Sravan/BizGaze_Remote
0
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ci(ios): pass a fixed CERTIFICATE_PRIVATE_KEY so the distribution cert is reusable

Browse Source 
fetch-signing-files --create alone mints a throwaway distribution certificate whose
private key dies with the build VM; the next build then finds a cert it has no key
for and fails 'Cannot save Signing Certificates without certificate private key'.
Supplying our own fixed private key (secure var in the ios_signing group) makes the
cert reproducible and reusable across builds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Sravan
2026-07-17 15:47:28 +05:30
parent 84315ccfb4
commit 1ffc69469b
1 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codemagic.yaml
+11 -1
View File
@@ -23,6 +23,8 @@ workflows:
# a brand-new app it fails init with "No matching profiles found …". Instead the "Set up code # a brand-new app it fails init with "No matching profiles found …". Instead the "Set up code
# signing" script below runs `fetch-signing-files … --create`, which creates the distribution # signing" script below runs `fetch-signing-files … --create`, which creates the distribution
# certificate + profile on first run, then `xcode-project use-profiles` wires them into the project. # certificate + profile on first run, then `xcode-project use-profiles` wires them into the project.
groups:
- ios_signing # ← Codemagic variable group holding CERTIFICATE_PRIVATE_KEY (secure). See below.
vars: vars:
BUNDLE_ID: "com.bizgaze.connect" BUNDLE_ID: "com.bizgaze.connect"
XCODE_WORKSPACE: "mobile/ios/App/App.xcworkspace" XCODE_WORKSPACE: "mobile/ios/App/App.xcworkspace"
@@ -55,9 +57,17 @@ workflows:
# cert to the keychain. NOTE: `xcode-project use-profiles` is intentionally NOT here — it must # cert to the keychain. NOTE: `xcode-project use-profiles` is intentionally NOT here — it must
# run AFTER `pod install` generates the workspace, otherwise it fails to wire the profile into # run AFTER `pod install` generates the workspace, otherwise it fails to wire the profile into
# the App target and the archive dies with "App requires a provisioning profile". # the App target and the archive dies with "App requires a provisioning profile".
#
# --certificate-key is REQUIRED for reusable signing: without it, --create makes a throwaway
# distribution cert whose private key dies with the build machine, so the next build finds a
# cert it has no key for ("Cannot save Signing Certificates without certificate private key").
# By passing our own fixed private key (CERTIFICATE_PRIVATE_KEY, a secure var in the
# `ios_signing` group), the cert is created once from that key and reused by every build.
keychain initialize keychain initialize
app-store-connect fetch-signing-files "$BUNDLE_ID" \ app-store-connect fetch-signing-files "$BUNDLE_ID" \
--type IOS_APP_STORE --create --type IOS_APP_STORE \
--certificate-key="@env:CERTIFICATE_PRIVATE_KEY" \
--create
keychain add-certificates keychain add-certificates
- name: Install CocoaPods - name: Install CocoaPods