#!/bin/bash
|
# Report the local code signing identity that package-app.sh will use.
|
|
set -euo pipefail
|
|
PREFERRED_IDENTITY="Aligner Local Code Signing"
|
REQUESTED_IDENTITY="${ALIGNER_CODE_SIGN_IDENTITY:-}"
|
IDENTITIES="$(security find-identity -v -p codesigning 2>/dev/null || true)"
|
|
if [ -n "$REQUESTED_IDENTITY" ]; then
|
SELECTED_IDENTITY="$REQUESTED_IDENTITY"
|
SELECTION_REASON="ALIGNER_CODE_SIGN_IDENTITY"
|
elif echo "$IDENTITIES" | grep -Fq "\"$PREFERRED_IDENTITY\""; then
|
SELECTED_IDENTITY="$PREFERRED_IDENTITY"
|
SELECTION_REASON="preferred project identity"
|
else
|
SELECTED_IDENTITY="$(echo "$IDENTITIES" | sed -n 's/.*"\([^"]*Local Code Signing\)".*/\1/p' | head -n 1)"
|
SELECTION_REASON="fallback local identity"
|
fi
|
|
echo "Signing identity check"
|
|
if [ -z "$SELECTED_IDENTITY" ]; then
|
echo " selected: ad-hoc"
|
echo " risk: TCC permissions may reset after rebuilds"
|
exit 0
|
fi
|
|
if ! echo "$IDENTITIES" | grep -Fq "\"$SELECTED_IDENTITY\""; then
|
echo " selected: $SELECTED_IDENTITY"
|
echo " error: selected identity is not available in this keychain" >&2
|
exit 1
|
fi
|
|
echo " selected: $SELECTED_IDENTITY"
|
echo " reason: $SELECTION_REASON"
|
|
if [ "$SELECTED_IDENTITY" != "$PREFERRED_IDENTITY" ]; then
|
echo " warning: preferred project identity '$PREFERRED_IDENTITY' is not active"
|
fi
|
