ci: fix release workflow

Author: id

.github/workflows/release.yaml

@@ -130,7 +130,7 @@ jobs:
           - macos-14
           - macos-15
         otp:
-          - 27.2-3
+          - 27
 
     runs-on: ${{ matrix.macos }}
 
@@ -140,6 +140,8 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.inputs.branch_or_tag }}
       - name: prepare
+        env:
+          OTP: ${{ matrix.otp }}
         run: |
           brew install curl zip unzip gnu-sed freetds erlang@$OTP
           echo "/usr/local/bin" >> $GITHUB_PATH
@@ -151,8 +153,8 @@ jobs:
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPLE_ID_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
           APPLE_DEVELOPER_IDENTITY: ${{ secrets.APPLE_DEVELOPER_IDENTITY }}
-          APPLE_DEVELOPER_ID_BUNDLE: ${{ secrets.APPLE_DEVELOPER_ID_BUNDLE }}
-          APPLE_DEVELOPER_ID_BUNDLE_PASSWORD: ${{ secrets.APPLE_DEVELOPER_ID_BUNDLE_PASSWORD }}
+          APPLE_DEVELOPER_ID_BUNDLE: ${{ matrix.os == 'macos-14' && secrets.APPLE_DEVELOPER_ID_BUNDLE || secrets.APPLE_DEVELOPER_ID_BUNDLE_NEW }}
+          APPLE_DEVELOPER_ID_BUNDLE_PASSWORD: ${{ matrix.os == 'macos-14' && secrets.APPLE_DEVELOPER_ID_BUNDLE_PASSWORD || secrets.APPLE_DEVELOPER_ID_BUNDLE_PASSWORD_NEW }}
           BUILD_WITHOUT_QUIC: 1
         run: |
           erl -eval 'erlang:display(erlang:system_info(system_version)),halt()'

scripts/macos-sign-binaries.sh

@@ -23,7 +23,7 @@ if [[ "${APPLE_DEVELOPER_ID_BUNDLE:-0}" == 0 || "${APPLE_DEVELOPER_ID_BUNDLE_PAS
 fi
 
 PKSC12_FILE="$HOME/developer-id-application.p12"
-base64 --decode > "${PKSC12_FILE}" <<<"${APPLE_DEVELOPER_ID_BUNDLE}"
+printf '%s' "${APPLE_DEVELOPER_ID_BUNDLE}" | base64 --decode > "${PKSC12_FILE}"
 
 KEYCHAIN="emqtt-bench-$(date +%s).keychain-db"
 KEYCHAIN_PASSWORD="$(openssl rand -base64 32)"
@@ -40,7 +40,12 @@ security set-keychain-settings "${KEYCHAIN}"
 security unlock-keychain -p "${KEYCHAIN_PASSWORD}" "${KEYCHAIN}"
 security import "${PKSC12_FILE}" -P "${APPLE_DEVELOPER_ID_BUNDLE_PASSWORD}" -t cert -f pkcs12 -k "${KEYCHAIN}" -T /usr/bin/codesign
 security set-key-partition-list -S "apple-tool:,apple:,codesign:" -s -k "${KEYCHAIN_PASSWORD}" "${KEYCHAIN}"
-security verify-cert -k "${KEYCHAIN}" -c "${PKSC12_FILE}"
+if [ "$(sw_vers -productVersion | cut -d'.' -f1)" -ge 15 ]; then
+  openssl pkcs12 -in "${PKSC12_FILE}" -clcerts -nokeys -out certificate.crt --passin "pass:${APPLE_DEVELOPER_ID_BUNDLE_PASSWORD}"
+  security verify-cert -k "${KEYCHAIN}" -c certificate.crt
+else
+  security verify-cert -k "${KEYCHAIN}" -c "${PKSC12_FILE}"
+fi
 security find-identity -p codesigning "${KEYCHAIN}"
 
 # add new keychain into the search path for codesign, otherwise the stuff does not work