pindo 5.21.3 → 5.21.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/pindo/module/cert/keychain_helper.rb +36 -81
- data/lib/pindo/version.rb +1 -1
- metadata +1 -1
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 9f3b56fbb1ab0c039204dd6a338a884ba5a6b0cc014d4abe0356a18bd92b9277
|
|
4
|
+
data.tar.gz: 5f1c9874bfb6ed50da8c7f02d5dc2a8fc93a15bd59eb59a6be5e904222a0fe42
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: dc8a61f2d93aae23c9f6e2986d962cf15d25dfe3bf5d88c02035f36a08dd4b04d98d1ce2f911ada41b79361fa9f6ff8b19a4c46751dce5fcbb5d30b7c87d08a5
|
|
7
|
+
data.tar.gz: b1f52d2f1e22c7c5b2d0d06ba51c57f65e240f2305dd8c4c72ad535708d27dd7f08e7dee84ea7f28a7a527930b55f20dd580ee20db69f732e9908771c595d371
|
|
@@ -34,7 +34,6 @@ module Pindo
|
|
|
34
34
|
if thrd.value.success?
|
|
35
35
|
# puts "安装成功!"
|
|
36
36
|
unless skip_set_partition_list
|
|
37
|
-
keychain_password ||= resolve_keychain_password(keychain_path)
|
|
38
37
|
set_partition_list(path, keychain_path, keychain_password: keychain_password, output: output, strict: strict)
|
|
39
38
|
end
|
|
40
39
|
else
|
|
@@ -59,100 +58,56 @@ module Pindo
|
|
|
59
58
|
return result
|
|
60
59
|
end
|
|
61
60
|
|
|
61
|
+
# 与 Match 一致：配置密码优先，否则从钥匙串读取或询问并缓存。
|
|
62
62
|
def set_partition_list(path, keychain_path, keychain_password: nil, output: false, strict: false)
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
# puts command
|
|
81
|
-
# UI.command(sensitive_command) if output
|
|
82
|
-
Open3.popen3(command) do |stdin, stdout, stderr, thrd|
|
|
83
|
-
unless thrd.value.success?
|
|
84
|
-
err = stderr.read.to_s.strip
|
|
85
|
-
raise Informative, "钥匙串访问配置失败，请检查 macOS 钥匙串密码", cause: nil if strict
|
|
86
|
-
|
|
87
|
-
# Inform user when no/wrong password was used as its needed to prevent UI permission popup from Xcode when signing
|
|
88
|
-
if err.include?("SecKeychainItemSetAccessWithPassword")
|
|
89
|
-
keychain_name = File.basename(keychain_path, ".*")
|
|
90
|
-
# puts "password #{keychain_password}"
|
|
91
|
-
# puts "keychain #{keychain_name}"
|
|
92
|
-
# puts "security #{server_name(keychain_name)}"
|
|
93
|
-
Security::InternetPassword.delete(server: server_name(keychain_name))
|
|
94
|
-
|
|
95
|
-
# UI.important("")
|
|
96
|
-
# UI.important("Could not configure imported keychain item (certificate) to prevent UI permission popup when code signing\n" \
|
|
97
|
-
# "Check if you supplied the correct `keychain_password` for keychain: `#{keychain_path}`\n" \
|
|
98
|
-
# "#{err}")
|
|
99
|
-
# UI.important("")
|
|
100
|
-
# UI.important("Please look at the following docs to see how to set a keychain password:")
|
|
101
|
-
# UI.important(" - https://docs.fastlane.tools/actions/sync_code_signing")
|
|
102
|
-
# UI.important(" - https://docs.fastlane.tools/actions/get_certificates")
|
|
103
|
-
# puts "证书密码错误!"
|
|
104
|
-
else
|
|
105
|
-
puts err
|
|
106
|
-
end
|
|
63
|
+
warning = '未配置免弹窗签名权限；后续签名时 macOS 可能弹出系统对话框，请按提示授权。'
|
|
64
|
+
return unless help_backticks('security -h | grep set-key-partition-list', print: false).length > 0
|
|
65
|
+
keychain_password = resolve_keychain_password(keychain_path) if keychain_password.to_s.empty?
|
|
66
|
+
|
|
67
|
+
command = "security set-key-partition-list -S apple-tool:,apple:,codesign: -s"
|
|
68
|
+
command << " -k #{keychain_password.shellescape} #{keychain_path.shellescape} 1> /dev/null"
|
|
69
|
+
Open3.popen3(command) do |stdin, stdout, stderr, thread|
|
|
70
|
+
# 消费错误输出但不打印，避免泄露敏感信息。
|
|
71
|
+
error = stderr.read
|
|
72
|
+
next if thread.value.success?
|
|
73
|
+
|
|
74
|
+
if error.include?('SecKeychainItemSetAccessWithPassword')
|
|
75
|
+
# Match 会清除被拒绝的缓存；捕获输出以安静处理条目不存在的情况。
|
|
76
|
+
_output, _error, status = Open3.capture3('security', 'delete-internet-password', '-s',
|
|
77
|
+
server_name(keychain_path), '-a', '')
|
|
78
|
+
unless status.success? || status.exitstatus == 44 # errSecItemNotFound
|
|
79
|
+
FastlaneCore::UI.important('未能清除失效的钥匙串密码缓存，请检查钥匙串访问权限；下次可能仍读取旧密码。')
|
|
107
80
|
end
|
|
108
81
|
end
|
|
109
|
-
|
|
110
|
-
# Hiding after Open3 finishes
|
|
111
|
-
# Helper.hide_loading_indicator
|
|
112
|
-
|
|
82
|
+
FastlaneCore::UI.important(warning)
|
|
113
83
|
end
|
|
114
84
|
end
|
|
115
85
|
|
|
116
|
-
# https://github.com/fastlane/fastlane/issues/14196
|
|
117
|
-
# Keychain password is needed to set the partition list to
|
|
118
|
-
# prevent Xcode from prompting dialog for keychain password when signing
|
|
119
|
-
# 1. Uses keychain password from login keychain if found
|
|
120
|
-
# 2. Prompts user for keychain password and stores it in login keychain for user later
|
|
121
86
|
def resolve_keychain_password(keychain_path)
|
|
122
|
-
|
|
123
|
-
server = server_name(keychain_name)
|
|
124
|
-
|
|
125
|
-
# Attempt to find password in keychain for keychain
|
|
87
|
+
server = server_name(keychain_path)
|
|
126
88
|
item = Security::InternetPassword.find(server: server)
|
|
127
|
-
if item
|
|
128
|
-
keychain_password = item.password
|
|
129
|
-
# UI.important("Using keychain password from keychain item #{server} in #{keychain_path}")
|
|
130
|
-
end
|
|
89
|
+
return item.password if item && !item.password.to_s.empty?
|
|
131
90
|
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
# UI.important("This passphrase will be stored in your local keychain with the name #{server} and used in future runs")
|
|
136
|
-
# UI.important("This prompt can be avoided by specifying the 'keychain_password' option or 'MATCH_KEYCHAIN_PASSWORD' environment variable")
|
|
137
|
-
# 收起 spinner，否则密码提示会被动画行覆盖，终端看起来像卡死
|
|
138
|
-
keychain_password = Funlog.with_paused_spinner do
|
|
139
|
-
FastlaneCore::Helper.ask_password(message: "Password for #{keychain_name} keychain: ", confirm: true, confirmation_message: "Type password for #{keychain_name} keychain again: ")
|
|
140
|
-
end
|
|
141
|
-
Security::InternetPassword.add(server, "", keychain_password)
|
|
142
|
-
# else
|
|
143
|
-
# UI.important("Keychain password for #{keychain_path} was not specified and not found in your keychain. Specify the 'keychain_password' option to prevent the UI permission popup when code signing")
|
|
144
|
-
# keychain_password = ""
|
|
145
|
-
# end
|
|
91
|
+
unless $stdin.tty? && FastlaneCore::UI.interactive?
|
|
92
|
+
FastlaneCore::UI.important('未配置或缓存 macOS 钥匙串密码；签名时可能需要系统授权。')
|
|
93
|
+
return ''
|
|
146
94
|
end
|
|
147
95
|
|
|
148
|
-
|
|
96
|
+
name = File.basename(keychain_path, '.*')
|
|
97
|
+
password = Funlog.with_paused_spinner do
|
|
98
|
+
FastlaneCore::Helper.ask_password(
|
|
99
|
+
message: "请输入 macOS #{name} 钥匙串密码（非证书导出密码，将保存到 #{server}）：",
|
|
100
|
+
confirm: true, confirmation_message: "请再次输入 #{name} 钥匙串密码：")
|
|
101
|
+
end
|
|
102
|
+
unless Security::InternetPassword.add(server, '', password)
|
|
103
|
+
FastlaneCore::UI.important('未能缓存钥匙串密码，下次运行可能需要重新输入。')
|
|
104
|
+
end
|
|
105
|
+
password
|
|
149
106
|
end
|
|
150
107
|
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
["pindo", "keychain", keychain_name].join("_")
|
|
108
|
+
def server_name(keychain_path)
|
|
109
|
+
['pindo', 'keychain', File.basename(keychain_path, '.*')].join('_')
|
|
154
110
|
end
|
|
155
|
-
|
|
156
111
|
private :server_name
|
|
157
112
|
end
|
|
158
113
|
end
|
data/lib/pindo/version.rb
CHANGED