CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

validate: macOS versions need Mac screenshots, Play reads survive an ended edit; macOS build numbers across platforms; Mac build prebuild + apple.macAppCheck; signing wording off the Mac; dry flows plan uploads

Browse source
This commit is contained in:
CRTkafa 2026-11-02 18:16:25 +07:00
parent b1f1b206d3
commit f5da7c9f7a
21 changed files with 519 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

6
cli/lib/signing.ts
View file

@ -113,7 +113,7 @@ export interface CertChoice { cert: ApiCert | null; why: string; usable: ApiCert
/** A certificate is usable when it is of the wanted type, active, valid for 30 more days and this machine holds its
* private key (a key file in .storebound/signing or a code signing identity in the keychain). Newest first. */
export function pickCertificate(certs: ApiCert[], type: CertType, hasKey: (c: ApiCert) => boolean, now = Date.now()): CertChoice {
export function pickCertificate(certs: ApiCert[], type: CertType, hasKey: (c: ApiCert) => boolean, now = Date.now(), platform: string = process.platform): CertChoice {
const ofType = certs.filter(c => c.attributes.certificateType === type && c.attributes.activated !== false);
const valid = ofType.filter(c => Date.parse(c.attributes.expirationDate ?? '') > now);
const expiring = valid.filter(c => Date.parse(c.attributes.expirationDate!) - now < 30 * 86_400_000);
@ -121,7 +121,9 @@ export function pickCertificate(certs: ApiCert[], type: CertType, hasKey: (c: Ap
const withoutKey = valid.filter(c => !hasKey(c));
const cert = usable[0] ?? null;
const why = cert ? `using ${cert.attributes.name ?? cert.attributes.displayName ?? type} (expires ${cert.attributes.expirationDate?.slice(0, 10)})`
: withoutKey.length ? `${withoutKey.length} ${type} certificate(s) on the team, but this machine has none of their private keys: a new one is needed (or import the .p12 from the Mac that made it)`
: withoutKey.length ? `${withoutKey.length} ${type} certificate(s) on the team, but this machine has none of their private keys: ${platform === 'darwin'
? 'a new one is needed (or import the .p12 from the Mac that made it)'
: 'this machine cannot build or sign for Apple. The keys live on the Mac that made the certificates: build there (e.g. over ssh to that Mac). Do not create another certificate, Apple caps them per team'}`
: `no valid ${type} certificate`;
return { cert, why, usable, withoutKey, expiring };
}