Unable to code sign on OSX, the specified item could not be found. #820
Comments
|
Please set env |
|
I received my certificate as a file from our companies releng department but I'm pretty sure I have it correct. I've attached the log. |
|
Root certs (Apple, StartSSL) are imported and keychain is added to search list. But we got "The specified item could not be found in the keychain.".
Does it work on another machine (maybe CI)? You have in any case workaround: import your |
|
@sethlu Maybe you can advice something? |
|
@develar I think before @Mossop responses, my only suggestion is that we better have a screenshot of a list of certs @Mossop has in his keychain for |
So, electron-builder creates keychain for specified p12 file and then tries to find valid identities — Yeah — I am not sure, is identity valid if no private key or not (no doubt — it is not valid to code sign). |
I can't test on another machine right now but I did import it into the keychain and signing worked correctly like that so something is right with the certificate. I am going to have to do this in CI eventually though so trying to get this working from a file is important to me. I exported the certificate using the instructions given then deleted it from my keychain and tried again and got the same failure. I tried again by exporting both the certificate and private key and again got the same problem. The only certs in the electron_builder_root_certs keychain are:
None of them are expired. |
|
Currently no open issues about it and it works for me (code sign on CI). Let's wait results on another machine / CI server. I think, it is some strange local issue. |
|
I've managed to successfully sign on a different machine so there must be something wrong with the setup of my development machine. How could I figure out what it is? |
|
@Mossop Are your private keys for signing exported along with the signing certs? For each signing cert in keychain there should be a corresponding private key (which Apple doesn't hold a copy). If the other machine succeeded in code signing while the current does not, the issue may lie in this I doubt. 😕 |
|
@sethlu I'm testing with the same p12 file referenced by CSC_LINK in both cases. In one which is a fairly clean machine it works, on my development machine it doesn't. Is it possible that having the private key in my default keychain could be causing problems? I don't really want to remove it to test as that is the root copy. |
|
I have same issue. When I use base64 from CSC_LINK I have this: To debug this, I put a breakpoint inside electron-builder and copied keychain and password. When I open it in Keychain Access and not provide CSC_LINK, application builds successfully, so it's definitely not problem with certificate itself. Also I put breakpoint in electron-osx-sign-tf and checked that the keychain exists and has certificates right before it's used. It is clearly visible from the log too. In fact, I think that it's something in electron-osx-sign-tf, but I was unable to figure out what is going wrong and why. I actually paused the execution and run exactly same codesign command manually and it succeeded. |
|
It is not time issue, since we correctly find valid cert after import. Well, I guess it is some codesign Apple bug. You both have company certs, as far I see :) Please see http://stackoverflow.com/a/19160225/1910191 — do you understand the answer, does it help you? |
|
There is a valid Apple Worldwide Certification Authority cert in electron_builder_root_certs keychain, that is added during the build. Not sure what I should do with it (I had no idea about macOS desktop development or iOS development approx week ago, so maybe I'm missing something obvious). It can't be a codesign bug, because:
So it might be something with how codesign is called by builder. Unsafe arguments or something? Is it possible? |
No. It is not *** Windows. But env maybe different. Compare |
|
Good idea, I checked env in terminal and env inside script. Exactly the same, except |
|
@jatt Do you have another cert? Could you please try to sign using different cert? |
|
@develar thanks for your advice, I did more testing with other certificate, and nothing changed. Though I was able to find something else: if I pass CSC_LINK and CSC_CERT_PASSWORD, everything works. If I pass the same p12 in base64 string and password via programmatic API it fails as described before. I'm checking now, maybe there's something wrong with a way I read this base64 string. It's hard to do it wrong, though. To clarify: I programmatically generate p12 using node-forge, but when I talk about CSC_LINK above, it links to p12 generated by my code and it works correctly this way, so it's not broken p12. |
|
@Mossop I think I figured what is the problem. Something very close to this is discussed in this SO question: http://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p Indeed, it seems that only Keychain Access.app knows how to properly unlock keychain. Here's what I did:
Unfortunately, it doesn't count as workaround, because I need it to work on CI server. So I will continue to investigate issue, and will try to submit PR with fix and test some time next week. |
|
I am running in the same bug running on Travis (macOS 10.12) |
|
Hello all, I'm running in to the same problem. Switching back to OS X 10.11 seems to have fixed it. Is there any way to get this to work on macOS Sierra? Thanks! |
|
My CI server builds the application fine (10.11), but on my dev machine using macOS Sierra 10.12.2 it doesn't work. electron-builder /Users/erock/notion/desktop/node_modules/7zip-bin-mac/7za (21988) exited with code 0 +1s
node_modules/windows-shortcuts-appid is not packed into asar archive - contains executable code
electron-builder Executing security find-identity -v /var/folders/qf/jm643rrn5sqc3zcn85hvty6c0000gn/T/electron-builder-yXnMic/t-55dd-0.keychain +116ms
electron-builder Executing security find-identity -v -p codesigning /var/folders/qf/jm643rrn5sqc3zcn85hvty6c0000gn/T/electron-builder-yXnMic/t-55dd-0.keychain +3ms
1) 68989144DA1E68EBD47B05BA67C04D291637E580 "Developer ID Application: Company AI, Inc. (6SF49XZ6MH)"
1 valid identities found
1) 68989144DA1E68EBD47B05BA67C04D291637E580 "Developer ID Application: Company AI, Inc. (6SF49XZ6MH)"
1 valid identities found
Signing app (identity: Developer ID Application: Company AI, Inc. (6SF49XZ6MH))
Error: Exit code: 1. Command failed: codesign --sign Developer ID Application: Company AI, Inc. (6SF49XZ6MH) --force --keychain /var/folders/qf/jm643rrn5sqc3zcn85hvty6c0000gn/T/electron-builder-yXnMic/t-55dd-0.keychain /Users/erock/notion/desktop/dist/mac/Notion.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework
error: The specified item could not be found in the keychain.
error: The specified item could not be found in the keychain.
at /Users/erock/notion/desktop/node_modules/electron-osx-sign-tf/util.js:69:16 |
@neurosnap It seems your electron-builder is old. Please upgrade to latest version (unlikely it will help, but just to be sure). |
|
This is with the identical Error: Command failed: codesign --sign Developer ID Application: Company AI, Inc. (6SF49XZ6MH) --force --keychain /var/folders/qf/jm643rrn5sqc3zcn85hvty6c0000gn/T/electron-builder-5NNSnv/0-1.keychain /Users/erock/notion/desktop/dist/mac/Notion.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Electron Framework
error: The specified item could not be found in the keychain.
at ChildProcess.exithandler (child_process.js:206:12)
at emitTwo (events.js:106:13)
at ChildProcess.emit (events.js:191:7)
at maybeClose (internal/child_process.js:877:16)
at Process.ChildProcess._handle.onexit (internal/child_process.js:226:5)
From previous event:
at MacPackager.sign (/Users/erock/notion/desktop/node_modules/electron-builder/out/macPackager.js:290:11)
at /Users/erock/notion/desktop/node_modules/electron-builder/src/macPackager.ts:86:26
From previous event:
at /Users/erock/notion/desktop/node_modules/electron-builder/src/macPackager.ts:86:10
at next (native)
From previous event:
at MacPackager.pack (/Users/erock/notion/desktop/node_modules/electron-builder/out/macPackager.js:185:11)
at /Users/erock/notion/desktop/node_modules/electron-builder/src/packager.ts:161:22
From previous event:
at Packager.doBuild (/Users/erock/notion/desktop/node_modules/electron-builder/out/packager.js:296:11)
at /Users/erock/notion/desktop/node_modules/electron-builder/src/packager.ts:129:38
at next (native)
at runCallback (timers.js:637:20)
at tryOnImmediate (timers.js:610:5)
at processImmediate [as _immediateCallback] (timers.js:582:5)
From previous event:
at Packager.build (/Users/erock/notion/desktop/node_modules/electron-builder/out/packager.js:248:11)
at /Users/erock/notion/desktop/node_modules/electron-builder/src/builder.ts:250:40
at next (native)
From previous event:
at build (/Users/erock/notion/desktop/node_modules/electron-builder/out/builder.js:90:21)
at Object.<anonymous> (/Users/erock/notion/desktop/node_modules/electron-builder/out/cli/build-cli.js:68:41)
at Module._compile (module.js:570:32)
at Object.Module._extensions..js (module.js:579:10)
at Module.load (module.js:487:32)
at tryModuleLoad (module.js:446:12)
at Function.Module._load (module.js:438:3)
at Module.runMain (module.js:604:10)
at run (bootstrap_node.js:394:7)
at startup (bootstrap_node.js:149:9)
at bootstrap_node.js:509:3 |
|
I got a similar problem after upgrade Mac OS to 10.12.2. I used CSC_LINK with file:///***.p12 along with CSC_KEY_PASSWORD and it works fine before upgrade. Related log information FYI: electron-builder Executing security import .... electron-builder Executing security find-identity -v /Applications/.../t-3de-0.keychain
Signing app (identity: Developer ID Application: **** inc. (***)) Error: Command failed: codesign --sign Developer ID Application: **** () --force --keychain /Applications//t-3de-0.keychain *** |
|
Hello All, Very similar situation for me... Here is some of the debug log... CSC_LINK=***.p12 Going to try on another machine to test Sierra... |
|
Package.json "build": {
"asar": true,
"npmRebuild": false,
"win": {
"target": "nsis"
},
"nsis": {
"oneClick": true,
"warningsAsErrors": false,
"perMachine": true
},
"publish": {
"provider": "generic"
}
},
"devDependencies": {
"electron": "^1.4.7",
"electron-builder": "^11.4.4",
"electron-debug": "^1.0.1",
"electron-devtools-installer": "^2.0.1",
"electron-installer-codesign": "~0.3.0",
"electron-packager": "^8.5.0",
},
"dependencies": {
"electron-auto-updater": "^1.0.0"
}, |
|
@FJunior225 from your issue I suppose |
|
@ekalinichev did you get anywhere with sorting out a PR to fix the original problem in this issue? |
|
@jwheare unfortunately not. Wasn't able to move further than described in my previous comment |
|
OK, thanks for your investigation. I can also confirm that the issue is resolved for me by switching back to 10.11 ( |
|
Hi @FJunior225 I feel like this is an issue with I will have a check during the weekend and see why |
|
Moved to backlog to keep issue list clear. |
|
I'm running also in to the issue on CircleCI. Here's are the OSX specs: https://circleci.github.io/macos-image-tests/ Build fails with: edit:// the same environment vairables I used on circle ci work on my local machine. edit2:// oh ok, if I remove the certificate from the keychain on my local machine, then the build fails with the same error. |
|
@arekkas please Open separate issue and please check that your p12 file contains not only cert, but private key also. |
That was it, thanks! |
|
@ekalinichev , was it not sufficient to stick that magic command into the code signing process? I tried here: https://github.com/thomasjm/electron-builder/commit/207689575c09bded78a9fab23e1c21d785fa6552 However, I'm having some trouble testing the fix, because I can't seem to build |
|
@eriedl-kiban Interesting... electron-builder tests failed on new travis Xcode 8.3 image. Will check. |
|
@eriedl-kiban I did not, I decided to just put the certificate on the mac's keychain as a workaround. I still think that fix should be straightforward to do though. |
|
One of our build servers was upgraded to macOS Sierra and now electron-builder fails at this spot. Do we have any resolution on this error? |
|
@neurosnap Please file issue and I will try to fix it as soon as possible. |
|
Having the same issue. If i import those certificates into login keychain, everything is fine, even though i've set CSC_IDENTITY_AUTO_DISCOVERY to false. OS: 10.12 |
|
If someone else stumbles across this issue, for me it's fixed with version 19.8.0. |
|
@nlsrchtr Version 19.8.0 of what? Thanks. |
|
@Nowaker With version 19.8.0 of electron-builder. |
|
For anyone running into this issue when building with a CI runner that was started using launchd: The CI runner (GitHub Actions in my case) could not access the keychain. This was fixed by setting "SessionCreate" to "true" in the plist file. See this SO answer for more information. |
|
This Github guid shows how to install certificate in keychain. |
|
For any one who blocked by this issue. I checked all above and all is right. How do I fix? Please note Just delete the expired cert. |
Building works normally but as soon as I set CSC_LINK to the base64 encoded value of my certificate or a file:// url for the certificate file building fails at code signing with "error: The specified item could not be found in the keychain."
The text was updated successfully, but these errors were encountered: