Fix Mac codesign by using certificate hash (#5690)

* Fix Mac codesign by isolating build keychain during signing

The --keychain flag alone doesn't prevent codesign from finding matching
identities in other keychains on the search list. Fix by temporarily
setting ONLY the build keychain as the search list during signing, then
restoring the original list on exit.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Include System.keychain for Apple root certificates

The previous fix broke certificate chain verification because we removed
the login keychain but also lost access to Apple's root certificates.
Include System.keychain (which has Apple roots) but not login.keychain
(which has the duplicate signing identity).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Use certificate SHA-1 hash instead of name to avoid ambiguity

Instead of manipulating the keychain search list (which breaks certificate
chain verification), extract the SHA-1 hash of the specific certificate
from the build keychain and use that as the signing identity. SHA-1 hashes
are unambiguous and codesign will use the exact certificate specified.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix certificate hash extraction - get first valid identity

The previous grep for SIGNING_IDENTITY failed because GitHub Actions
masks the value. Instead, get the first valid codesigning identity from
the keychain (there should only be one since we just imported it).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Use full keychain path for find-identity

security find-identity requires the full path to the keychain file,
not just the keychain name. Resolve the full path from list-keychains
output before querying for identities.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Add debug output to certificate import and remove set-keychain-settings

Add debug output to see what identities are available after import.
Also remove the set-keychain-settings line which may be causing issues
(the -u flag locks keychain on sleep).

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Search all keychains for identity hash

The build keychain import isn't creating a recognizable codesigning
identity, but the certificate exists in login.keychain. Search all
keychains and use the hash of the first valid identity - hashes are
unique and unambiguous regardless of which keychain contains them.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/mac_build.yml

@@ -140,16 +140,23 @@ jobs:
           security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
 
           # Import certificate
+          echo "=== Importing certificate ==="
           security import certificate.p12 -k "$KEYCHAIN_NAME" -P "$MACOS_CERTIFICATE_PWD" -T /usr/bin/codesign -T /usr/bin/security
 
           # Allow codesign to access keychain
+          echo "=== Setting key partition list ==="
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME"
 
           # Add keychain to search list (required for codesign to find certificates)
+          echo "=== Adding keychain to search list ==="
           security list-keychains -d user -s "$KEYCHAIN_NAME" login.keychain
 
-          # Set longer timeout for signing large app bundles
-          security set-keychain-settings -t 3600 -u "$KEYCHAIN_NAME"
+          # Debug: Check what's in the keychain after import
+          echo "=== Debug: Identities in build keychain ==="
+          KEYCHAIN_PATH="$HOME/Library/Keychains/$KEYCHAIN_NAME-db"
+          security find-identity -v -p codesigning "$KEYCHAIN_PATH" || true
+          echo "=== Debug: All available identities ==="
+          security find-identity -v -p codesigning || true
 
           # Clean up
           rm certificate.p12

scripts/codesign_mac_app.sh

@@ -25,6 +25,22 @@ if [ -n "${KEYCHAIN_PASSWORD:-}" ]; then
     security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_NAME" || true
 fi
 
+# Get the SHA-1 hash of the signing certificate
+# Using the hash avoids "ambiguous" errors when the same identity exists in multiple keychains
+echo "Available codesigning identities:"
+security find-identity -v -p codesigning
+
+# Get the first valid identity hash (the hash is unique and unambiguous)
+CERT_HASH=$(security find-identity -v -p codesigning | grep -E '^\s+[0-9]+\)' | head -1 | awk '{print $2}')
+if [ -z "$CERT_HASH" ]; then
+    echo "ERROR: No valid signing identity found"
+    exit 1
+fi
+echo "Using certificate hash: $CERT_HASH"
+
+# Use the hash as the signing identity to avoid ambiguity
+SIGNING_IDENTITY="$CERT_HASH"
+
 echo "=== Signing nested components first ==="
 echo "Using keychain: $KEYCHAIN_NAME"