mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-09 08:04:45 +00:00
Vitor PamplonaandClaude Opus 4.8
e82237840a
The desktop DMG release leg (build-desktop macos, packageReleaseDmg) has never produced a signed artifact: createReleaseDistributable fails with "Could not find certificate for '***' in keychain []". This is independent of the v1.12.3 notarization fix, which addressed the separate amy CLI leg. Root cause: Compose's MacSignerImpl maps the signing identity to a certificate by running `security find-certificate -a -c <identity>` with no keychain argument. On the GitHub macOS runners that lookup does not resolve the cert that import-macos-cert imported into a throwaway keychain and added only to the user search list — even though bare `codesign --sign` (e.g. the signMacJarNatives task, which succeeds in the same job) finds it fine. The "keychain []" in the error is just the null settings.keychain being echoed. Fix: export the throwaway keychain path from the import-macos-cert action and feed it to Compose's `signing.keychain` via AMETHYST_MAC_SIGN_KEYCHAIN, so the certificate lookup searches that keychain directly. Also set it as the default keychain for good measure. No-op on local/PR builds (env unset -> Compose keeps its previous default-search-list behavior). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>