Repository navigation
fix(ci): put the helper signing keychain ON the search list - #458
Merged
Merged
Conversation
#457 stopped unlisting the helper keychain but never listed it: on this runner image 'security create-keychain' does not append to the user's search list, so the identity stayed invisible to codesign and cli/desktop darwin shards still died with 'item could not be found'. Probe run 40325026239 on macos-14 proved the split: the same keychain fails while unlisted and signs cleanly once listed, and --keychain alone never helps. List it as the sole entry exactly as the CLI darwin shards already do (the path that signed cli-server-v3.0.2 today); the trap restores the baseline at step end.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #457, which stopped unlisting the helper keychain but never listed it. Probe run 40325026239 on macos-14 settled the mechanism:
security create-keychaindoes not append to the user's search list on this image, andcodesignresolves a named identity through the search list only ---keychainalone never helps. Same keychain: unlisted = "item could not be found", listed = signs clean. The fix makes the keychain the sole search-list entry exactly as the CLI darwin shards already do (the path that signed cli-server-v3.0.2 today); the step's trap restores the baseline. Both duplicated desktop job bodies edited identically (release-cut-order drift test passes); docs paragraph rewritten to the probe-proven account.