fanhuadesenlinnn/clash-party
1
0
Fork 0
mirror of https://hubproxy.babadafafafafa.cn/https://github.com/mihomo-party-org/clash-party.git synced 2026-09-20 08:03:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

ci: staple the notarization ticket to the macOS pkg

Browse Source 
The macos and macos10 jobs submit the signed .pkg to notarytool but never
staple the resulting ticket to it. Without a stapled ticket Gatekeeper has to
reach Apple's notary service to verify the package, so an install on a machine
that is offline — or behind a blocked network, which is a plausible state for
this particular app before it is running — fails with "cannot be opened because
Apple cannot check it for malicious software".

Staple after a successful submission, which is the documented final step of the
Developer ID distribution flow.
This commit is contained in:
MOMO0302-02
2026-08-20 10:10:21 +08:00
committed by GitHub
parent 4e86b53db7
commit c779799bee
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/build.yml vendored
View File

@@ -406,6 +406,7 @@ jobs:
productsign --sign "Developer ID Installer: Prometheus Advertising Corp (489PDK5LP3)" Unsigned-Workbench.pkg $pkg_name
rm -f Unsigned-Workbench.pkg
xcrun notarytool submit $pkg_name --apple-id $APPLE_ID --team-id $APPLE_TEAM_ID --password $APPLE_APP_SPECIFIC_PASSWORD --wait
xcrun stapler staple $pkg_name
done
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -508,6 +509,7 @@ jobs:
productsign --sign "Developer ID Installer: Prometheus Advertising Corp (489PDK5LP3)" Unsigned-Workbench.pkg $pkg_name
rm -f Unsigned-Workbench.pkg
xcrun notarytool submit $pkg_name --apple-id $APPLE_ID --team-id $APPLE_TEAM_ID --password $APPLE_APP_SPECIFIC_PASSWORD --wait
xcrun stapler staple $pkg_name
done
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}