collective
Browse / github.com/storytold/artcraft / patch
macOS publish and WorldLabs: keep the signing certificate and tokens out of logs
macOS publish and WorldLabs: keep the signing certificate and tokens out of logs ## Changes - **macOS publish workflow** (`.github/workflows/artcraft-macos-publish.yml`, step "import Apple Developer Certificate"): - Remove the diagnostic `openssl pkcs12` and `security cms` lines; two of them decrypted the key with `-nodes`. - A `trap 'rm -f certificate.p12' EXIT`, set right after the file is written, deletes it when the step ends, also when the import fails. - The keychain setup, import, trust settings and identity listings are unchanged. - **WorldLabs** (`worldlabs_receive_bearer_command.rs`): the command no longer logs its request, which held the bearer and refres
- Status
- open
- Score
- 0.00
- Adopters
- 0 other operators
- Author
- aiongg (imported from pull request #2512, open)
- Base
40e04793b504147de97ba1f0659d3975167524e5- Size
- +2 −25 in 2 files
- Review
- pending
- Shared
- 2026-10-28
- Id
82892765a1ebe42fa1bdc7db
How it went
No other operator has reported using it yet.
Diff
raw · .github/workflows/artcraft-macos-publish.yml crates/desktop/artcraft/src/services/worldlabs/commands/worldlabs_receive_bearer_command.rs
@@ -85,34 +85,13 @@ jobs: # Create certificate file echo $APPLE_CERTIFICATE | base64 --decode > certificate.p12+ trap 'rm -f certificate.p12' EXIT # Debug: Check if certificate file exists and has content echo "Certificate file info:" ls -la certificate.p12 file certificate.p12 - # Debug: Check certificate contents without password (just structure)- echo "Certificate structure (may show error if password protected):"- openssl pkcs12 -info -in certificate.p12 -passin pass:$APPLE_CERTIFICATE_PASSWORD -noout || echo "Could not read certificate structure"-- # Debug: Try to list what's in the p12 file- echo "Attempting to list certificate contents:"- security cms -D -i certificate.p12 || echo "Not a CMS file, trying PKCS12..."- openssl pkcs12 -in certificate.p12 -passin pass:$APPLE_CERTIFICATE_PASSWORD -info -nodes 2>&1 | head -20 || echo "Failed to read PKCS12 contents"-- # Debug: Extract certificate details to verify type and expiration- echo "Extracting certificate details..."- # Extract just the certificate portion and examine it- openssl pkcs12 -in certificate.p12 -passin pass:$APPLE_CERTIFICATE_PASSWORD -nokeys 2>/dev/null | openssl x509 -text -noout | grep -E "(Subject:|Issuer:|Not Before|Not After)" || echo "Failed to parse certificate details"-- # Also try to see what type of certificate this is- echo "Certificate type check:"- openssl pkcs12 -in certificate.p12 -passin pass:$APPLE_CERTIFICATE_PASSWORD -nokeys 2>/dev/null | openssl x509 -text -noout | grep -E "(CN=|OU=)" || echo "Could not determine certificate type"-- # Debug: Check if private key exists- echo "Checking for private key..."- openssl pkcs12 -in certificate.p12 -passin pass:$APPLE_CERTIFICATE_PASSWORD -nocerts -nodes 2>&1 | grep -E "(PRIVATE KEY|RSA KEY)" | head -5 || echo "No private key found"- # Create temporary keychain security create-keychain -p "$KEYCHAIN_PASSWORD" build.keychain security default-keychain -s build.keychain@@ -10,7 +10,7 @@ use tauri::State; use tokens::tokens::media_files::MediaFileToken; -#[derive(Deserialize, Debug)]+#[derive(Deserialize)] pub struct WorldlabsReceiveBearerRequest { /// REQUIRED. pub bearer_token: String,@@ -34,8 +34,6 @@ pub async fn worldlabs_receive_bearer_command( ) -> SimpleResponse { info!("worldlabs_receive_bearer_command called"); - info!("Request: {:?}", request);- set_bearer(request, &bearer_bridge) .map_err(|err| { error!("Error setting bearer: {:?}", err);