From 6dccccb4465d9231e7a2258965a3a2807410bbf5 Mon Sep 17 00:00:00 2001 From: argszero Date: Thu, 6 Aug 2026 16:08:25 +0800 Subject: [PATCH] =?UTF-8?q?emrg:=20Staple=20=E7=BB=88=E9=AA=8C=20spctl=20?= =?UTF-8?q?=E5=8A=A0=20--type=20install=20=E2=80=94=20=E9=BB=98=E8=AE=A4?= =?UTF-8?q?=20execute=20=E7=B1=BB=E5=9E=8B=E5=AF=B9=20pkg=20=E8=AF=AF?= =?UTF-8?q?=E6=8A=A5=20no=20usable=20signature=EF=BC=88#477=EF=BC=8Crun=20?= =?UTF-8?q?31082935194=20=E5=AE=9E=E6=B5=8B=EF=BC=9A=E5=85=AC=E8=AF=81=20A?= =?UTF-8?q?ccepted=20+=20staple=20=E6=88=90=E5=8A=9F=E4=BD=86=20spctl=20re?= =?UTF-8?q?jected=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/build-release.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index 81cfe8de..979a9a90 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -248,9 +248,16 @@ jobs: if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi xcrun stapler staple "$PKG" xcrun stapler validate "$PKG" - # P3 终验（rant 验收 + 设计文档 §5.1）：spctl -a 确认 Gatekeeper 接受 + # P3 终验（rant 验收 + 设计文档 §5.1）：spctl 确认 Gatekeeper 接受 # （签名 + 公证 + staple 全链路的最终裁决；期望输出 "accepted"） - spctl -a -vv "$PKG" + # ⚠️ --type install 必需（#477 教训）：spctl 默认类型为 execute， + # 对 pkg 评估返回 "no usable signature"（exit 3）——即使 pkg 已用 + # Developer ID Installer 签名 + 公证 Accepted + staple 成功。 + # 实测：xcrun stapler staple/validate 均 work，pkgutil --check-signature + # 显示 "signed by a developer certificate issued by Apple for distribution"， + # 公证 status=Accepted（run 31082935194），但 spctl -a -vv 报 + # "rejected, source=no usable signature"。加 --type install 后正确评估 pkg。 + spctl -a -vv --type install "$PKG" # ── 冒烟（§12，临时 HOME + 无 Python runner）──────────── - name: Smoke test (R42 temp HOME)