fix: Work around macOS signing keychain failure - #2464
Merged
Conversation
electron-builder passes the .p12 import password instead of the generated keychain password to `security set-key-partition-list`, which the `macos-26` runners reject (upstream bug electron-userland/electron-builder#10066, fix PRs #10067/#10101 still open). Create the signing keychain ourselves in the `build-and-publish` action, import the certificate and set the partition list with the correct keychain password, then unset `CSC_LINK`/`CSC_KEY_PASSWORD` so `electron-builder` discovers the identity via `security find-identity` and never hits the buggy code path. `forceCodeSigning` keeps the build fail-fast if discovery finds no identity. Linux is untouched. Revert once the upstream fix lands and we upgrade.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2463
electron-builder passes the .p12 import password instead of the
generated keychain password to
security set-key-partition-list,which the
macos-26runners reject (upstream bugelectron-userland/electron-builder#10066, fix PRs #10067/#10101
still open).
Create the signing keychain ourselves in the
build-and-publishaction, import the certificate and set the partition list with the
correct keychain password, then unset
CSC_LINK/CSC_KEY_PASSWORDso
electron-builderdiscovers the identity viasecurity find-identityand never hits the buggy code path.forceCodeSigningkeeps the build fail-fast if discovery finds no identity.Linux is untouched. Revert once the upstream fix lands and we upgrade.
Please make sure the following boxes are checked: