diff --git a/CHANGELOG.md b/CHANGELOG.md index 2f9a5c3f72..892d8d7fff 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,8 @@ This is the log of notable changes to EAS CLI and related packages. ### ๐Ÿ› Bug fixes +- [build-tools] Fix `eas build --local` for iOS on macOS 26 (Tahoe) where `Keychain.findIdentitiesByTeamId` falsely reported the dist certificate as not imported. The `-v` flag on `security find-identity` requires the full trust chain to resolve from the build keychain alone, but the build keychain only holds the cert + private key โ€” Apple Root CA lives in `/Library/Keychains/System.keychain` and `find-identity` does not aggregate trust resolution across keychains. Dropped `-v`; presence check now works across macOS versions and codesign continues to resolve trust downstream via `Security.framework`. ([#3679](https://github.com/expo/eas-cli/pull/3679) by [@kearnsm293-afk](https://github.com/kearnsm293-afk)) + ### ๐Ÿงน Chores ## [18.11.0](https://github.com/expo/eas-cli/releases/tag/v18.11.0) - 2026-05-05 diff --git a/packages/build-tools/src/ios/credentials/keychain.ts b/packages/build-tools/src/ios/credentials/keychain.ts index b9fb807389..47b95fa5fc 100644 --- a/packages/build-tools/src/ios/credentials/keychain.ts +++ b/packages/build-tools/src/ios/credentials/keychain.ts @@ -97,9 +97,23 @@ export default class Keychain { } private async findIdentitiesByTeamId(teamId: string): Promise { + // Note: no `-v` flag. `-v` ("valid identities only") requires the full + // trust chain (dist cert -> Apple WWDR Intermediate -> Apple Root CA) to + // resolve from the keychain(s) in the search list. The build keychain + // created above only holds the dist cert + private key; Apple Root CA + // lives in /Library/Keychains/System.keychain. `security find-identity` + // does not aggregate trust resolution across keychains passed as + // positional args (only `security list-keychains -s` does, and that's + // session-wide and undesirable). On macOS 26 (Tahoe), this caused + // `find-identity -v -s "()" ` to return 0 + // identities even when the cert+key were correctly imported, falsely + // tripping `ensureCertificateImported`. Without `-v`, the presence + // check works correctly across macOS versions; codesign performs its + // own trust resolution downstream via Security.framework (which does + // aggregate across keychains), so signing still succeeds. const { output } = await spawn( 'security', - ['find-identity', '-v', '-s', `(${teamId})`, this.keychainPath], + ['find-identity', '-s', `(${teamId})`, this.keychainPath], { stdio: 'pipe', }