P12 文件格式无效或已损坏，请重新导出（不能据此判定为密码错误）', cause: nil
         end

data/lib/pindo/module/cert/p12_password_resolver.rb

@@ -0,0 +1,110 @@
+require 'digest'
+require 'open3'
+require 'pindo/base/funlog'
+require 'pindo/module/cert/p12_material'
+
+module Pindo
+  module CertProcess
+    # Capture both output streams: security gem's system calls can expose raw errors.
+    class P12ExportPasswordStore
+      Item = Struct.new(:password)
+
+      def self.find(server:)
+        output, _error, status = Open3.capture3('security', 'find-internet-password', '-w', '-s', server, '-a', '')
+        return nil if status.exitstatus == 44
+        fail_access! unless status.success?
+
+        Item.new(output.sub(/\n\z/, ''))
+      rescue Informative
+        raise
+      rescue ::StandardError
+        fail_access!
+      end
+
+      def self.add(server, account, password)
+        _output, _error, status = Open3.capture3('security', 'add-internet-password', '-s', server, '-a', account, '-w', password)
+        fail_access! unless status.success?
+        true
+      rescue Informative
+        raise
+      rescue ::StandardError
+        fail_access!
+      end
+
+      def self.delete(server:)
+        _output, _error, status = Open3.capture3('security', 'delete-internet-password', '-s', server, '-a', '')
+        fail_access! unless status.success?
+        true
+      rescue Informative
+        raise
+      rescue ::StandardError
+        fail_access!
+      end
+
+      def self.fail_access!
+        raise Informative, '无法访问私钥导出密码钥匙串条目，请检查 macOS 钥匙串权限', cause: nil
+      end
+      private_class_method :fail_access!
+    end
+
+    # Export passwords are scoped to the exact downloaded material, not a keychain password.
+    class P12PasswordResolver
+      def self.resolve(cert_path:, key_path:, file_password:)
+        resolver = new(cert_path, key_path)
+        resolver.resolve(file_password)
+      end
+
+      def initialize(cert_path, key_path)
+        @cert_path = cert_path
+        @key_path = key_path
+        @server = "pindo_p12_export_#{Digest::SHA256.file(key_path).hexdigest}"
+      end
+
+      def resolve(file_password)
+        return validate(file_password) unless file_password.nil?
+
+        item = keychain { P12ExportPasswordStore.find(server: @server) }
+        begin
+          return validate(item ? keychain { item.password } : '')
+        rescue P12Material::PasswordError
+          keychain { P12ExportPasswordStore.delete(server: @server) } if item
+        end
+
+        password = prompt
+        result = validate(password)
+        keychain { P12ExportPasswordStore.add(@server, '', password) }
+        result
+      end
+
+      private
+
+      def validate(password)
+        material = P12Material.load(cert_path: @cert_path, key_path: @key_path, password: password)
+        [password, material]
+      end
+
+      def prompt
+        unless $stdin.tty? && $stdout.tty?
+          raise Informative, '非交互环境缺少有效的私钥导出密码，请配置 PINDO_P12_PASSWORD_FILE 或预先保存到钥匙串', cause: nil
+        end
+        password = Funlog.with_paused_spinner do
+          FastlaneCore::Helper.ask_password(message: '请输入当前证书材料的导出密码（非 macOS 钥匙串密码）：')
+        end
+        unless password.is_a?(String)
+          raise Informative, '未输入有效的私钥导出密码', cause: nil
+        end
+        password
+      rescue Informative
+        raise
+      rescue ::StandardError
+        raise Informative, '无法读取控制台导出密码', cause: nil
+      end
+
+      def keychain
+        yield
+      rescue ::StandardError
+        raise Informative, '无法读取或保存私钥导出密码，请检查 macOS 钥匙串访问权限', cause: nil
+      end
+    end
+  end
+end

data/lib/pindo/version.rb

@@ -6,7 +6,7 @@ require 'time'
 
 module Pindo
 
-  VERSION = "5.21.2"
+  VERSION = "5.21.4"
 
   class VersionCheck
     RUBYGEMS_API = 'https://rubygems.org/api/v1/gems/pindo.json'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pindo
 version: !ruby/object:Gem::Version
-  version: 5.21.2
+  version: 5.21.4
 platform: ruby
 authors:
 - wade
@@ -405,6 +405,7 @@ files:
 - lib/pindo/module/cert/mode/custom_https_cert_operator.rb
 - lib/pindo/module/cert/mode/match_git_cert_operator.rb
 - lib/pindo/module/cert/p12_material.rb
+- lib/pindo/module/cert/p12_password_resolver.rb
 - lib/pindo/module/cert/pem_helper.rb
 - lib/pindo/module/cert/provisioning_helper.rb
 - lib/pindo/module/pgyer/media_url_helper.rb