ci(macos): reject a MAC_CSC_NAME that carries its certificate type - #264
Merged
Conversation
`CSC_NAME` must name the identity without its certificate type;
electron-builder chooses the type itself and refuses a qualified name:
⨯ Please remove prefix "Developer ID Application:" from the specified
name — appropriate certificate will be chosen automatically
It refuses at `Package .app bundle`, which runs after the ffmpeg build
and the compositor addon — about twelve minutes into the macOS job, and
nowhere else. That is what happened the first time signing was enabled
here: twelve minutes to learn that a secret had four extra words.
The mistake is easy to make because the same secret also feeds
`codesign --sign` at `Sign DMG`, and codesign accepts the full common
name, so the qualified form looks correct right up until
electron-builder sees it. The short form satisfies both, since codesign
matches on a substring of the common name.
Check it in `Resolve macOS signing`, where every other signing input is
already validated, and fail in seconds with the value to use instead.
Only prefixes ending in a colon match, so a company whose name starts
with one of these words is not caught.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validate
MAC_CSC_NAMEinResolve macOS signingand fail immediately if it carries a certificate-type prefix, instead of letting electron-builder discover it twelve minutes later.Why
CSC_NAMEmust name the identity without its type — electron-builder selects the certificate type itself and rejects a qualified name:It rejects at
Package .app bundle, which sits afterVendor LGPL ffmpegandBuild Metal compositor addon. In run 30950523913 — the first build ever to have signing enabled — that cost a full macOS job to learn that a secret had four extra words in it.The mistake is easy to make because the same secret feeds two different consumers:
CSC_NAMEfor electron-builder, andcodesign --signatSign DMG.codesignhappily accepts the full common name, so the qualified form looks correct everywhere until electron-builder sees it. The short form satisfies both, sincecodesignmatches on a substring of the common name — verified locally:Behaviour
The check runs only when signing is enabled — every other signing input is already validated in that same step — and the error names the value to use:
Covers the Developer ID, Apple Development/Distribution and 3rd Party Mac Developer prefixes. Every pattern ends at the colon, so an organisation whose name merely begins with one of those words is not rejected.
Related issue
Refs #
Type of change
Release impact
Desktop impact
Testing
Shell logic exercised against the real values and the false-positive edge case:
Workflow YAML parses (
js-yaml);npm run docs:checkOK (22 files). No documentation asserts anything aboutMAC_CSC_NAME's format, so nothing needed updating —release-and-secrets.mddescribes the secret's purpose, not its shape.