From 4b76c407d5a42d824524e7b95a7bcfbed47e8d16 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Sun, 25 Oct 2026 09:14:05 -0400 Subject: [PATCH] macOS signing: keep the temporary keychain until the build has signed with it import-cert.sh deleted its whole private temp directory on exit, and the keychain lives there, so codesign failed with "The specified item could not be found in the keychain" in the release build. Co-Authored-By: Claude Opus 5.5 --- packaging/macos/import-cert.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh index aeb58fd4..978874d3 100755 --- a/packaging/macos/import-cert.sh +++ b/packaging/macos/import-cert.sh @@ -19,7 +19,9 @@ fi TMP_BASE="${RUNNER_TEMP:-${TMPDIR:-/tmp}}" TMP="$(mktemp -d "${TMP_BASE}/figcraft-signing.XXXXXX")" -trap 'rm -rf "$TMP"' EXIT +# Remove only the decoded certificate: the keychain lives in the same directory and codesign +# needs it until the workflow's "Remove temporary keychain" step deletes it. +trap 'rm -f "${CERT:-}"' EXIT KEYCHAIN="$TMP/figcraft-signing.keychain-db" CERT="$TMP/figcraft-signing.p12" KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}"