From d15681738195ee140ff533495e4599e889a5c29c Mon Sep 17 00:00:00 2001 From: YuYu1015 Date: Thu, 20 Aug 2026 00:45:16 +0800 Subject: [PATCH 1/2] test(moon): stop the distance assertion depending on the lunar month MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `^3\d\d,\d\d\d km$` says the Moon is between 300,000 and 399,999 km away. It runs from about 356,500 km at perigee to about 406,700 km at apogee, so that pattern is true for most of a lunar month and false near apogee — a test that passes for three weeks and fails in the fourth, on nobody's change. It failed today. What the assertion is actually for is the formatting: a grouped number of kilometres rather than a bare double. Six digits says that without also asserting where the Moon is. --- test/features/data/moon_page_test.dart | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/test/features/data/moon_page_test.dart b/test/features/data/moon_page_test.dart index 3c7235928..cd4d3eb4c 100644 --- a/test/features/data/moon_page_test.dart +++ b/test/features/data/moon_page_test.dart @@ -129,6 +129,11 @@ void main() { expect(find.text(label), findsOneWidget, reason: label); } // The distance is a grouped number of kilometres, never a bare double. - expect(find.textContaining(RegExp(r'^3\d\d,\d\d\d km$')), findsOneWidget); + // + // Six digits, not "starts with a 3". The Moon's distance runs from about + // 356,500 km at perigee to about 406,700 km at apogee, so a leading 3 is + // true for most of a lunar month and false near apogee — which is a test + // that passes for three weeks and fails in the fourth, on nobody's change. + expect(find.textContaining(RegExp(r'^\d\d\d,\d\d\d km$')), findsOneWidget); }); } From 92a8c5713c9f6d92111fecb4077a9533dd613bbd Mon Sep 17 00:00:00 2001 From: YuYu1015 Date: Thu, 20 Aug 2026 00:46:34 +0800 Subject: [PATCH 2/2] ci(ios): say which secret is wrong instead of failing inside base64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first run of this step died on base64: stdin: (null): error decoding base64 input stream Error: Process completed with exit code 1 which names neither the secret nor the mistake, in a step whose whole job is to stop a signing problem from being cryptic. The value was a *path* rather than the file's contents. I could not find any other input that produces that message: empty, wrapped lines, stray spaces and even a PEM header all decode without complaint on macOS, so the one thing it does say is the one thing it says badly. So the decode is guarded and its result is checked. Whitespace is stripped first, because a value that travelled through a browser text field arrives with whatever that field did to it, and `base64 --decode` is not uniformly forgiving about it across runner images. Then the bytes have to start 0x30, the DER SEQUENCE tag — a .cer, a PEM or a truncated paste all reach `security import` otherwise, and it answers "Unknown format in import", which is the same problem one layer further down. --- tool/release/ios_keychain.sh | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/tool/release/ios_keychain.sh b/tool/release/ios_keychain.sh index b4dd6f9f4..15bd7bb47 100755 --- a/tool/release/ios_keychain.sh +++ b/tool/release/ios_keychain.sh @@ -75,7 +75,35 @@ keychain="$RUNNER_TEMP/dpip-signing.keychain-db" keychain_password="$(uuidgen)" p12="$RUNNER_TEMP/dpip-ios-dev.p12" -printf '%s\n' "$APPLE_DEV_CERT_BASE64" | base64 --decode > "$p12" +# Whitespace out first. A value that travelled through a browser text field +# can arrive with a trailing newline or a wrapped line, and neither is part of +# the payload — but `base64 --decode` on macOS is not uniformly forgiving about +# them across versions, and this is not a thing to leave to the runner image. +# +# The failure being caught here is not exotic; it is the one that happened. The +# secret held a *path* rather than the file's contents, and all `base64` said +# was "stdin: (null): error decoding base64 input stream" — a message that +# names neither the secret nor the mistake, in a step whose entire job is to +# stop a signing problem from being cryptic. +if ! printf '%s' "$APPLE_DEV_CERT_BASE64" | tr -d '[:space:]' | + base64 --decode > "$p12" 2>/dev/null; then + printf '::error::APPLE_DEV_CERT_BASE64 is not base64.\n' + printf 'It usually means the path was pasted instead of the contents. ' + printf 'Rebuild it with: base64 -i | pbcopy\n' + exit 1 +fi + +# And check it is a PKCS#12 rather than merely *some* bytes. DER starts with a +# SEQUENCE tag, 0x30 — a .cer, a PEM, or a truncated paste all fail here, and +# all of them would otherwise reach `security import` and be reported as +# "Unknown format in import", which says nothing about which secret is wrong. +if [[ ! -s $p12 ]] || [[ $(head -c 1 "$p12" | od -An -tx1 | tr -d ' ') != 30 ]]; then + printf '::error::APPLE_DEV_CERT_BASE64 decoded to %s bytes that are not a ' \ + "$(wc -c < "$p12" | tr -d ' ')" + printf 'PKCS#12 file. Export the identity from Keychain Access -> ' + printf 'My Certificates -> Export as .p12, then base64 that file.\n' + exit 1 +fi security create-keychain -p "$keychain_password" "$keychain" # `-t 21600` is the inactivity timeout. `-l` locks on sleep as well — it is a