Skip to content

Commit 1943134

Browse files
its-mashits-mash
committed
fix: don't pass APPLE_CERTIFICATE to tauri-action
Tauri's bundler uses var_os() which treats empty strings as present, causing it to attempt certificate import even when the value is empty. Instead, we handle cert import ourselves and only pass APPLE_SIGNING_IDENTITY to tauri-action. Also adds a temporary test-build workflow for macOS validation. Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>
1 parent 68495e5 commit 1943134

2 files changed

Lines changed: 99 additions & 16 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -119,10 +119,10 @@ jobs:
119119

120120
- run: pnpm install --frozen-lockfile
121121

122-
# Import Apple certificate for macOS signing. Outputs cert_ok=true
123-
# only when the certificate was successfully imported into keychain.
124-
# If import fails, tauri-action gets no APPLE_CERTIFICATE, forcing
125-
# ad-hoc signing instead of failing the build.
122+
# Import Apple certificate ourselves, then DON'T pass APPLE_CERTIFICATE
123+
# to tauri-action. Tauri's bundler uses var_os() which treats empty
124+
# strings as present (Some("")), so we must completely omit the env var.
125+
# Instead we import the cert here and only pass APPLE_SIGNING_IDENTITY.
126126
- name: Import Apple certificate
127127
if: matrix.os == 'macos-latest' || matrix.os == 'macos-15'
128128
id: apple-cert
@@ -132,43 +132,45 @@ jobs:
132132
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
133133
run: |
134134
if [ -z "$APPLE_CERTIFICATE" ] || [ -z "$KEYCHAIN_PASSWORD" ]; then
135-
echo "No Apple certificate configured — skipping import"
136-
echo "cert_ok=false" >> "$GITHUB_OUTPUT"
135+
echo "No Apple certificate configured — using ad-hoc signing"
136+
echo "identity=-" >> "$GITHUB_OUTPUT"
137137
exit 0
138138
fi
139139
echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
140140
if [ ! -s certificate.p12 ]; then
141-
echo "Certificate decode produced empty file — skipping import"
141+
echo "Certificate decode produced empty file — using ad-hoc signing"
142142
rm -f certificate.p12
143-
echo "cert_ok=false" >> "$GITHUB_OUTPUT"
143+
echo "identity=-" >> "$GITHUB_OUTPUT"
144144
exit 0
145145
fi
146146
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
147147
security default-keychain -s build.keychain
148148
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
149149
if ! security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign; then
150-
echo "Certificate import failed — falling back to ad-hoc signing"
150+
echo "Certificate import failed — using ad-hoc signing"
151151
rm -f certificate.p12
152-
echo "cert_ok=false" >> "$GITHUB_OUTPUT"
152+
echo "identity=-" >> "$GITHUB_OUTPUT"
153153
exit 0
154154
fi
155155
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
156156
rm certificate.p12
157+
echo "identity=${{ secrets.APPLE_SIGNING_IDENTITY }}" >> "$GITHUB_OUTPUT"
157158
echo "cert_ok=true" >> "$GITHUB_OUTPUT"
158159
160+
# IMPORTANT: Do NOT pass APPLE_CERTIFICATE to tauri-action.
161+
# We handle certificate import ourselves above. Tauri's bundler
162+
# treats empty strings as "certificate present" and tries to import,
163+
# which fails. By omitting the var entirely, the bundler skips import
164+
# and uses the identity from APPLE_SIGNING_IDENTITY (or ad-hoc).
159165
- name: Build Tauri app
160166
uses: tauri-apps/tauri-action@v0
161167
env:
162168
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
163169
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
164170
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
165171
PKG_CONFIG_PATH: /usr/lib/x86_64-linux-gnu/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig
166-
# Only pass Apple certificate/signing to tauri-action when import succeeded.
167-
# When cert_ok is false, these are empty strings — tauri falls back to ad-hoc signing.
168-
APPLE_SIGNING_IDENTITY: ${{ steps.apple-cert.outputs.cert_ok == 'true' && secrets.APPLE_SIGNING_IDENTITY || '' }}
169-
APPLE_CERTIFICATE: ${{ steps.apple-cert.outputs.cert_ok == 'true' && secrets.APPLE_CERTIFICATE || '' }}
170-
APPLE_CERTIFICATE_PASSWORD: ${{ steps.apple-cert.outputs.cert_ok == 'true' && secrets.APPLE_CERTIFICATE_PASSWORD || '' }}
171-
# macOS notarization (only works with Developer ID cert)
172+
APPLE_SIGNING_IDENTITY: ${{ steps.apple-cert.outputs.identity }}
173+
# Notarization only when cert import succeeded
172174
APPLE_ID: ${{ steps.apple-cert.outputs.cert_ok == 'true' && secrets.APPLE_ID || '' }}
173175
APPLE_PASSWORD: ${{ steps.apple-cert.outputs.cert_ok == 'true' && secrets.APPLE_PASSWORD || '' }}
174176
APPLE_TEAM_ID: ${{ steps.apple-cert.outputs.cert_ok == 'true' && secrets.APPLE_TEAM_ID || '' }}

‎.github/workflows/test-build.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Test Build
2+
3+
on:
4+
workflow_dispatch:
5+
6+
env:
7+
CARGO_TERM_COLOR: always
8+
9+
jobs:
10+
test-build:
11+
strategy:
12+
fail-fast: false
13+
matrix:
14+
include:
15+
- os: macos-latest
16+
target: aarch64-apple-darwin
17+
artifact: macos-arm
18+
- os: macos-latest
19+
target: x86_64-apple-darwin
20+
artifact: macos-intel
21+
22+
runs-on: ${{ matrix.os }}
23+
steps:
24+
- uses: actions/checkout@v4
25+
26+
- uses: dtolnay/rust-toolchain@stable
27+
with:
28+
targets: ${{ matrix.target }}
29+
30+
- uses: Swatinem/rust-cache@v2
31+
with:
32+
key: ${{ matrix.target }}-test
33+
34+
- uses: pnpm/action-setup@v4
35+
- uses: actions/setup-node@v4
36+
with:
37+
node-version: 20
38+
cache: 'pnpm'
39+
40+
- run: pnpm install --frozen-lockfile
41+
42+
- name: Import Apple certificate
43+
id: apple-cert
44+
env:
45+
APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
46+
APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
47+
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
48+
run: |
49+
if [ -z "$APPLE_CERTIFICATE" ] || [ -z "$KEYCHAIN_PASSWORD" ]; then
50+
echo "No Apple certificate configured — using ad-hoc signing"
51+
echo "identity=-" >> "$GITHUB_OUTPUT"
52+
exit 0
53+
fi
54+
echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
55+
if [ ! -s certificate.p12 ]; then
56+
echo "Certificate decode produced empty file — using ad-hoc signing"
57+
rm -f certificate.p12
58+
echo "identity=-" >> "$GITHUB_OUTPUT"
59+
exit 0
60+
fi
61+
security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
62+
security default-keychain -s build.keychain
63+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" build.keychain
64+
if ! security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign; then
65+
echo "Certificate import failed — using ad-hoc signing"
66+
rm -f certificate.p12
67+
echo "identity=-" >> "$GITHUB_OUTPUT"
68+
exit 0
69+
fi
70+
security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" build.keychain
71+
rm certificate.p12
72+
echo "identity=${{ secrets.APPLE_SIGNING_IDENTITY }}" >> "$GITHUB_OUTPUT"
73+
echo "cert_ok=true" >> "$GITHUB_OUTPUT"
74+
75+
- name: Build Tauri app
76+
run: pnpm tauri build --target ${{ matrix.target }}
77+
working-directory: apps/desktop
78+
env:
79+
TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
80+
TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
81+
APPLE_SIGNING_IDENTITY: ${{ steps.apple-cert.outputs.identity }}

0 commit comments

Comments
 (0)