From 8749adaeb912afb711f0e619ae467a800b670cbe Mon Sep 17 00:00:00 2001
From: 7418 <7418@openclaw.ai>
Date: Tue, 3 Mar 2026 01:14:42 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20CI=20=E8=AF=81=E4=B9=A6=E8=A7=A3?=
 =?UTF-8?q?=E7=A0=81=E5=8E=BB=E9=99=A4=E6=8D=A2=E8=A1=8C=20+=20openssl=20?=
 =?UTF-8?q?=E9=A2=84=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

printf + tr -d 去除 base64 中可能的 \r\n，
openssl pkcs12 -noout 在签名前验证 .p12 格式和密码正确。

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0311f36..474280d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -74,7 +74,10 @@ jobs:
         if: ${{ env.HAS_CERT == 'true' }}
         env:
           MAC_CERT_P12_BASE64: ${{ secrets.MAC_CERT_P12_BASE64 }}
-        run: echo "$MAC_CERT_P12_BASE64" | base64 --decode > /tmp/cert.p12
+          MAC_CERT_PASSWORD: ${{ secrets.MAC_CERT_PASSWORD }}
+        run: |
+          printf '%s' "$MAC_CERT_P12_BASE64" | tr -d '\r\n' | base64 --decode > /tmp/cert.p12
+          openssl pkcs12 -in /tmp/cert.p12 -passin pass:"$MAC_CERT_PASSWORD" -noout
 
       - name: Package for macOS (x64 + arm64)
         env: