How to fix Xcode's code sign issues on Jenkins? - ios

I have done the usual steps of making the xcodebuild work on jenkins, which would be installing "keychain & provisioning profiles" plugin, uploading the right keychain+profiles in the plugin's configuration, and using security -v unlock-keychain, and PROVISIONING_PROFILE in the xcodebuild command.
the build goes forward O.K., even runs the defined postbuild scripts defined in the Xcode project, and creates the .app folder with all the necessary content, but fails here...
/Users/Shared/Jenkins/Home/jobs/iOS_feature/workspace/build/Applications/MyApp.app/Frameworks/libswiftUIKit.dylib: User interaction is not allowed.
*** error: Couldn't codesign /Users/Shared/Jenkins/Home/jobs/iOS_feature/workspace/build/Applications/MyApp.app/Frameworks/libswiftUIKit.dylib: codesign failed with exit code 1
Any ideas what could cause this? from what I understand, the Keychain+ProvisioningProfiles are in place since the build doesn't fail here.

firstly, are you passing your keychain password to the security -v unlock-keychain command (using -p)? it's definitely not an ideal solution, because it probably requires exposing your password in clear text on your build server.
our workaround for this problem is to login to the actual machine (remote screen sharing or locally sitting at the machine). run a single build from the desktop, whether it be command line or in Xcode. (you might be asked to "always allow" but i'm not 100% sure under which scenarios this will happen).
from then on, all your remote CI builds should pass through code signing successfully.

It's not due to reverse DNS failing or self signed certs on the Jenkins box is it?
We had similar issues though not on Jenkins but Xcode 7 does these extra two checks we found.

Does CodeSign have permission to use the private key?
Whenever I see this error, this is usually the solution:
https://stackoverflow.com/a/22637896/78496

Related

Xcode 11 SPM authentication failed because no credentials provided

I started using Swift package manager and when I add repository with https (https://github.com/Alamofire/Alamofire.git) address authentication always fails when I try to login with my github account
Xcode authentication fail
But if I'm using git#github.com:Alamofire/Alamofire.git it will get added successfully. I tried regenerating new key, deleted .ssh directory but nothing makes https work and I still get xcode authentication failed because no credentials were provided error. I could use locally ssh url but in CI I need one with https.
It was a problem with git config. In .gitconfig file it was set to
[url "git#github.com:"]
insteadOf = https://github.com/
After removing this section https worked correctly
EDIT: as mentioned in comments you can easily access your gitconfig in terminal with command: git config --global --edit
In my case with Xcode 11.3.1 I had the same problem and I solved changing de auth method to SSH from HTTPS in Github account preferences on Xcode.
Building off of two previous answers, I solved this by doing what Abrahanfer did, setting Clone using to SSH in Xcode Preferences -> Account.
Then I used the SSH url of the repo, for example: git#github.com:AppPear/SwiftUI-PullToRefresh.git
you can use ssh URLs instead of https, e.g. git#github.com:ORG_NAME/REPO_NAME.git
I double clicked the error message Error while fetching remote repository: git#github.com:ORG/REPO-NAME.git or the The server SSH fingerprint failed to verify
in Xcode's Report Navigator which then a popup appeared asking if I wanted to trust the host. After clicking that I was able to add the Swift Package using SSH.
Selecting HTTPS or SSH in the Xcode Preferences did not fix for me because Xcode seems to automatically handle SSH GitHub URLs in the SPM flow.
what worked for me was both #SimonasDaniliauskas answer and #Abrahanfer answer
Basically in the command line I had to run:
git config --global --unset-all url.git#github.com:.insteadof
And in Xcode I had to go to Xcode > Preferences and switch my GitHub to use SSH
Btw, if you don't have ssh setup, follow this medium post or these GitHub directions. If you need change your ssh keys follow this YouTube tutorial
If you are facing this and your .gitconfig has below, and you want to keep it!
[url "git#github.com:"]
insteadOf = https://github.com/
just add below two lines after above two lines in your .gitconfig
[url "https://github.com/apple"]
insteadOf = https://github.com/apple
Duplicate above two lines and replace /apple with any other /user or /org where you might want to download your packages from
Try removing it and adding it again. If that won't work, remove your GitHub account from Xcode. Usually, git via ssh works better. What CI are you using?
For me, it seems more like a red herring (maybe a fellow developer accidentally checked in this small change related to swift package in project setting). I went to project setting, removed it from under "Swift Packages". It seems okay after that.
I keep having this issue in Xcode 12.0.1 (12A7300).
My GitHub credentials seemed to not work, even though I applied all the suggestions above.
The way I fixed it (for now, at least) was to switch to SSH only authentication.
I managed to get HTTPS working fine with CI. The solution, with bitrise, is to use 'Authenticate host with netrc', then Xcode will find private HTTPS repos properly. I am sure other CI platforms (or your own) can setup the same solution.
Adding repo via source tree and checking out repo through Xcode use some other tool, then adding same repo via SPM. Try creating SSH key via rsa key algorithm instead of ed255189 key algorithm. SPM tool comfortably work with rsa.
Note: rsa key authentication is slower than ed25519 key authentication.
I followed the other anwsers here with no success. Eventually it turned out that the package was added to XCode with my username inside the https domain, like that:
https://yarden_k#bitbucket.org/private/package/path.git
so I had to adjust the accepted answer the same way (I added those lines to .gitconfig file):
[url "git#bitbucket.org:"]
insteadOf = https://yarden_k#bitbucket.org/
And viola! It finally worked. Was a real headache to figure this one out.
Me too facing this problem
Check your repo access is correct and you have proper access for PUSH the code
They only gave me READ access, After facing this issue I'll informed to respective person and get WRITE access

Code signing macOS app with Electron

I cannot seem to get code signing to work with electron-builder. When I run security find-identity -v I get back 3 certs, all of which look good. They also show up when running electron-builder. However, it says that cannot find valid "Developer ID Application" identity or custom non-Apple code signing certificate and directs me to the electron-builder docs (which are not helpful at all).
Can anyone point me in the right direction?
Before running electron builder, set the environment variables like this -
export DEBUG=electron-builder
export CSC_LINK=~/Desktop/mac_certs.p12 (change path according to your location)
export CSC_KEY_PASSWORD={your cert password}
Then try running with electron builder.
If this does not work, please paste the output of electron-builder

AWS Appium Project Package

I see below error while packaging appium project for AWS.
Unknown lifecycle phase --DskipTests=true. You must specify a valid lifecycle phase or a goal in the format
Note:
Executing packaging command on mac terminal
Tried both --DskipTests=true & -DskipTests=true (see same error for both)
Looking forward for some help. Thanks!
I work for the AWS Device Farm team.
I have seen this error when users copy-paste the command from the documentation.
We are working on updating this as there seems to be some unknown characters that get introduced.
Users have got this to work by deleting -DskipTests=true and typing it instead of copy pasting it.
Since you are on a Mac terminal you will need to use a single dash '-' for the parameter.
Apologies for the inconvenience.
Hope this helps.

Xcode Server Bot won't connect to Gitlab server (Fails to integrate)

I'm trying to integrate a simple Xcode Bot with my Xcode server.
I'm using OS X Server 5 Beta 3 and Xcode 7 Beta 5
I create a bot and everything goes great. I use an existing ssh key for connecting to this git repository on gitlab and that works fine everywhere else and even Xcode (in accounts preferences) seems to not have a problem with the repo.
But when I go to integrate the bot, it fails to check out the source with:
Failed to authenticate SSH session: Callback returned error (-1)
I've tried changing this to use my actual gitlab credentials instead of the ssh key and I get the same error. It doesn't seem to matter what I use for the bot, it fails to sign in. Yet all of those credentials work on gitlab using git and Xcode itself just fine.
Anyone else run into this? And/or are there any better logs somewhere of what's going on?
Not much in the verbosity in the xcodebuild logs on the server either:
2015-08-10 09:42:28.303 xcsbuildd[14203:84978] XCSIntegrationExecutor.m:229 [XCSIntegrationExecutor integrationStep:didFinishWithError:result:] [BuildService, Error] XCSCheckoutIntegrationStep finished integration with an error: Error Domain=XCSBuildServiceDomain Code=-1 "Could not checkout sources because the source control information is in an invalid format. UserInfo=0x7fb8ece65810 {NSLocalizedDescription=Could not checkout sources because the source control information is in an invalid format., XCSErrorFixItType=scm-failure}
Not sure what it means by invalid format?:
Could not checkout sources because the source control information is
in an invalid format

Jenkins Cannot import the following key file

I am able to build my application on Visual Studio without any problem. I am trying Jenkins out on the same machine. When I try to build my application from my git remote repository (It contains the .pfx file in the SVC) I get the error
error MSB3325: Cannot import the following key file: Key.pfx. The key
file may be password protected. To correct this, try to import the
certificate again or manually install the certificate to the Strong
Name CSP with the following key container name: VS_KEY...
error MSB3321: Importing key file "Key.pfx" was canceled.
I had already run the command shown on the answer of this question Cannot import the keyfile 'blah.pfx' - error 'The keyfile may be password protected' and that is the reason my application runs in Visual Studio (I've done it through the command prompt as administrator fyi), which means when I try running it again the object already exists and if I uninstall and reinstall the same problem happens again.
Anyone has any ideas of how I can solve this problem?
Its the IIDentity (the windows account/identity) that is running Jenkins, most likely.
As a quick test, edit the Jenkins service and put in your credentials.
..
If that works, either keep it that way, or do your manual import voodoo using the identity that you want Jenkins to run under.

Resources