Fastlane Match未安装密钥，CI服务器iOS应用签名失败求助

It sounds like you're hitting a common CI-specific snag with Fastlane Match—let's break down why the private key isn't installing and how to get your builds working smoothly.

Why This Happens #

Match does handle private keys as part of its core workflow, but CI environments are clean, ephemeral setups with restricted keychain access. The most likely issues are:

1. Your private key was never uploaded to your Match Git repository.
2. The CI environment's keychain lacks the permissions needed for Match to import the key.

Step 1: Verify Your Match Repository Has the Private Key #

First, check if your Match repo includes the private key:

• Navigate to the Git repo you configured for storing signing assets via Match.
• Look for a private_keys folder—inside, you should see a .p12 file linked to your ad-hoc certificate.

If that file is missing, upload your local key to the repo:
On your Mac, run this command to push all your local signing assets to Match's repo:

fastlane match adhoc

You only need to do this once (or whenever you add new signing assets).

Step 2: Fix CI Keychain Permissions with setup_ci #

CI environments use locked, temporary keychains by default. Fastlane has a built-in action to resolve this—add setup_ci to your lane before running match.

Here's your updated lane code:

desc "Builds the app for the Beta distribution"
lane :build_adhoc do
  setup_ci # Configures CI keychain for seamless signing
  match(type: "adhoc", readonly: true)
  build_app(scheme: "MyApp", export_method: "ad-hoc")
end

What setup_ci does behind the scenes:

• Creates a dedicated temporary keychain for signing tasks
• Unlocks the keychain and sets it as the default for Fastlane actions
• Adjusts permissions so Match can import the private key without access errors

Step 3: Confirm CI Has Access to Your Match Repository #

Ensure your CI server can clone your Match repo:

• If using SSH, add the CI server's SSH key to the repo's access list
• If using HTTPS, store the repo's credentials as secrets in your CI platform (most services like GitHub Actions, GitLab CI, or Jenkins support secure secret storage)

Final Test #

Run your CI build again—Match should now download and install the private key, certificate, and provisioning profile, letting build_app sign your app successfully.

内容的提问来源于stack exchange，提问作者Jan