mirror of
https://github.com/Such-Software/hash-wallet.git
synced 2026-10-17 05:41:29 +02:00
jwinterm
5a43cc1114
macOS Keychain Access on Sonoma+ exports .p12 with modern crypto (AES-256-GCM + PBKDF2 + SHA-256). The `security import` binary on some macOS releases — including ours apparently — rejects it with: SecKeychainItemImport: Unknown format in import. The openssl decode itself was fine (now using openssl base64 -d -A), but security can't import the resulting PKCS12 envelope. Pipe the .p12 through openssl: unpack with the user's password, then re-export using legacy PBE-SHA1-3DES for both certs and keys, plus SHA1 MAC. The resulting .p12 uses 90s-era crypto for the OUTER envelope, which is what security import wants — the actual signing keys + cert inside are unchanged. No security implication; the legacy format encryption only matters for the few seconds the .p12 lives in $RUNNER_TEMP before being imported and deleted. Also added diagnostic output (file size, magic bytes, file(1)) so the next failure mode (if any) is easier to characterize.