Xcode 13 Cloud Signing - certificate private key not installed

Question

willft OP

Created Dec ’21

Replies 5

Boosts 0

Views 3.9k

Participants 4

Hello!

I am trying to use the new Xcode 13 Cloud Signing feature (authenticationKeyPath & friends) to archive (and eventually upload) my iOS app via a CI service (GitHub actions in this case). My xcodebuild invocation is as such:

xcrun xcodebuild archive \
    -workspace '/path/to/MyApp.xcworkspace' \
    -scheme 'MyApp - App Store' \
    -archivePath '/path/to/output.xcarchive' \
    -allowProvisioningUpdates \
    -authenticationKeyID 'KEY_ID_HERE' \
    -authenticationKeyIssuerID 'ISSUER_ID_HERE' \
    -authenticationKeyPath '/complete/path/to/key.p8' \
    -destination 'generic/platform=iOS,name=Any iOS Device'

The first run on CI with this invocation succeeds! The second run (i.e. on a clean machine) outputs this error:

error: Revoke certificate: Your account already has an Apple Development signing certificate for this machine, but its private key is not installed in your keychain. Xcode can create a new one after revoking your existing certificate. (in target 'MyApp' from project 'MyApp')

The "Certificates, Identifiers, & Profiles" page does, indeed, list a certificate created by the API key in question. If I revoke this certificate, the next build succeeds and the one after that fails.

I thought the idea with Cloud Signing was to keep from manually installing certificates & provisioning profiles. Am I misunderstanding something?

Is there a modification I can make to this command to make it succeed? Do I need to manually create & install development certificate?

Xcode version: 13.2 beta 2
macOS version: 11 (macOS 12 is not yet supported on GitHub actions)
API key: has admin role

(As a sidenote: I have tried Xcode Cloud, but it suffers random failures & long build times, plus it won't work for all my apps. So that's not currently a viable alternative for me.)

Boost

Answer 1

willft OP

Dec ’21

Note: I have also attempted this with Xcode 13.1 which yielded no difference.

0

Answer 2

bucek.jiri OP

Feb ’22

I am getting exactly the same behavior using the Bitrise CI. Success on the first try and this same error on the subsequent.

Multiple development certificates are really created on the Apple Developer portal. When revoked, this works again.

xcodebuild 
"-project" "/Demo.xcodeproj"
 "-scheme" "Bitrise Demo"
 "-configuration" "Release"
 "-xcconfig" "/temp.xcconfig" "archive"
 "-archivePath" "/Demo.xcarchive"
 "-allowProvisioningUpdates"
 "-authenticationKeyPath" "/AuthKey_YGHQQ95LVN_1271060667.p8" "-authenticationKeyID" "YGHQQ95LVN" "-authenticationKeyIssuerID" "e053-5b8c7c11a4d1"
 "-destination" "generic/platform=iOS"

0

Answer 3

bucek.jiri OP

Feb ’22

The way I went around this in Bitrise is that I manually uploaded a development certificate to Bitrise. Bitrise then uses this uploaded certificate to code sign the archive instead of fetching the certificate from Apple. The other code signing files are then fetched properly and it works as expected. I believe this is a workaround though and the command should fetch an already existing development certificate fine without attempting to create a new one.

1

Answer 4

Kjor OP

Mar ’22

@bucek.jiri: Thanks for the workaround but then, it means that Bitrise is handling the signing and not Xcloud Cloud right?

0

Answer 5

hooke OP

1w

I'm facing the same issue. I contacted Apple support but they didn't have a solution. This problem persists even with Xcode 15.4.

0