From 79bf9a688c85bc2e15bf2d0905ce07fde8da0902 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Sun, 25 Oct 2026 09:13:55 -0400 Subject: [PATCH] macOS signing: keep the temporary keychain until the build has signed with it import-cert.sh deleted its whole private temp directory on exit, and the keychain lives there, so codesign failed with "The specified item could not be found in the keychain" in the release build. Co-Authored-By: Claude Opus 5.5 --- packaging/macos/import-cert.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh index 901d3095..1b911e31 100755 --- a/packaging/macos/import-cert.sh +++ b/packaging/macos/import-cert.sh @@ -24,7 +24,9 @@ KEYCHAIN="$TMP_DIR/deckcraft-signing.keychain-db" CERT="$TMP_DIR/deckcraft-signing.p12" KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}" -trap 'rm -rf "$TMP_DIR"' EXIT +# Remove only the decoded certificate: the keychain lives in the same directory and codesign +# needs it until the workflow's "Remove temporary keychain" step deletes it. +trap 'rm -f "${CERT:-}"' EXIT printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT" security create-keychain -p "$KC_PASS" "$KEYCHAIN" security set-keychain-settings -lut 21600 "$KEYCHAIN"