Jenkins Swarm Agent iOS签名链构建失败及权限问题求助

一、签名链构建失败问题解决 #

报错unable to build chain to self-signed root for signer "Apple Development: Local (123456789)"的核心原因是Jenkins代理进程无法访问myuser钥匙串中的签名证书及根证书链，即使证书已在本地导入。

解决步骤：

• 确认Apple Development证书和对应的Apple根证书已导入myuser的登录钥匙串，并对根证书设置「始终信任」（右键证书→显示简介→信任→使用此证书时：始终信任）
• 确保Jenkins代理进程以myuser身份运行，且能访问钥匙串（需要修正LaunchAgent配置）
• 移除Pipeline中不必要的sudo切换，避免权限上下文混乱

二、添加UserName后的代理连接权限问题解决 #

添加<key>UserName</key> <string>myuser</string>后出现Operation not permitted，是因为plist格式错误+macOS隐私权限限制+路径配置错误共同导致。

修正后的LaunchAgent plist配置 #

注意修正EnvironmentVariables的嵌套结构（必须是dict）、补全绝对路径、正确设置UserName：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
         <string>com.jenkins.ci</string>
    <key>SessionCreate</key>
         <true/>
    <key>UserName</key>
         <string>myuser</string>
    <key>EnvironmentVariables</key>
         <dict>
           <key>JENKINS_HOME</key>
           <string>/Users/myuser</string>
         </dict>
    <key>ProgramArguments</key>
         <array>
           <string>/usr/bin/java</string>
           <string>-jar</string>
           <string>/Users/myuser/iosbuildagent/swarm-client-3.24.jar</string>
           <string>-master</string>
           <string>http://jenkins-myaddress.com</string>
           <string>-tunnel</string>
           <string>123.123.123.123:50000</string>
           <string>-username</string>
           <string>myuser</string>
           <string>-password</string>
           <string>mypassword</string>
           <string>-executors</string>
           <string>1</string>
           <string>-mode</string>
           <string>exclusive</string>
           <string>-workDir</string>
           <string>/Users/myuser/iosbuildagent/workspace</string>
           <string>-fsroot</string>
           <string>/Users/myuser/</string>
         </array>
    <key>KeepAlive</key>
         <true/>
    <key>StandardOutPath</key>
         <string>/Users/myuser/iosbuildagent/stdout.log</string>
    <key>StandardErrorPath</key>
         <string>/Users/myuser/iosbuildagent/error.log</string>
  </dict>
</plist>

权限修复操作 #

1. 移除旧的remoting缓存目录并重建权限：

rm -rf /Users/myuser/remoting.jarCache
mkdir -p /Users/myuser/remoting.jarCache
chown myuser:staff /Users/myuser/remoting.jarCache

2. 给Java进程授予全磁盘访问权限：
   • 打开「系统设置→隐私与安全性→全磁盘访问」
   • 点击+号，添加/usr/bin/java（或者你使用的Java路径）
3. 重新加载LaunchAgent：

launchctl unload ~/Library/LaunchAgents/com.jenkins.ci.plist
launchctl load ~/Library/LaunchAgents/com.jenkins.ci.plist

三、优化后的Pipeline脚本 #

移除sudo切换，直接在代理的用户上下文执行脚本（确保代理已以myuser身份运行）：

node('macos') {
    stage('run deploy.sh Debug') {
        sh '''
        cd /Users/myuser/server/services/iosrepo/
        ./deploy.sh Debug
        '''
    }
}

额外验证步骤 #

• 手动运行swarm客户端测试：以myuser身份执行java -jar /Users/myuser/iosbuildagent/swarm-client-3.24.jar [参数]，确认能正常连接Jenkins
• 在代理节点执行security find-identity -v -p codesigning，确认能看到目标签名证书

内容的提问来源于stack exchange，提问作者quaini