macos 签名问题

Author: linyuan.yang

.github/workflows/release.yml

@@ -55,7 +55,10 @@ jobs:
 
   release-macos:
     needs: [check, prepare-release]
-    runs-on: macos-latest
+    # macos-latest 已切换到 macOS 26；无界面 runner 写入自签名证书信任时会阻塞。
+    # 固定到此前验证可用的 macOS 15，避免基础镜像升级悄悄改变签名行为。
+    runs-on: macos-15
+    timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:

scripts/mac-import-signing-cert.sh

@@ -14,14 +14,21 @@ CERT_PATH="$RUNNER_TEMP/sbox-signing.crt"
 
 printf '%s' "$APPLE_CERTIFICATE" | base64 -D > "$P12_PATH"
 
+echo "正在创建临时签名钥匙串..."
 security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
 security set-keychain-settings -lut 21600 "$KEYCHAIN_PATH"
 security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
+
+echo "正在导入签名身份..."
 security import "$P12_PATH" -k "$KEYCHAIN_PATH" \
   -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign
 # 从已导入的钥匙串读取证书，避免 OpenSSL 3 拒绝旧 P12 中的 RC2 加密。
 security find-certificate -c "$IDENTITY" -p "$KEYCHAIN_PATH" > "$CERT_PATH"
+
+echo "正在信任自签名证书..."
 security add-trusted-cert -r trustRoot -p codeSign -k "$KEYCHAIN_PATH" "$CERT_PATH"
+
+echo "正在授权 codesign 访问私钥..."
 security set-key-partition-list -S apple-tool:,apple:,codesign: \
   -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"