[match][sigh] fix access to certs installed by fastlane tools for productsign command for macOS #20474
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
It's ready to merge. |
|
@getaaron Could you also review this one? |
|
@DuMaM this LGTM but the CircleCI builds didn't run, can you connect CircleCI to GitHub and rerun the build? (you should see ~11 checks passed instead of 2 if it worked) |
getaaron
approved these changes
Jul 18, 2022
|
It passed everything :) cc: @getaaron |
|
Awesome thank you so much for your contribution! ❤️ |
|
Thanks for merging it 👍 |
There was a problem hiding this comment.
Congratulations! 🎉 This was released as part of fastlane 2.208.0 🚀
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Checklist
bundle exec rspecfrom the root directory to see all new and existing tests passbundle exec rubocop -ato ensure the code style is validMotivation and Context
This allows for MacOS CI to run without need of any user action from GUI.
Description
Signing MacOS in CI right now is impossible when somebody is using match or sigh for cert management.
I'm looking for official documentation, where the process is well described, but for now this will do the job.
https://www.hexnode.com/mobile-device-management/help/how-to-sign-macos-pkg-files-for-deployment-with-hexnode-mdm/
When somebody will follow those steps, now it will fail on
productsigncommand.Instead of using certs from keychain, user will see password prompt in GUI (even though all certs are added to be
accessible for all), until password will not be correct command will fail.Testing Steps
matchfor appstore (Apple Distribution) with optionadditional_cert_types: mac_installer_distribution--verboseduring lane run to see how import behaves.xcrun productsign --keychain <new_keychain> --sing <Installer_Cert_From_Match> unsigned.pkg signed.pkg