106 lines
4.6 KiB
Bash
106 lines
4.6 KiB
Bash
|
#!/usr/bin/env bash
|
|||
|
|
# 一次性签名环境配置：检查证书 + 录入 Apple ID 凭证 + 写入 .env.signing
|
|||
|
|
# 用法: pnpm sign:setup
|
|||
|
|
set -euo pipefail
|
|||
|
|
|
|||
|
|
cd "$(dirname "$0")/.."
|
|||
|
|
|
|||
|
|
KEYCHAIN_PROFILE="GeoRanklySign"
|
|||
|
|
ENV_FILE=".env.signing"
|
|||
|
|
|
|||
|
|
R=$'\033[31m'; G=$'\033[32m'; Y=$'\033[33m'; B=$'\033[1m'; N=$'\033[0m'
|
|||
|
|
ok() { echo " ${G}✓${N} $1"; }
|
|||
|
|
fail() { echo " ${R}✗${N} $1"; }
|
|||
|
|
warn() { echo " ${Y}!${N} $1"; }
|
|||
|
|
hr() { echo ""; echo "${B}── $1 ──${N}"; }
|
|||
|
|
|
|||
|
|
# ── 1. Xcode CLT ────────────────────────────────────────────────
|
|||
|
|
hr "1/3 检查 Xcode Command Line Tools"
|
|||
|
|
if xcode-select -p >/dev/null 2>&1; then
|
|||
|
|
ok "已安装：$(xcode-select -p)"
|
|||
|
|
else
|
|||
|
|
fail "未安装"
|
|||
|
|
echo " 请在终端运行 ${B}xcode-select --install${N}，弹窗装好后再来"
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# ── 2. Developer ID 证书 ────────────────────────────────────────
|
|||
|
|
hr "2/3 检查 Developer ID Application 证书"
|
|||
|
|
IDENTITIES=$(security find-identity -v -p codesigning | grep "Developer ID Application" || true)
|
|||
|
|
|
|||
|
|
if [ -z "$IDENTITIES" ]; then
|
|||
|
|
fail "钥匙串里没找到 Developer ID Application 证书"
|
|||
|
|
cat <<EOF
|
|||
|
|
|
|||
|
|
${B}申请步骤（一次性，约 10 分钟）：${N}
|
|||
|
|
${Y}1.${N} 浏览器登录 https://developer.apple.com/account/resources/certificates
|
|||
|
|
${Y}2.${N} 点 ${B}+${N} 新建证书 → 选 ${B}Developer ID Application${N} → Continue
|
|||
|
|
${Y}3.${N} 它要你上传 CSR，按下面方法生成：
|
|||
|
|
打开 macOS ${B}钥匙串访问.app${N}
|
|||
|
|
菜单栏 → 钥匙串访问 → 证书助理 → ${B}从证书颁发机构请求证书…${N}
|
|||
|
|
邮箱填你的 Apple ID，常用名随意，选 ${B}存储到磁盘${N}，保存为 .certSigningRequest
|
|||
|
|
${Y}4.${N} 把这个 .certSigningRequest 上传，下载得到 ${B}developerID_application.cer${N}
|
|||
|
|
${Y}5.${N} 双击 .cer，导入到 ${B}登录${N} 钥匙串
|
|||
|
|
${Y}6.${N} 重新运行 ${B}pnpm sign:setup${N}
|
|||
|
|
|
|||
|
|
EOF
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# 多张证书时取第一张
|
|||
|
|
IDENTITY_LINE=$(echo "$IDENTITIES" | head -n1)
|
|||
|
|
IDENTITY_NAME=$(echo "$IDENTITY_LINE" | sed -E 's/.*"(Developer ID Application: [^"]+)".*/\1/')
|
|||
|
|
# CSC_NAME 必须去掉 "Developer ID Application: " 前缀，否则 electron-builder 会拒绝
|
|||
|
|
CSC_NAME_VALUE=$(echo "$IDENTITY_NAME" | sed -E 's/^Developer ID Application: //')
|
|||
|
|
TEAM_ID=$(echo "$IDENTITY_NAME" | sed -E 's/.*\(([A-Z0-9]+)\).*/\1/')
|
|||
|
|
ok "找到证书：${B}$IDENTITY_NAME${N}"
|
|||
|
|
ok "Team ID：${B}$TEAM_ID${N}"
|
|||
|
|
|
|||
|
|
if [ "$(echo "$IDENTITIES" | wc -l | tr -d ' ')" -gt 1 ]; then
|
|||
|
|
warn "钥匙串里有多张 Developer ID 证书，本脚本默认用上面这一张"
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# ── 3. Apple ID 凭证（公证用）─────────────────────────────────────
|
|||
|
|
hr "3/3 录入 Apple ID 凭证（用于公证 notarize）"
|
|||
|
|
|
|||
|
|
NEED_CREDENTIALS=1
|
|||
|
|
if security find-generic-password -s "com.apple.gke.notary.tool.saved-creds" -a "$KEYCHAIN_PROFILE" >/dev/null 2>&1; then
|
|||
|
|
ok "钥匙串里已有 profile：$KEYCHAIN_PROFILE"
|
|||
|
|
read -r -p " 是否重新录入？(y/N): " RECONFIG
|
|||
|
|
[[ "${RECONFIG:-n}" =~ ^[Yy]$ ]] || NEED_CREDENTIALS=0
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
if [ "$NEED_CREDENTIALS" = "1" ]; then
|
|||
|
|
echo ""
|
|||
|
|
echo " 需要 ${B}Apple ID 邮箱${N} + ${B}App 专用密码${N}（不是登录密码！）"
|
|||
|
|
echo " 生成 App 专用密码： https://appleid.apple.com → 登录与安全 → App 专用密码 → +"
|
|||
|
|
echo ""
|
|||
|
|
read -r -p " Apple ID 邮箱: " APPLE_ID
|
|||
|
|
read -r -s -p " App 专用密码 (xxxx-xxxx-xxxx-xxxx): " APPLE_PWD
|
|||
|
|
echo ""
|
|||
|
|
|
|||
|
|
if ! xcrun notarytool store-credentials "$KEYCHAIN_PROFILE" \
|
|||
|
|
--apple-id "$APPLE_ID" \
|
|||
|
|
--team-id "$TEAM_ID" \
|
|||
|
|
--password "$APPLE_PWD" >/dev/null; then
|
|||
|
|
fail "凭证录入失败，常见原因：密码格式错（需带短横线），或 Team ID 不匹配"
|
|||
|
|
exit 1
|
|||
|
|
fi
|
|||
|
|
ok "凭证已存入钥匙串（profile: ${KEYCHAIN_PROFILE}）"
|
|||
|
|
fi
|
|||
|
|
|
|||
|
|
# ── 写入 .env.signing ───────────────────────────────────────────
|
|||
|
|
cat > "$ENV_FILE" <<EOF
|
|||
|
|
# Auto-generated by scripts/sign-setup.sh — DO NOT COMMIT
|
|||
|
|
# 让 electron-builder 自动选用钥匙串里的证书
|
|||
|
|
# 注意：CSC_NAME 不能带 "Developer ID Application:" 前缀
|
|||
|
|
CSC_NAME="$CSC_NAME_VALUE"
|
|||
|
|
APPLE_TEAM_ID="$TEAM_ID"
|
|||
|
|
NOTARY_KEYCHAIN_PROFILE="$KEYCHAIN_PROFILE"
|
|||
|
|
EOF
|
|||
|
|
ok "写入 ${B}apps/desktop-client/$ENV_FILE${N}"
|
|||
|
|
|
|||
|
|
echo ""
|
|||
|
|
echo "${G}${B}━━━ 配置完成 ━━━${N}"
|
|||
|
|
echo " 下一步：运行 ${B}pnpm sign:mac${N} 一键打包 + 签名 + 公证"
|