mirror of
https://github.com/SignTools/SignTools.git
synced 2026-04-27 02:45:56 +03:00
[GH-ISSUE #7] GitHub Actions CI troubleshooting #3
Labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/SignTools#3
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @sourcelocation on GitHub (Mar 3, 2021).
Original GitHub issue: https://github.com/SignTools/SignTools/issues/7
Hi again. I have another issue where GitHub Actions cannot sign my .iPA file. It says
Here's the screenshot:
Also, sorry for asking too much help. I love your project.
@ViRb3 commented on GitHub (Mar 3, 2021):
Oh, I know exactly what this is, an oversight after I made some changes. I will fix it in a second and let you know.
@ViRb3 commented on GitHub (Mar 3, 2021):
I pushed the fix, please update your fork and try again. Let me know how it goes.
@sourcelocation commented on GitHub (Mar 3, 2021):
Thanks, it worked. But now I have another similar issue:
Did I do something wrong?
@ViRb3 commented on GitHub (Mar 3, 2021):
This means that the builder could not properly download a job from your server. I pushed another update to the CI repo that will print the error instead of swallowing it. Please update, try again, and share the error here.
@sourcelocation commented on GitHub (Mar 3, 2021):
Here is the log.
@ViRb3 commented on GitHub (Mar 3, 2021):
This looks like a different error from the one above. Here it fails during the signing process. To debug this, go into the
sign.shfile in your CI repo and just below theSigning...line, change:to:
(remove the output suppression)
I added that so it doesn't leak potentially private information about the app you're signing. Feel free to share the error here if you can't figure it out.
@sourcelocation commented on GitHub (Mar 3, 2021):
@ViRb3 commented on GitHub (Mar 3, 2021):
Very weird. From https://github.com/SignTools/XReSign/blob/master/XReSign/Scripts/xresign.sh:
This is the error that it's hitting. It means that either the "-c" or "-i" argument is empty. How are you running the workflow? It's being triggered by the service when you upload an app, correct?
@sourcelocation commented on GitHub (Mar 3, 2021):
Right
@ViRb3 commented on GitHub (Mar 3, 2021):
So "-i" can't be empty as we're setting it to "unsigned.ipa". This only leaves "-c" being empty. That comes from here in
sign.sh:I suppose this command doesn't successfully obtain the certificate common name. Maybe the certificate isn't being properly imported?
In this line:
can you remove the output suppression bit again (
> /dev/null 2>&1), and see what it says?Could you also add a line
echo $IDENTITYafter theIDENTITY=...line, and see if it prints anything?@sourcelocation commented on GitHub (Mar 3, 2021):
Sure, give me just a second 👍🏻
@ViRb3 commented on GitHub (Mar 3, 2021):
Am I right to understand that
echo $IDENTITYprinted nothing, so the common name reading failed?@sourcelocation commented on GitHub (Mar 3, 2021):
Oh wait, forgot to add it. Will upload another iPA right now...
@ViRb3 commented on GitHub (Mar 3, 2021):
I deleted your logs to preserve any private information that could have been in them.
I suppose the print statement was in line 105, which is empty. That confirms my theory. The question now is, did you export an incorrect certificate, or is my command not working correctly? This is the line that fails:
Do you have any ideas? Can you try this on your Mac:
Does it return anything?
@sourcelocation commented on GitHub (Mar 3, 2021):
Thank you for the reply! Yes, it returns. Here's the output:
(Relaced some parts with *******)
@ViRb3 commented on GitHub (Mar 3, 2021):
Can you run the same command on the CI? Meanwhile I will see what possible commands for
-pthere are, and we can see which one returns your certificate.@sourcelocation commented on GitHub (Mar 3, 2021):
Also, is this the right certificate I need to export?
@ViRb3 commented on GitHub (Mar 3, 2021):
You need the one in the middle, not the key icon, but the certificate icon.
EDIT: That doesn't let you export it in .p12 format. If I remember correctly, .p12 was an archive of multiple signing objects, namely a certificate and a key. So what you did before was you exported just the key without the certificate, which is why the CI failed. You'll need to export the whole signing identity as a single .p12 file. I will look into this and let you know in a bit.
@sourcelocation commented on GitHub (Mar 3, 2021):
But when I try to export the certificate, Keychain does not allow me to export it in .p12.
EDIT: Right
@ViRb3 commented on GitHub (Mar 3, 2021):
Check the edit above. Do you have a Discord or Telegram where I could contact you to troubleshoot this faster?
@ViRb3 commented on GitHub (Mar 3, 2021):
I deleted your comment again to preserve your account names.
As we discussed over chat, the problem was the way the certificate was exported. You want to select both the signing key and the certificate, and export them as one single .p12 file. Failing this you end up with incomplete information to achieve signing. I will reflect this in the documentation. Either way, as we verified over chat, you got the CI to work, so I am closing this now.