From f6741eff4d94fc6f951eb3fda10e2883fd0d510a Mon Sep 17 00:00:00 2001 From: "Dylan M. Taylor" Date: Wed, 11 Nov 2026 16:22:40 -0500 Subject: [PATCH] macOS signing: decode the certificate into an exclusive temp file (#11028) import-cert.sh wrote the decoded .p12 to a fixed name in the temp directory. If another account had created that file first, the shell redirection truncated and reused it, keeping its owner and mode, and the signing key was readable to that account. Create it with mktemp. --- packaging/macos/import-cert.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh index d67e7a6893..7ada923bc8 100755 --- a/packaging/macos/import-cert.sh +++ b/packaging/macos/import-cert.sh @@ -19,7 +19,9 @@ fi TMP="${RUNNER_TEMP:-${TMPDIR:-/tmp}}" KEYCHAIN="$TMP/photocraft-signing.keychain-db" -CERT="$TMP/photocraft-signing.p12" +# A fresh, private file (mktemp creates it exclusively, mode 0600): a predictable name could be +# pre-created by another account, and redirection would keep that file's owner and mode. +CERT="$(mktemp "$TMP/photocraft-signing.XXXXXX")" KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}" trap 'rm -f "$CERT"' EXIT