ayushya/noo
1
0
Fork 0
Code Pull Requests Actions Packages Projects Releases 16 Activity

CI: pin iOS signing certificate by SHA-1 and log CI keychain identities

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Ayushya Amitabh
2026-10-07 23:14:07 -04:00
co-authored by Claude Sonnet 5.5
parent ef4c1a2afa
commit 91ab8b4a07
3 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/scripts/ios_ci_signing.rb
+7 -2
View File
@@ -6,6 +6,11 @@
require "xcodeproj" require "xcodeproj"
TEAM = "Q3JLTAG9PV" TEAM = "Q3JLTAG9PV"
# Pinned by SHA-1, not by the "Apple Distribution" name: a runner that also
# holds other same-named distribution certs (e.g. a dev Mac's login keychain)
# would otherwise let Xcode pick one the profiles don't include. Update this
# (and ios/ExportOptions.plist) when the certificate is renewed.
CERT_SHA1 = "2527806871D806E8E27221B15CA8A1938CF216F2"
PROFILES = { PROFILES = {
"Runner" => "NooProfile", "Runner" => "NooProfile",
"ShareExtension" => "NooShareSheetProfile", "ShareExtension" => "NooShareSheetProfile",
@@ -18,8 +23,8 @@ PROFILES.each do |target_name, profile|
settings = config.build_settings settings = config.build_settings
settings["CODE_SIGN_STYLE"] = "Manual" settings["CODE_SIGN_STYLE"] = "Manual"
settings["DEVELOPMENT_TEAM"] = TEAM settings["DEVELOPMENT_TEAM"] = TEAM
settings["CODE_SIGN_IDENTITY"] = "Apple Distribution" settings["CODE_SIGN_IDENTITY"] = CERT_SHA1
settings["CODE_SIGN_IDENTITY[sdk=iphoneos*]"] = "Apple Distribution" settings["CODE_SIGN_IDENTITY[sdk=iphoneos*]"] = CERT_SHA1
settings["PROVISIONING_PROFILE_SPECIFIER"] = profile settings["PROVISIONING_PROFILE_SPECIFIER"] = profile
end end
end end
.gitea/workflows/ios.yml
+3
View File
@@ -61,6 +61,9 @@ jobs:
security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN" security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"') security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
rm -f "${{ runner.temp }}/dist.p12" rm -f "${{ runner.temp }}/dist.p12"
# Must list 2527806871D8... (the cert the profiles embed); if it
# doesn't, IOS_DIST_CERT_P12_BASE64 holds the wrong certificate.
security find-identity -v -p codesigning "$KEYCHAIN"
PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles" PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
mkdir -p "$PROFILES_DIR" mkdir -p "$PROFILES_DIR"
ios/ExportOptions.plist
+1 -1
View File
@@ -9,7 +9,7 @@
<key>signingStyle</key> <key>signingStyle</key>
<string>manual</string> <string>manual</string>
<key>signingCertificate</key> <key>signingCertificate</key>
<string>Apple Distribution</string> <string>2527806871D806E8E27221B15CA8A1938CF216F2</string>
<key>provisioningProfiles</key> <key>provisioningProfiles</key>
<dict> <dict>
<key>dev.ayushya.noo</key> <key>dev.ayushya.noo</key>