keychain workflow..

NateIsStalling · NateIsStalling · commit dafd771bb588 · 2025-03-18T21:59:32.000-04:00
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
@@ -129,6 +129,7 @@ jobs:
         name: Install the Apple certificate and provisioning profile
         env:
           BUILD_CERTIFICATE_BASE64: ${{ secrets.MAC_SIGNING_BUILD_CERTIFICATE_BASE64 }}
+          BUILD_CERTIFICATE_COMMON_NAME: ${{ secrets.MAC_SIGNING_BUILD_CERTIFICATE_COMMON_NAME }}
           P12_PASSWORD: ${{ secrets.MAC_SIGNING_P12_PASSWORD }}
           BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.MAC_SIGNING_EMBEDDED_PROVISIONPROFILE_BASE64 }}
           INTERMEDIATE_CERTIFICATE_BASE64: ${{ secrets.MAC_SIGNING_APPLE_INTERMEDIATE_CERTIFICATE_BASE64 }}
@@ -157,7 +158,7 @@ jobs:
           echo "import certificate to keychain"
           # security add-trusted-cert -d -r unspecified -k "$KEYCHAIN_PATH" "$INTERMEDIATE_PEM_PATH"
           security import "$CERTIFICATE_PATH" -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k "$KEYCHAIN_PATH"
-          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" -D "${BUILD_CERTIFICATE_COMMON_NAME}" $KEYCHAIN_PATH
           security list-keychain -d user -s $KEYCHAIN_PATH
           
           # apply provisioning profile
@@ -216,6 +217,7 @@ jobs:
         name: Install the Apple certificate and provisioning profile
         env:
           BUILD_CERTIFICATE_BASE64: ${{ secrets.MAC_SIGNING_BUILD_CERTIFICATE_BASE64 }}
+          BUILD_CERTIFICATE_COMMON_NAME: ${{ secrets.MAC_SIGNING_BUILD_CERTIFICATE_COMMON_NAME }}
           P12_PASSWORD: ${{ secrets.MAC_SIGNING_P12_PASSWORD }}
           BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.MAC_SIGNING_EMBEDDED_PROVISIONPROFILE_BASE64 }}
           INTERMEDIATE_CERTIFICATE_BASE64: ${{ secrets.MAC_SIGNING_APPLE_INTERMEDIATE_CERTIFICATE_BASE64 }}
@@ -237,15 +239,19 @@ jobs:
           
           echo "create temporary keychain"
           security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
-          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
-          security default-keychain -s $KEYCHAIN_PATH
+          
+          security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | sed s/\"//g)
+          
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          #security default-keychain -s $KEYCHAIN_PATH
           
           echo "import certificate to keychain"
           # security add-trusted-cert -d -r unspecified -k "$KEYCHAIN_PATH" "$INTERMEDIATE_PEM_PATH"
-          security import "$CERTIFICATE_PATH" -k "$KEYCHAIN_PATH" -P "$P12_PASSWORD" -T /usr/bin/codesign
-          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-          security list-keychains -d user -s $(security list-keychains -d user | sed -e s/\"//g) "$KEYCHAIN_PATH"
+          security import "$CERTIFICATE_PATH" -k "$KEYCHAIN_PATH" -P "$P12_PASSWORD" -A -T /usr/bin/codesign -T "/usr/bin/productsign"
+          # security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+          
+          security set-key-partition-list -S apple-tool:,apple:, -s -k $KEYCHAIN_PASSWORD -D "${BUILD_CERTIFICATE_COMMON_NAME}" -t private $KEYCHAIN_PATH
           
           # apply provisioning profile
           echo "PP_PATH=\"$PP_PATH\"" >> $GITHUB_OUTPUT
