GitHub Action自托管macOS runner签名证书导入失败问题

问题描述 #

使用GitHub Action进行iOS应用分发时，遵循官方指南从GitHub Secrets导入Apple证书和配置文件，仅在自托管macOS环境出现归档失败，签名证书未被识别为有效代码签名身份：

• 执行证书导入命令返回1 identity imported.

  security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
  security list-keychain -d user -s $KEYCHAIN_PATH
  

• 但执行签名身份验证命令返回0 valid identities found

  security find-identity -v -p codesigning $KEYCHAIN_PATH
  

官方托管macos-latest环境可正常运行，完整工作流代码如下：

name: iOS build and TestFlight upload
on:
  pull_request:
    branches:
      - main
  push:
    branches:
      - feature/temp
jobs:
  Build:
    runs-on: [self-hosted, macOS]
    steps:
    - name: Xcode 14.3.1
      run: sudo xcode-select --switch /Applications/Xcode.app

    - name: Checkout repository
      uses: actions/checkout@v2
    
    - name: Setup JDK 17
      uses: actions/setup-java@v3
      with:
        distribution: "zulu"
        java-version: 17
        
    - name: Install the Apple certificate and provisioning profile
      env:
        BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
        P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
        BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }}
        KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
      run: |
        # create variables
        CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
        PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision
        KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db

        # import certificate and provisioning profile from secrets
        echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
        echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH

        # check if the files exist
        ls $CERTIFICATE_PATH
        ls $PP_PATH
      
        # create temporary keychain          
        security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
        security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
        security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

        # keychain information and unlocked
        security show-keychain-info $KEYCHAIN_PATH

        # import certificate to keychain
        security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
        security list-keychain -d user -s $KEYCHAIN_PATH
    
        # checking the validity of the codesigning identities
        security find-identity -v -p codesigning $KEYCHAIN_PATH

        # check if the certificate was added
        security find-certificate -a -p -c $CERTIFICATE_PATH $KEYCHAIN_PATH
      
        # apply provisioning profile
        mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles
        cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles

        # check if the provisioning profile was added
        ls ~/Library/MobileDevice/Provisioning\ Profiles
      
    - name: Build archive
      run: | 
          xcodebuild -scheme XYZProject \
          -project $GITHUB_WORKSPACE/iosApp/XYXProject.xcodeproj \
          -archivePath $RUNNER_TEMP/XYZProject.xcarchive \
          -sdk iphoneos \
          -configuration Release \
          -destination generic/platform=iOS \
          clean archive
      
    - name: Clean up keychain and provisioning profile
      if: ${{ always() }}
      run: |
        security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
        rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision

原因分析 #

1. 证书导入参数错误：原命令中-t cert参数强制指定导入类型为证书，而PKCS12文件包含证书和私钥对，该参数会导致私钥未被正确导入，缺少私钥的证书无法成为有效代码签名身份。
2. 自托管环境钥匙链优先级问题：自托管环境可能存在多个用户钥匙链，临时钥匙链未被设为默认，导致Xcode和security命令无法优先读取。
3. 钥匙链权限限制：自托管环境的macOS系统可能启用了更严格的钥匙链权限，未授予代码签名工具访问临时钥匙链的权限。
4. 系统/命令行为差异：不同macOS版本的security命令行为略有差异，官方托管环境的系统版本经过验证，自托管环境可能存在版本不兼容。

解决方法 #

1. 修正证书导入命令 #

移除-t cert参数，确保PKCS12文件中的证书和私钥都被正确导入：

security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -f pkcs12 -k $KEYCHAIN_PATH

2. 设置临时钥匙链为默认 #

在security list-keychain后添加命令，确保临时钥匙链被设为用户默认钥匙链：

security default-keychain -s $KEYCHAIN_PATH

3. 授予代码签名工具钥匙链访问权限 #

添加命令允许Apple工具访问临时钥匙链：

security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

4. 验证证书与私钥完整性 #

添加命令检查私钥是否成功导入（替换为你的证书名称，可从Apple开发者后台获取）：

security find-generic-password -l "iPhone Distribution: Your Team Name" $KEYCHAIN_PATH

5. 调整后的完整证书安装步骤 #

# import certificate to keychain
security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -f pkcs12 -k $KEYCHAIN_PATH
security list-keychain -d user -s $KEYCHAIN_PATH
# 设置默认钥匙链
security default-keychain -s $KEYCHAIN_PATH
# 授予代码签名权限
security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH

# checking the validity of the codesigning identities
security find-identity -v -p codesigning $KEYCHAIN_PATH

6. 环境兼容性检查 #

• 确保自托管macOS版本符合Xcode 14.3.1要求（需macOS Ventura 13.2或更高版本）
• 验证Xcode命令行工具路径正确，无版本冲突

内容的提问来源于stack exchange，提问作者ajw