We have a cert imported that has a password and I was running into errors running the script because it forces "yes" answers to everything when running 'mst-cli install' to upgrade after setting known-good digests.
Here's the ERROR:
Mac verify error: invalid password?
fail: Error executing RunContainerCommand
There's maybe a more elegant way to fix this but in the script I replaced:
"
log "Running mst-cli install (auto-confirm yes)..."
# mst-cli reads its 'Continue installation?' prompt from /dev/tty, so a plain
# `yes | mst-cli install` pipe is ignored. `script` (util-linux, ships with
# every supported distro) allocates a PTY and lets us feed 'yes' answers in.
printf 'yes\n%.0s' {1..10} | script -qec 'mst-cli install' /dev/null
"
with
"
mst-cli install
"
This allowed me to run through the install prompts manually and enter the TLS Cert Import Password.