[sigh] fix: prevent empty string as input to codesign on KEYCHAIN_FLAG#30018
Conversation
"${KEYCHAIN_FLAG}" 被加了引号，当 KEYCHAIN_FLAG 为空时，会传一个空字符串参数给 codesign，导致 "No such file or directory"
错误。第 587 行和第 900 行的同名变量都没有加引号，是正确的。
zengchunshan
changed the title
iBotPeaches
left a comment
iBotPeaches
left a comment
There was a problem hiding this comment.
thanks! We aren't going to add the ignore back, so lets fix this the right way like we did for the other properties - f6017ed
I imagine we can treat it like any of the other ones there. So we can unquote it later. Make sure shelllint passes :)
- KEYCHAIN_FLAG (string) → KEYCHAIN_ARGS (array), initialized as (), populated as (--keychain "$KEYCHAIN_PATH") — same shape as PAGESIZE_ARGS.
- The 3 codesign call sites all use "${KEYCHAIN_ARGS[@]}" (quoted, like "${PAGESIZE_ARGS[@]}").
- Both # shellcheck disable=SC2086 comments and their "Must not quote KEYCHAIN_FLAG…" notes can be removed — they no longer apply.
- The log-presence check switches from [[ -n "${KEYCHAIN_FLAG}" ]] to [[ ${#KEYCHAIN_ARGS[@]} -gt 0 ]] (the array equivalent).
- shellcheck on resign.sh should now pass without that suppression on these lines.
zengchunshan
left a comment
zengchunshan
left a comment
There was a problem hiding this comment.
Thanks for the pointer to f6017ed — makes total sense. I've updated the patch to follow the same approach: convert KEYCHAIN_FLAG into a KEYCHAIN_ARGS=() array (mirror of PAGESIZE_ARGS), use "${KEYCHAIN_ARGS[@]}" at all three codesign call sites, and drop both # shellcheck disable=SC2086 suppressions plus the "Must not quote KEYCHAIN_FLAG…" comments. The presence check at the top becomes [[ ${#KEYCHAIN_ARGS[@]} -gt 0]]. shellcheck passes cleanly on resign.sh now, and the original OnDemandResources/*.assetpack failure is fixed as a side-effect (empty array → zero args, so no stray '' reaches codesign).
iBotPeaches
left a comment
iBotPeaches
left a comment
There was a problem hiding this comment.
Acts like PAGESIZE_ARGS now and makes sense and bonus without the shell lint ignore.
iBotPeaches
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @zengchunshan 👋
Thank you for your contribution to fastlane and congrats on getting this pull request merged 🎉
The code change now lives in the master branch, however it wasn't released to RubyGems yet.
We usually ship about once a month, and your PR will be included in the next one.
Please let us know if this change requires an immediate release by adding a comment here 👍
We'll notify you once we shipped a new release with your changes 🚀"
fastlane#30018) * KEYCHAIN_FLAG 的引号问题 "${KEYCHAIN_FLAG}" 被加了引号，当 KEYCHAIN_FLAG 为空时，会传一个空字符串参数给 codesign，导致 "No such file or directory" 错误。第 587 行和第 900 行的同名变量都没有加引号，是正确的。 * Refactor keychain handling in resign.sh - KEYCHAIN_FLAG (string) → KEYCHAIN_ARGS (array), initialized as (), populated as (--keychain "$KEYCHAIN_PATH") — same shape as PAGESIZE_ARGS. - The 3 codesign call sites all use "${KEYCHAIN_ARGS[@]}" (quoted, like "${PAGESIZE_ARGS[@]}"). - Both # shellcheck disable=SC2086 comments and their "Must not quote KEYCHAIN_FLAG…" notes can be removed — they no longer apply. - The log-presence check switches from [[ -n "${KEYCHAIN_FLAG}" ]] to [[ ${#KEYCHAIN_ARGS[@]} -gt 0 ]] (the array equivalent). - shellcheck on resign.sh should now pass without that suppression on these lines.
There was a problem hiding this comment.
Congratulations! 🎉 This was released as part of fastlane 2.234.0 🚀
github-actions
Bot
added
status: released
and removed
status: included-in-next-release
labels
2 participants
使用 fastlane sigh resign 对一个包含 OnDemandResources 目录（其中带有 .assetpack 资源包）的 .ipa 进行重签名时，签名过程会中止并报错：
No such file or directory
Encountered an error, aborting!
[!] Failed to re-sign .ipa
该问题只在未传 --keychain-path 参数（即 KEYCHAIN_FLAG 为空）时出现。
根因分析
在 sigh/lib/assets/resign.sh 中，用于签名 .assetpack 的 codesign 调用对 ${KEYCHAIN_FLAG} 加了双引号：
https://github.com/fastlane/fastlane/blob/master/sigh/lib/assets/resign.sh#L565
/usr/bin/codesign ${VERBOSE} "${PAGESIZE_ARGS[@]}" --generate-entitlement-der "${KEYCHAIN_FLAG}" -f -s "$CERTIFICATE" "$assetpack"
当用户没有传 --keychain-path 时，KEYCHAIN_FLAG 是空字符串。由于被双引号包裹，bash 会把它展开成一个字面量空参数 '' 传给 codesign，于是 codesign
把这个空字符串当作要签的文件路径来处理，从而抛出 No such file or directory 错误。
同一脚本里另外两处 codesign 调用（约第 587 行的 frameworks 签名、约第 900 行的主 app 签名）做法是正确的——${KEYCHAIN_FLAG} 不加引号，并附有明确注释：
Must not quote KEYCHAIN_FLAG because it needs to be unwrapped and passed to codesign with spaces
shellcheck disable=SC2086
/usr/bin/codesign ${VERBOSE} "${PAGESIZE_ARGS[@]}" --generate-entitlement-der ${KEYCHAIN_FLAG} -f -s "$CERTIFICATE" "$framework"
所以第 565 行看起来是一处回归 / 与文件其余部分不一致的写法。
Checklist
bundle exec rspecfrom the root directory to see all new and existing tests passbundle exec rubocop -ato ensure the code style is validci/circlecibuilds in the "All checks have passed" section of my PR (connect CircleCI to GitHub if not)Motivation and Context
Description
Testing Steps