xcodebuild OTHER_CODE_SIGN_FLAGS --keychain search order

Question

BarryLeslie OP

Created Apr ’18

Replies 2

Boosts 0

Views 6.1k

Participants 4

Hi,

I am posting this in the hopes that it may save someone with a similar problem some time.

A build was failing with the following error:

Code Signing Error: Provisioning profile "FooBar" doesn't include signing certificate "iPhone Developer: foo bar (xxxxxxxxxxx)".

The build was done on the command line with:

xcodebuild OTHER_CODE_SIGN_FLAGS='--keychain /Users/me/Library/Keychains/Buildsystem' (and other parameters)

Before each build we create the Buildsystem keychain and import the certificates needed fo the build into it. The keychain is then removed after the build.

I could do the build locally and it would work, it was only on our build machine under jenkins that it failed.

After spending a lot of time on this I found the cause was that there was another certificate in the builds machine's login keychain that was being used for the code signing even though we had provided a keychain with the correct certificate and told the codsigning to use it. After deleting the bad certificate from teh login keychain everything worked.

So it looks like the -keychain has no effect or that codesigning searched the login keychain before the specified one.

Is there anyway to change this behavior?

The idea of using a special keychain for the build process was to avoid things like this.

Boost

Answer 1

yadam.servicenow OP

Sep ’19

I'm experiencing the same issues. No matter how I format OTHER_CODE_SIGN_FLAGS arguments I cannot convince xcodebuild to use a custom keychain.

As far as I can tell from `xcodebuild -help` and searching online OTHER_CODE_SIGN_FLAGS is the only way to set a custom keychain.

I would love to hear from someone else if they have alternate solutions.

0

Answer 2

m-miscampbell OP

Sep ’20

Hi guys

I was having the exact same issue and was able to find a solution by creating a separate keychain for the certificate, then using the below shell command extract the SHA-1 hash of the certificate.

Code Block security find-identity -v -p codesigning <keychain_path> | awk -F' ' 'NR==1{print $2}'

You can then use xcodebuild to pass this certificate sha1 hash for the key CODE_SIGN_IDENTITY into the OTHER_CODE_SIGN_FLAGS like below:

Code Block xcodebuild -workspace Project.xcworkspace -scheme <ProjectScheme> -configuration <ProjectConfigiguration>
OTHER_CODE_SIGN_FLAGS='--keychain=<Keychain_Path>' CODE_SIGN_IDENTITY=<SHA1_HASH_FOR_CERTIFICATE clean archive

Hope this helps you overcome this issue.

1