fix(desktop): pass the keychain password to set-key-partition-list - #14610
Conversation
electron-builder passes the .p12 password as the keychain password when it calls `security set-key-partition-list` on the temp keychain it just created. macOS 26.6 now checks that password, so Mac signing fails with SecKeychainUnlock on every run since the runner image moved to 26.6. Still unfixed upstream as of electron-builder 26.15.3, so patch it. Also drop jq from the Windows/Linux Slack steps; the builder container doesn't have it, which marked successful publishes as failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
Dependency limit exceeded — report not shown. This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report. Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard. Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account. |
1 participant
Mac desktop builds have failed on every main deploy since 2026-09-08 (latest: run 36038859427):
Cause: electron-builder creates a temp keychain with a random password, but passes the
.p12password (CSC_KEY_PASSWORD) as-ktoset-key-partition-list. Older macOS let that through because the keychain was already unlocked. The runner image moved from macOS 26.5 to 26.6 between the last green run (09-01) and the first red one (09-08), and 26.6 validates the password. Secrets haven't changed since 08-14. The bug is still present in electron-builder 26.15.3, so upgrading doesn't fix it.Fix: a patch-package patch to
app-builder-lib@25.1.8that passes the keychain password instead. I reproduced this locally on macOS 27 with a throwaway keychain:-k <p12 password>gives the sameSecKeychainUnlockerror, and-k <keychain password>exits 0.Also: the Windows/Linux
Slack notificationsteps calljq, which theelectronuserland/buildercontainer doesn't include. The step exits 127, so those jobs show red even though the build published. Switched it tonode -p.Verify after merge: the Mac job logs
signing … identity=8F3E8976…and notarizes, andlatest-mac.ymlon download.audius.co gets a freshlast-modified.🤖 Generated with Claude Code