search

Apple-Actions / import-codesign-certs

GitHub Action for Importing Code-signing Certificates into a Keychain
MIT License
184 stars 78 forks source link

Options to `security import` are confusing #60

Open Sevastyan opened 8 months ago

Sevastyan commented 8 months ago

You are importing a certificate with security import supplying mutually exclusive options -A and -T. For example, following your implementation, a cert would be imported with the following:

/usr/bin/security import cert -k signing_temp.keychain -f pkcs12 -A -T /usr/bin/codesign -T /usr/bin/security -P ***

Option -A negates -T, as "-A Allow any application to access the imported key without warning".

Could you give some explanation to why its implemented this way? Is option -A specified to cover some edge-case and make the action applicable to a wider audience?

Given that it is insecure, maybe it is worth offering -A via an action's own option toggle?