sign releases with imported keychain identity

2026-05-24 19:10:02 +02:00
parent 083f8e7068
commit 55f5a70ff5
3 changed files with 27 additions and 3 deletions
@@ -298,10 +298,15 @@ sign_and_validate_darwin_binary() {
 	local binary="$1"
 	local version_output
 	local codesign_details
+	local codesign_args

 	[[ -n "$codesign_identity" ]] || die "CUSTOM_RELEASE_CODESIGN_IDENTITY is required for darwin builds"

-	codesign --force --sign "$codesign_identity" --options runtime --timestamp "$binary"
+	codesign_args=(--force --sign "$codesign_identity" --options runtime --timestamp)
+	if [[ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]]; then
+		codesign_args+=(--keychain "$CUSTOM_RELEASE_KEYCHAIN_PATH")
+	fi
+	codesign "${codesign_args[@]}" "$binary"

 	version_output="$("$binary" --version)"
 	if [[ "$version_output" == *modernc-sqlite* ]]; then