From 7da8c7716c97bd4d61e6f03a5a89abfbb221e967 Mon Sep 17 00:00:00 2001 From: MasterYoav Date: Fri, 18 Sep 2026 10:42:21 +0300 Subject: [PATCH] The first DMG pass tried to sign before the certificate was imported. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI builds the DMG twice — unsigned first, then again after the import step. Keyed on the identity's name alone, the first pass failed the release with "no identity found". It now signs only when the identity is in a keychain. Co-Authored-By: Claude Opus 5 (1M context) --- scripts/create-dmg.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/scripts/create-dmg.sh b/scripts/create-dmg.sh index 1633ab6..ac66b87 100755 --- a/scripts/create-dmg.sh +++ b/scripts/create-dmg.sh @@ -36,7 +36,13 @@ chmod +x "${STAGE}/Uninstall xBot.command" # and the disk image preserve those. Unsigned, it arrives quarantined from a download and macOS # refuses it as coming from an unidentified developer — which, for the person who already trashed # the app and wants their volumes back, is a dead end with no second path. -if [[ -n "${MACOS_SIGNING_IDENTITY:-}" ]]; then +# +# Only when the identity is actually in a keychain, not merely named. In CI this script runs twice: +# once before the certificate is imported (an unsigned DMG, so a run with no secrets still produces +# one) and again from sign-mac-app.sh afterwards. Keyed on the name alone, the first pass failed the +# release with "no identity found". +if [[ -n "${MACOS_SIGNING_IDENTITY:-}" ]] \ + && security find-identity -v -p codesigning | grep -qF "${MACOS_SIGNING_IDENTITY}"; then codesign --force --timestamp --sign "${MACOS_SIGNING_IDENTITY}" \ "${STAGE}/Uninstall xBot.command" fi