From b32bf2987ee523efabaed45e12d45e3455303a18 Mon Sep 17 00:00:00 2001
From: coso <wutongci@hotmail.com>
Date: Thu, 15 Jan 2026 18:42:27 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=B0=86=20aster=20=E4=BE=9D=E8=B5=96?=
 =?UTF-8?q?=E6=94=B9=E4=B8=BA=20git=20=E4=BB=93=E5=BA=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/release.yml | 44 +++++++++++++++++++++++++++++------
 src-tauri/Cargo.lock          |  1 +
 src-tauri/Cargo.toml          |  3 +--
 src-tauri/entitlements.plist  | 18 ++++++++++++++
 src-tauri/tauri.conf.json     |  5 ++--
 5 files changed, 60 insertions(+), 11 deletions(-)
 create mode 100644 src-tauri/entitlements.plist

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 925beb1fc..d166a444f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -79,12 +79,43 @@ jobs:
       - name: Install frontend dependencies
         run: pnpm install --no-frozen-lockfile
 
+      # macOS 签名证书设置
+      - name: Import Apple Certificate
+        if: matrix.platform == 'macos-latest'
+        env:
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+        run: |
+          # 创建临时 keychain
+          KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
+          KEYCHAIN_PASSWORD=$(openssl rand -base64 32)
+          
+          # 解码证书
+          echo -n "$APPLE_CERTIFICATE" | base64 --decode > $RUNNER_TEMP/certificate.p12
+          
+          # 创建 keychain
+          security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
+          security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          
+          # 导入证书
+          security import $RUNNER_TEMP/certificate.p12 -P "$APPLE_CERTIFICATE_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
+          security set-key-partition-list -S apple-tool:,apple: -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
+          security list-keychain -d user -s $KEYCHAIN_PATH
+
       - name: Build Tauri app
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_PROFILE_RELEASE_LTO: thin
           CARGO_PROFILE_RELEASE_CODEGEN_UNITS: 16
+          # Apple 签名和公证环境变量
+          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         with:
           tauriScript: npx tauri
           tagName: ${{ github.event.inputs.version || github.ref_name }}
@@ -105,16 +136,15 @@ jobs:
             - **Windows (64-bit)**: `proxycast_*_x64-setup.exe`
             - **Linux x64**: `proxycast_*_amd64.deb` / `proxycast_*_amd64.AppImage`
 
-            ### macOS 首次安装
-
-            由于应用未经 Apple 签名，首次打开可能提示「应用已损坏」，请运行：
-            ```bash
-            xattr -cr /Applications/proxycast.app
-            ```
-
             ### 默认配置
             - **端口**: 8999
             - **API Key**: 首次启动自动生成，可在设置页查看/修改
           releaseDraft: false
           prerelease: false
           args: --target ${{ matrix.target }}
+
+      # 清理 keychain
+      - name: Cleanup Keychain
+        if: matrix.platform == 'macos-latest' && always()
+        run: |
+          security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 9ba68aa59..5efb99e4d 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -181,6 +181,7 @@ checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
 [[package]]
 name = "aster"
 version = "0.3.0"
+source = "git+https://github.com/astercloud/aster-rust?branch=main#2487b9349d12c86fbe6ee61d5a9396769978df68"
 dependencies = [
  "ahash",
  "anyhow",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 0b0d12c46..2273aaca9 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -78,8 +78,7 @@ window-vibrancy = "0.7.1"
 if-addrs = "0.13"
 
 # Aster Agent Framework
-# 使用本地路径进行开发，后续切换到 git
-aster = { path = "../../../astercloud/aster-rust/crates/aster" }
+aster = { git = "https://github.com/astercloud/aster-rust", branch = "main" }
 
 # Platform specific dependencies for browser interceptor
 
diff --git a/src-tauri/entitlements.plist b/src-tauri/entitlements.plist
new file mode 100644
index 000000000..e7b78d299
--- /dev/null
+++ b/src-tauri/entitlements.plist
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.network.client</key>
+    <true/>
+    <key>com.apple.security.network.server</key>
+    <true/>
+    <key>com.apple.security.files.user-selected.read-write</key>
+    <true/>
+</dict>
+</plist>
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 581a43935..8d340662a 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -61,11 +61,12 @@
       "resources/models/**/*"
     ],
     "macOS": {
-      "entitlements": null,
+      "entitlements": "entitlements.plist",
       "exceptionDomain": null,
       "frameworks": [],
       "providerShortName": null,
-      "signingIdentity": null
+      "signingIdentity": "-",
+      "minimumSystemVersion": "10.15"
     }
   },
   "plugins": {