From bca67944b8d3152b4117a049b4043e48c1aba90d Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Sun, 25 Oct 2026 09:14:00 -0400 Subject: [PATCH] macOS signing: keep the temporary keychain until the build has signed with it import-cert.sh deleted its whole private temp directory on exit, and the keychain lives there, so codesign failed with "The specified item could not be found in the keychain" in the release build. Co-Authored-By: Claude Opus 5.5 --- packaging/macos/import-cert.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packaging/macos/import-cert.sh b/packaging/macos/import-cert.sh index ce9432e4e..14732dd44 100755 --- a/packaging/macos/import-cert.sh +++ b/packaging/macos/import-cert.sh @@ -26,7 +26,9 @@ KEYCHAIN="$WORK/gridcraft-signing.keychain-db" CERT="$WORK/gridcraft-signing.p12" KC_PASS="${KEYCHAIN_PASSWORD:-$(openssl rand -hex 24)}" -trap 'rm -rf "$WORK"' EXIT +# Remove only the decoded certificate: the keychain lives in the same directory and codesign +# needs it until the workflow's "Remove temporary keychain" step deletes it. +trap 'rm -f "${CERT:-}"' EXIT printf '%s' "$APPLE_CERTIFICATE" | base64 --decode >"$CERT" security create-keychain -p "$KC_PASS" "$KEYCHAIN" security set-keychain-settings -lut 21600 "$KEYCHAIN"