sttlab-tech
678557caf7
Adds --capture-mic/--mic-output for a second, independently-captured audio track (mic vs system, written to separate outputs to avoid interleaving corruption). Embeds Info.plist at link time so the binary carries a stable CFBundleIdentifier and the usage-description keys TCC requires, and adds scripts/build-signed.sh + scripts/create-signing-identity.sh so a rebuilt binary keeps the same signing identity instead of losing granted permissions on every rebuild. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
61 lines
2.4 KiB
Bash
Executable File
61 lines
2.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# One-time setup: creates a self-signed code-signing certificate and trusts
|
|
# it for the "codeSign" policy, entirely via CLI (no Keychain Access GUI).
|
|
# This is what scripts/build-signed.sh needs to sign audiotee with a stable
|
|
# identity — see CONTEXT.md §6.2 for why that matters.
|
|
#
|
|
# This script modifies your login keychain's trust settings. Read it before
|
|
# running it. macOS will likely prompt for your login password during the
|
|
# `security import` / `security add-trusted-cert` steps — that's expected,
|
|
# it's the OS asking permission to change keychain ACLs/trust, not this
|
|
# script asking for your password directly.
|
|
#
|
|
# Usage:
|
|
# scripts/create-signing-identity.sh [certificate-name]
|
|
# (default name: audiotee-dev)
|
|
|
|
set -euo pipefail
|
|
|
|
CERT_NAME="${1:-audiotee-dev}"
|
|
DAYS=3650
|
|
KEYCHAIN="$HOME/Library/Keychains/login.keychain-db"
|
|
WORKDIR="$(mktemp -d)"
|
|
trap 'rm -rf "$WORKDIR"' EXIT
|
|
|
|
EXISTING="$(security find-identity -v -p codesigning | grep -c "\"$CERT_NAME\"" || true)"
|
|
if [[ "$EXISTING" -gt 0 ]]; then
|
|
echo "A code-signing identity named \"$CERT_NAME\" already exists. Nothing to do."
|
|
security find-identity -v -p codesigning
|
|
exit 0
|
|
fi
|
|
|
|
echo "Generating a self-signed code-signing certificate: $CERT_NAME"
|
|
openssl req -x509 -newkey rsa:2048 \
|
|
-keyout "$WORKDIR/key.pem" -out "$WORKDIR/cert.pem" \
|
|
-days "$DAYS" -nodes -subj "/CN=$CERT_NAME" \
|
|
-addext "extendedKeyUsage=critical,codeSigning" \
|
|
-addext "basicConstraints=critical,CA:false" \
|
|
-addext "keyUsage=critical,digitalSignature"
|
|
|
|
# -legacy: OpenSSL 3.x defaults to AES-256/SHA-256 for PKCS12, which macOS's
|
|
# Security framework can't read (fails with a misleading "wrong password?").
|
|
# It needs the older RC2/3DES-based encoding this flag produces.
|
|
openssl pkcs12 -export -out "$WORKDIR/cert.p12" \
|
|
-inkey "$WORKDIR/key.pem" -in "$WORKDIR/cert.pem" -passout pass:temporary \
|
|
-legacy
|
|
|
|
echo "Importing into your login keychain (may prompt for your login password)..."
|
|
security import "$WORKDIR/cert.p12" -k "$KEYCHAIN" -P temporary \
|
|
-T /usr/bin/codesign -T /usr/bin/security
|
|
|
|
echo "Trusting it for code signing only, not as a general root CA" \
|
|
"(may prompt for your login password)..."
|
|
security add-trusted-cert -r trustRoot -p codeSign -k "$KEYCHAIN" "$WORKDIR/cert.pem"
|
|
|
|
echo ""
|
|
echo "Done. Verifying the identity is now usable by codesign:"
|
|
security find-identity -v -p codesigning
|
|
|
|
echo ""
|
|
echo "Next: scripts/build-signed.sh (it auto-detects this identity)."
|