From 5c8b324dc8a5b14e08df9342562e20e8ac8a88bd Mon Sep 17 00:00:00 2001 From: Dan Crosby Date: Thu, 29 Jan 2026 21:51:15 -0800 Subject: [PATCH] Fix Mac codesigning to use correct keychain in CI (#5697) * Remove --keychain flag from codesign commands The --keychain flag was causing codesign to look for the private key in the build keychain, but the matching cert+key is in login.keychain. Since we now use the unambiguous SHA-1 hash, codesign will find the correct certificate and key pair in whichever keychain contains them. This fixes the intermittent errSecInternalComponent failures. Co-Authored-By: Claude Opus 4.5 * Use build keychain specifically for CI codesigning In CI, the workflow imports the signing certificate into a temporary build keychain. Previously, the script searched ALL keychains and picked the first certificate found, which could be an old certificate from login.keychain instead of the freshly imported one. Now when KEYCHAIN_NAME is set (CI environment), the script looks for certificates only in that specific keychain. For local dev (no KEYCHAIN_NAME), it still searches all keychains. Co-Authored-By: Claude Opus 4.5 --------- Co-authored-by: Claude Opus 4.5 --- scripts/codesign_mac_app.sh | 44 +++++++++++++++++++++---------------- 1 file changed, 25 insertions(+), 19 deletions(-) diff --git a/scripts/codesign_mac_app.sh b/scripts/codesign_mac_app.sh index 85387890d8..bc8edef063 100755 --- a/scripts/codesign_mac_app.sh +++ b/scripts/codesign_mac_app.sh @@ -5,33 +5,49 @@ # # Environment variables: # SIGNING_IDENTITY - The signing identity (default: "Developer ID Application") -# KEYCHAIN_PASSWORD - Password to unlock the build keychain (optional) -# KEYCHAIN_NAME - Name of the keychain to unlock and use for signing (default: "build.keychain") +# KEYCHAIN_PASSWORD - Password to unlock the keychain (optional, CI only) +# KEYCHAIN_NAME - Name of the keychain containing the signing certificate (optional, CI only) +# When set, looks for certificate in this specific keychain. +# When not set, searches all keychains (local dev mode). set -euxo pipefail APP_PATH="$1" ENTITLEMENTS_PATH="${2:-}" SIGNING_IDENTITY="${SIGNING_IDENTITY:-Developer ID Application}" -KEYCHAIN_NAME="${KEYCHAIN_NAME:-build.keychain}" +# KEYCHAIN_NAME is set by CI workflow - don't set a default here so we can detect if we're in CI if [ ! -d "$APP_PATH" ]; then echo "ERROR: App not found at $APP_PATH" exit 1 fi -# Unlock keychain if password provided -if [ -n "${KEYCHAIN_PASSWORD:-}" ]; then +# Unlock keychain if password and keychain name are provided (CI environment) +if [ -n "${KEYCHAIN_PASSWORD:-}" ] && [ -n "${KEYCHAIN_NAME:-}" ]; then security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME" || true fi # Get the SHA-1 hash of the signing certificate # Using the hash avoids "ambiguous" errors when the same identity exists in multiple keychains -echo "Available codesigning identities:" -security find-identity -v -p codesigning +# We look in the build keychain specifically if KEYCHAIN_NAME is set (CI environment) +# Otherwise fall back to searching all keychains (local dev) + +if [ -n "${KEYCHAIN_NAME:-}" ]; then + # CI environment: look for certificate in the build keychain specifically + KEYCHAIN_PATH="$HOME/Library/Keychains/${KEYCHAIN_NAME}-db" + echo "Looking for signing identity in build keychain: $KEYCHAIN_PATH" + echo "Available identities in build keychain:" + security find-identity -v -p codesigning "$KEYCHAIN_PATH" + + CERT_HASH=$(security find-identity -v -p codesigning "$KEYCHAIN_PATH" | grep -E '^\s+[0-9]+\)' | head -1 | awk '{print $2}') +else + # Local dev: search all keychains + echo "Available codesigning identities:" + security find-identity -v -p codesigning + + CERT_HASH=$(security find-identity -v -p codesigning | grep -E '^\s+[0-9]+\)' | head -1 | awk '{print $2}') +fi -# Get the first valid identity hash (the hash is unique and unambiguous) -CERT_HASH=$(security find-identity -v -p codesigning | grep -E '^\s+[0-9]+\)' | head -1 | awk '{print $2}') if [ -z "$CERT_HASH" ]; then echo "ERROR: No valid signing identity found" exit 1 @@ -42,13 +58,11 @@ echo "Using certificate hash: $CERT_HASH" SIGNING_IDENTITY="$CERT_HASH" echo "=== Signing nested components first ===" -echo "Using keychain: $KEYCHAIN_NAME" # Sign all dylibs find "$APP_PATH" -name "*.dylib" -print0 | while IFS= read -r -d '' item; do echo "Signing dylib: $item" codesign --force --verify --verbose --timestamp --options runtime \ - --keychain "$KEYCHAIN_NAME" \ --sign "$SIGNING_IDENTITY" "$item" done @@ -56,7 +70,6 @@ done find "$APP_PATH" -name "*.bundle" -print0 | while IFS= read -r -d '' item; do echo "Signing bundle: $item" codesign --force --verify --verbose --timestamp --options runtime \ - --keychain "$KEYCHAIN_NAME" \ --sign "$SIGNING_IDENTITY" "$item" done @@ -68,7 +81,6 @@ find "$APP_PATH" -name "*.xpc" -print0 | while IFS= read -r -d '' item; do fi echo "Signing XPC service: $item" codesign --force --verify --verbose --timestamp --options runtime \ - --keychain "$KEYCHAIN_NAME" \ --sign "$SIGNING_IDENTITY" "$item" done @@ -80,7 +92,6 @@ find "$APP_PATH" -path "*/Frameworks/*.app" -print0 | while IFS= read -r -d '' i fi echo "Signing nested app: $item" codesign --force --verify --verbose --timestamp --options runtime \ - --keychain "$KEYCHAIN_NAME" \ --sign "$SIGNING_IDENTITY" "$item" done @@ -92,7 +103,6 @@ find "$APP_PATH" -path "*/Frameworks/*/Versions/*/Autoupdate" -type f -print0 | fi echo "Signing executable: $item" codesign --force --verify --verbose --timestamp --options runtime \ - --keychain "$KEYCHAIN_NAME" \ --sign "$SIGNING_IDENTITY" "$item" done @@ -102,12 +112,10 @@ find "$APP_PATH" -name "*.framework" -print0 | while IFS= read -r -d '' item; do if [[ "$item" == *"Sparkle.framework" ]]; then echo "Signing Sparkle framework with --deep: $item" codesign --deep --force --verify --verbose --timestamp --options runtime \ - --keychain "$KEYCHAIN_NAME" \ --sign "$SIGNING_IDENTITY" "$item" else echo "Signing framework: $item" codesign --force --verify --verbose --timestamp --options runtime \ - --keychain "$KEYCHAIN_NAME" \ --sign "$SIGNING_IDENTITY" "$item" fi done @@ -117,12 +125,10 @@ echo "=== Signing main app bundle ===" if [ -n "$ENTITLEMENTS_PATH" ] && [ -f "$ENTITLEMENTS_PATH" ]; then echo "Using entitlements: $ENTITLEMENTS_PATH" codesign --force --verify --verbose --timestamp --options runtime \ - --keychain "$KEYCHAIN_NAME" \ --entitlements "$ENTITLEMENTS_PATH" \ --sign "$SIGNING_IDENTITY" "$APP_PATH" else codesign --force --verify --verbose --timestamp --options runtime \ - --keychain "$KEYCHAIN_NAME" \ --sign "$SIGNING_IDENTITY" "$APP_PATH" fi