security commands coming from build runner yielding no results

Question

Created Nov ’24

Replies 4

Boosts 0

Participants 2

I'm trying to sign a build coming from a gitlab runner, but for some reason security find-identity is yielding no results during the pipeline.

Hitting the runner via SSH shows the results as I would expect, as well as VNCing into the runner and using the terminal.

whoami on all 3 shows the same result

My current attempt is to build the keychain on the fly so that I can ensure I have access to the identity, and it succeeds in building the keychain and importing the certs, but find-identity still shows zero results in the pipeline.

- security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
- security list-keychains -d user -s "$KEYCHAIN_PATH" "/Users/######/Library/Keychains/login.keychain-db" "/Library/Keychains/System.keychain"
- security set-keychain-settings "$KEYCHAIN_PATH"
- security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"

- security import "$SIGNING_KEY_DECODED" -P "$P12_PASSWORD" -A -f pkcs12 -k $KEYCHAIN_PATH -T "/usr/bin/codesign"
- > # escape :
    CERT_IDENTITY="##########"
    security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" -D "$CERT_IDENTITY" -t private "$KEYCHAIN_PATH"
- echo $(security find-identity)

The echo at the end returns the following:

Policy: X.509 Basic
  Matching identities
     0 identities found
  Valid identities only
     0 valid identities found

Running the same command via ssh/terminal over VNC after the build fails returns the following:

Policy: X.509 Basic
  Matching identities
  1) C6......A2 "iPhone Distribution: ###########"
     1 identities found

  Valid identities only
  1) C6......A2 "iPhone Distribution: ###########"
     1 valid identities found

Which suggests that the keychain creation and certificate import is working as expected.

I'm not ruling out the possibility of this being an issue on gitlab's end, but this has been working historically, and only really stopped working since we've updated to Sonoma (we're on 14.7.1 now). We have an active runner on Ventura 13.6.1 that's working still.

Boost

Answer 1

DTS Engineer OP

Apple

Dec ’24

In your script, if you do a security list-keychains before that security find-identity, what does it give you back?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

pgasher OP

Dec ’24

$ echo $(security list-keychain)

"/Library/Keychains/System.keychain" "/Library/Keychains/System.keychain"

$ echo $(security list-keychain -d user)

"/Users/#######/####.keychain" "/Users/#######/Library/Keychains/login.keychain-db" "/Library/Keychains/System.keychain"

####.keychain is the $KEYCHAIN_PATH variable from the script.

0

Answer 3

pgasher OP

Dec ’24

something that's interesting -- if I adjust the first list-keychain -s command to remove the -d user and otherwise leave it the same, the echo for list-keychain still returns the same result:

- security list-keychains -s "$KEYCHAIN_PATH" "/Users/######/Library/Keychains/login.keychain-db" "/Library/Keychains/System.keychain"

$ echo $(security list-keychain)

"/Library/Keychains/System.keychain" "/Library/Keychains/System.keychain"

0

Answer 4

DTS Engineer OP

Apple

Dec ’24

I suspect that your CI infrastructure is running your script is some sort of mixed context that’s confusing Security framework. I see this a lot, where a daemon switches the BSD context without switching the security context. I talk about this concept in a lot more detail in Technote 2083 Daemons and Agents.

Unfortunately I don’t have a good answer to that. The approach you’ve outlined works when run from Terminal and from SSH, and the thing that those two mechanism have in common is that security ends up running in a consistent user login context, with both the BSD context and security context aligned.

My only suggestion is that you raise this issue with your CI vendor.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0