46 lines
1.5 KiB
Bash
Executable File
46 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# 生成一个本地自签名代码签名证书，保证每次重建后「辅助功能」授权不会失效。
|
|
set -euo pipefail
|
|
|
|
IDENTITY="${TINYSTT_SIGN_IDENTITY:-${TINYTTS_SIGN_IDENTITY:-TinySTT Dev}}"
|
|
|
|
if security find-identity -v -p codesigning 2>/dev/null | grep -q "$IDENTITY"; then
|
|
echo "签名身份已存在：$IDENTITY"
|
|
exit 0
|
|
fi
|
|
|
|
WORK="$(mktemp -d)"
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
cat > "$WORK/cert.cnf" <<'EOF'
|
|
[req]
|
|
distinguished_name = dn
|
|
x509_extensions = ext
|
|
prompt = no
|
|
[dn]
|
|
CN = TinySTT Dev
|
|
[ext]
|
|
basicConstraints = critical,CA:false
|
|
keyUsage = critical,digitalSignature
|
|
extendedKeyUsage = critical,codeSigning
|
|
EOF
|
|
|
|
openssl req -x509 -newkey rsa:2048 -nodes \
|
|
-keyout "$WORK/key.pem" -out "$WORK/cert.pem" \
|
|
-days 3650 -config "$WORK/cert.cnf" >/dev/null 2>&1
|
|
|
|
openssl pkcs12 -export -out "$WORK/id.p12" \
|
|
-inkey "$WORK/key.pem" -in "$WORK/cert.pem" \
|
|
-name "$IDENTITY" -passout pass:tinystt \
|
|
-legacy -macalg sha1 -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES >/dev/null 2>&1 \
|
|
|| openssl pkcs12 -export -out "$WORK/id.p12" \
|
|
-inkey "$WORK/key.pem" -in "$WORK/cert.pem" \
|
|
-name "$IDENTITY" -passout pass:tinystt \
|
|
-macalg sha1 -certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES >/dev/null 2>&1
|
|
|
|
security import "$WORK/id.p12" -k "$HOME/Library/Keychains/login.keychain-db" \
|
|
-P tinystt -T /usr/bin/codesign >/dev/null
|
|
|
|
echo "已创建签名身份：$IDENTITY"
|
|
security find-identity -v -p codesigning | grep "$IDENTITY" || true
|