🔨 Improve config for cert_chain

Author: pboling

version_gem.gemspec

@@ -13,9 +13,12 @@ Gem::Specification.new do |spec|
   # Ref: https://gitlab.com/oauth-xx/version_gem/-/issues/3
   # Hence, only enable signing if the cert_file is present.
   # See CONTRIBUTING.md
-  cert_file = ENV.fetch("GEM_CERT_PATH", "certs/#{ENV.fetch("GEM_CERT_USER", ENV["USER"])}.pem")
-  if cert_file && File.exist?(File.join(__dir__, cert_file))
-    spec.cert_chain = [ENV.fetch("GEM_CERT_PATH", "certs/#{ENV.fetch("GEM_CERT_USER", ENV["USER"])}.pem")]
+  default_user_cert = "certs/#{ENV.fetch("GEM_CERT_USER", ENV["USER"])}.pem"
+  default_user_cert_path = File.join(__dir__, default_user_cert)
+  cert_file_path = ENV.fetch("GEM_CERT_PATH", default_user_cert_path)
+  cert_chain = cert_file_path.split(",")
+  if cert_file_path && cert_chain.map { |fp| File.exist?(fp) }
+    spec.cert_chain = cert_chain
     if $PROGRAM_NAME.end_with?("gem", "rake") && ARGV[0] == "build"
       spec.signing_key = File.expand_path("~/.ssh/gem-private_key.pem")
     end