Skip to content

Investigation: Alternative paths to fix macOS codesiging#30

Closed
mokagio wants to merge 1 commit into
ainfra-2597-fix-macos-code-signing-for-contributor-toolkitfrom
mokagio/fastlane-macos-signing
Closed

Investigation: Alternative paths to fix macOS codesiging#30
mokagio wants to merge 1 commit into
ainfra-2597-fix-macos-code-signing-for-contributor-toolkitfrom
mokagio/fastlane-macos-signing

Conversation

@mokagio

@mokagio mokagio commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator

Builds on top of #22, but tried to explore other options.

Keep the verification lane in place so Buildkite records the unsigned
artifact failure before trying an alternative certificate setup.

---

Generated with the help of Codex, https://openai.com/codex

Co-Authored-By: Codex GPT-5 <noreply@openai.com>
Copilot AI review requested due to automatic review settings July 10, 2026 06:47
@mokagio
mokagio marked this pull request as draft July 10, 2026 06:47

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR appears to investigate alternative approaches to the macOS code-signing fix introduced in PR #22 by removing the CI-only Apple intermediate certificate import from the Fastlane before_all hook.

Changes:

  • Remove the CI-only download/import of Apple’s “Developer ID Certification Authority” G2 intermediate from before_all.
  • Remove the now-unused require 'tmpdir'.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread fastlane/Fastfile
Comment on lines 21 to 23
before_all do |_lane|
setup_ci # Fixes Keychain access on CI

# macOS 26 CI images don't ship the "Developer ID Certification Authority" G2
# intermediate, and `match` installs only the leaf. Without the intermediate in
# a search-list keychain, `security` can't build the chain and evaluates the
# identity as CSSMERR_TP_NOT_TRUSTED — electron-builder then silently skips
# signing. Install it into the temp keychain `setup_ci` just created.
if FastlaneCore::Helper.is_ci?
cert_path = File.join(Dir.tmpdir, 'DeveloperIDG2CA.cer')
sh('curl', '-fsSL', 'https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer', '-o', cert_path)
import_certificate(certificate_path: cert_path, keychain_name: 'fastlane_tmp_keychain')
end
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants