From 9b4335ac02cc085adbe98a8ea4fec2d75077808a Mon Sep 17 00:00:00 2001 From: EMRG Evolution Date: Thu, 6 Aug 2026 15:43:06 +0800 Subject: [PATCH 1/2] =?UTF-8?q?emrg:=20pkg=20=E5=86=85=E5=B5=8C=20runtime?= =?UTF-8?q?=20codesign=20=E2=80=94=20.so/dylib/python=20=E4=BA=8C=E8=BF=9B?= =?UTF-8?q?=E5=88=B6=20Developer=20ID=20=E7=AD=BE=E5=90=8D=EF=BC=88?= =?UTF-8?q?=E7=AC=AC=2010=20=E6=AC=A1=E6=9E=84=E5=BB=BA=E5=85=AC=E8=AF=81?= =?UTF-8?q?=20Invalid=20=E6=A0=B9=E5=9B=A0=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- packaging/make-installer.sh | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/packaging/make-installer.sh b/packaging/make-installer.sh index e843bdad..d5e3a13c 100755 --- a/packaging/make-installer.sh +++ b/packaging/make-installer.sh @@ -46,6 +46,25 @@ case "$PLATFORM" in mkdir -p "$PKG_ROOT/payload/emrg-gui" cp -R "$RUNTIME/." "$PKG_ROOT/payload/" cp -R "$GUI_APP" "$PKG_ROOT/payload/emrg-gui/EMRG.app" + # macOS 公证要求 pkg 内所有 Mach-O 二进制都有 Developer ID 签名 + 时间戳 + # （第 10 次构建教训：Python runtime 的 .so 未签名 → notarytool Invalid， + # 报 "The binary is not signed with a valid Developer ID certificate"）。 + # 对 payload 内除 EMRG.app（electron-builder 已签）外的所有 Mach-O 签名。 + if [ "$(uname -s)" = "Darwin" ] && command -v codesign >/dev/null; then + SIGN_ID="$(security find-identity -v -p codesigning 2>/dev/null | grep 'Developer ID Application' | head -1 | sed -E 's/.*"([^"]+)".*/\1/')" + if [ -n "$SIGN_ID" ]; then + echo "==> codesign runtime binaries（公证要求：Developer ID + timestamp）" + # 收集 payload 内所有 Mach-O（.so / 无扩展名可执行 / Python 解释器） + # 排除 EMRG.app（electron-builder 已签）与"卸载 EMRG.app"（纯 bash 脚本无 Mach-O） + find "$PKG_ROOT/payload" -path '*EMRG.app' -prune -o -path '*卸载 EMRG.app' -prune -o \ + -type f \( -name '*.so' -o -name '*.dylib' -o -name 'python*' -o -name 'emrgd' -o -name 'emrg' -o -name 'emrg-uninstall' \) \ + -exec file {} + 2>/dev/null | grep 'Mach-O' | grep -v 'for architecture' | cut -d: -f1 | sort -u | while read -r BIN; do + codesign --force --timestamp --sign "$SIGN_ID" "$BIN" 2>/dev/null && echo " ✓ $(basename "$BIN")" || echo " ✗ 跳过 $(basename "$BIN")" + done + else + echo "!! 未找到 Developer ID Application 身份，跳过 runtime codesign（公证可能失败）" >&2 + fi + fi # 生成"卸载 EMRG.app"（R30/R31/R102：bash 包装调 emrg-uninstall + 删主 GUI + 提示拖废纸篓） UNINSTALL_APP="$PKG_ROOT/payload/emrg-gui/卸载 EMRG.app" mkdir -p "$UNINSTALL_APP/Contents/MacOS" From c39183fddf138ccc0a41e30d4ab8b51c11b672ee Mon Sep 17 00:00:00 2001 From: EMRG Evolution Date: Thu, 6 Aug 2026 15:44:27 +0800 Subject: [PATCH 2/2] =?UTF-8?q?emrg:=20runtime=20codesign=20=E8=A1=A5=20ha?= =?UTF-8?q?rdened=20runtime=20=E2=80=94=20--options=20runtime=EF=BC=88?= =?UTF-8?q?=E7=AC=AC=2010=20=E6=AC=A1=E6=9E=84=E5=BB=BA=E5=85=AC=E8=AF=81?= =?UTF-8?q?=20Invalid=20=E7=AC=AC=E4=B8=89=E7=B1=BB=E9=94=99=E8=AF=AF?= =?UTF-8?q?=EF=BC=9Aexecutable=20does=20not=20have=20the=20hardened=20runt?= =?UTF-8?q?ime=20enabled=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- packaging/make-installer.sh | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/packaging/make-installer.sh b/packaging/make-installer.sh index d5e3a13c..12c6370c 100755 --- a/packaging/make-installer.sh +++ b/packaging/make-installer.sh @@ -46,20 +46,24 @@ case "$PLATFORM" in mkdir -p "$PKG_ROOT/payload/emrg-gui" cp -R "$RUNTIME/." "$PKG_ROOT/payload/" cp -R "$GUI_APP" "$PKG_ROOT/payload/emrg-gui/EMRG.app" - # macOS 公证要求 pkg 内所有 Mach-O 二进制都有 Developer ID 签名 + 时间戳 - # （第 10 次构建教训：Python runtime 的 .so 未签名 → notarytool Invalid， - # 报 "The binary is not signed with a valid Developer ID certificate"）。 + # macOS 公证要求 pkg 内所有 Mach-O 二进制都有 Developer ID 签名 + 时间戳 + + # hardened runtime（第 10 次构建教训：Python runtime 的 .so/dylib 未签名 → + # notarytool Invalid statusCode 4000，12 个文件报三类错： + # "not signed with a valid Developer ID certificate" + # "does not include a secure timestamp" + # "does not have the hardened runtime enabled"）。 # 对 payload 内除 EMRG.app（electron-builder 已签）外的所有 Mach-O 签名。 + # --options runtime = hardened runtime（缺它会触发第三类错误）；实测 OK。 if [ "$(uname -s)" = "Darwin" ] && command -v codesign >/dev/null; then SIGN_ID="$(security find-identity -v -p codesigning 2>/dev/null | grep 'Developer ID Application' | head -1 | sed -E 's/.*"([^"]+)".*/\1/')" if [ -n "$SIGN_ID" ]; then - echo "==> codesign runtime binaries（公证要求：Developer ID + timestamp）" + echo "==> codesign runtime binaries（公证要求：Developer ID + timestamp + hardened runtime）" # 收集 payload 内所有 Mach-O（.so / 无扩展名可执行 / Python 解释器） # 排除 EMRG.app（electron-builder 已签）与"卸载 EMRG.app"（纯 bash 脚本无 Mach-O） find "$PKG_ROOT/payload" -path '*EMRG.app' -prune -o -path '*卸载 EMRG.app' -prune -o \ -type f \( -name '*.so' -o -name '*.dylib' -o -name 'python*' -o -name 'emrgd' -o -name 'emrg' -o -name 'emrg-uninstall' \) \ -exec file {} + 2>/dev/null | grep 'Mach-O' | grep -v 'for architecture' | cut -d: -f1 | sort -u | while read -r BIN; do - codesign --force --timestamp --sign "$SIGN_ID" "$BIN" 2>/dev/null && echo " ✓ $(basename "$BIN")" || echo " ✗ 跳过 $(basename "$BIN")" + codesign --force --timestamp --options runtime --sign "$SIGN_ID" "$BIN" 2>/dev/null && echo " ✓ $(basename "$BIN")" || echo " ✗ 跳过 $(basename "$BIN")" done else echo "!! 未找到 Developer ID Application 身份，跳过 runtime codesign（公证可能失败）" >&2