mirror of
https://github.com/nolen777/eagle0.git
synced 2026-07-28 21:35:42 +00:00
c3ad03c270
* Fix Mac codesign by isolating build keychain during signing The --keychain flag alone doesn't prevent codesign from finding matching identities in other keychains on the search list. Fix by temporarily setting ONLY the build keychain as the search list during signing, then restoring the original list on exit. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Include System.keychain for Apple root certificates The previous fix broke certificate chain verification because we removed the login keychain but also lost access to Apple's root certificates. Include System.keychain (which has Apple roots) but not login.keychain (which has the duplicate signing identity). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Use certificate SHA-1 hash instead of name to avoid ambiguity Instead of manipulating the keychain search list (which breaks certificate chain verification), extract the SHA-1 hash of the specific certificate from the build keychain and use that as the signing identity. SHA-1 hashes are unambiguous and codesign will use the exact certificate specified. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Fix certificate hash extraction - get first valid identity The previous grep for SIGNING_IDENTITY failed because GitHub Actions masks the value. Instead, get the first valid codesigning identity from the keychain (there should only be one since we just imported it). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Use full keychain path for find-identity security find-identity requires the full path to the keychain file, not just the keychain name. Resolve the full path from list-keychains output before querying for identities. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Add debug output to certificate import and remove set-keychain-settings Add debug output to see what identities are available after import. Also remove the set-keychain-settings line which may be causing issues (the -u flag locks keychain on sleep). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Search all keychains for identity hash The build keychain import isn't creating a recognizable codesigning identity, but the certificate exists in login.keychain. Search all keychains and use the hash of the first valid identity - hashes are unique and unambiguous regardless of which keychain contains them. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>