| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
ci: vendor Apple Developer ID intermediates (fix flaky nightly signing) (#6404) * ci: vendor Apple Developer ID intermediates so signing never needs a live fetch The signing keychain setup downloaded DeveloperIDCA.cer and DeveloperIDG2CA.cer from www.apple.com on every nightly/release run. A transient failure of that request leaves the build keychain without the intermediate chain, so codesign fails with "unable to build chain to self-signed root ... errSecInternalComponent" and the nightly signing step exits non-zero. Commit both intermediates (verified against Apple's published SHA-256 fingerprints) under scripts/apple-developer-id-certs and import from the vendored copies, falling back to the network only if a file is missing. Signing is now offline-deterministic on every fleet Mac. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci: update self-hosted guard for vendored intermediate certs The signing-helper guard asserted the helper always downloads the intermediates from www.apple.com. Now that the helper prefers vendored copies, update the guard to enforce the stronger contract: the vendored .cer files must exist, the helper must import them offline (no network) when present, and still download as a fallback when they are absent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> | 3 个月前 | |
ci: vendor Apple Developer ID intermediates (fix flaky nightly signing) (#6404) * ci: vendor Apple Developer ID intermediates so signing never needs a live fetch The signing keychain setup downloaded DeveloperIDCA.cer and DeveloperIDG2CA.cer from www.apple.com on every nightly/release run. A transient failure of that request leaves the build keychain without the intermediate chain, so codesign fails with "unable to build chain to self-signed root ... errSecInternalComponent" and the nightly signing step exits non-zero. Commit both intermediates (verified against Apple's published SHA-256 fingerprints) under scripts/apple-developer-id-certs and import from the vendored copies, falling back to the network only if a file is missing. Signing is now offline-deterministic on every fleet Mac. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci: update self-hosted guard for vendored intermediate certs The signing-helper guard asserted the helper always downloads the intermediates from www.apple.com. Now that the helper prefers vendored copies, update the guard to enforce the stronger contract: the vendored .cer files must exist, the helper must import them offline (no network) when present, and still download as a fallback when they are absent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> | 3 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 3 个月前 | ||
| 3 个月前 |