Identity findable by `security find-identity`, but not `codesign`

I am experiencing an issue with signing an application, where codesign is unable to find the identity I am referencing. I have imported a .p12 certificate into a keychain labeled build.keychain, and running security find-identity -v -p codesigning build.keychain returns 1 valid codesigning identity. When I use the unique identifier provided (the all-caps hex hash) as the signing identity for the codesign command, the command exits with the error error: The specified item could not be found in the keychain. I have tried specifying the keychain to search within ("build.keychain"), as well as running the command without specifying the keychain.

The specific command in question is:

codesign --continue --force -vvvv --keychain /Users/runner/Library/Keychains/build.keychain-db -s $SIGNER_HEX_HASH --options runtime path/to/app/App.app/Contents/Frameworks/App.framework/Versions/A

My apologies if I'm missing something obvious. Most forums and posts reference cases where no valid signing identity is present in the results of security find-identity.

Does your build keychain show up in the list printed by:

% security list-keychains

That’s required because --keychain is only used to restrict the search for the identity.

ps There are some minor issues with how you sign your framework:

  • When signing bundled code, it’s best to sign the bundle, not a specific item within the bundle.

  • The hardened runtime flag is only necessary for executables.

See Creating Distribution-Signed Code for Mac for more hints and tips in this space.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Identity findable by `security find-identity`, but not `codesign`
 
 
Q