{"record":{"id":"0ddced63e2cb8506","repo":"stablyai/orca","slug":"missing-signing-identity-for-orca-computer-use-hel","errorCode":null,"errorMessage":"Missing signing identity for Orca Computer Use helper app","messagePattern":"Missing signing identity for Orca Computer Use helper app","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"config/electron-builder.config.cjs","lineNumber":564,"sourceCode":"\nasync function signMacComputerUseHelper(helperAppPath, packager) {\n  if (!existsSync(helperAppPath)) {\n    if (isMacRelease) {\n      throw new Error(`Missing Orca Computer Use helper app at ${helperAppPath}`)\n    }\n    return\n  }\n  const codeSigningInfo =\n    isMacRelease && process.env.CSC_LINK && packager?.codeSigningInfo?.value\n      ? await packager.codeSigningInfo.value\n      : null\n  const identity =\n    process.env.ORCA_COMPUTER_MACOS_SIGN_IDENTITY ??\n    process.env.CSC_NAME ??\n    findInstalledMacSigningIdentity(codeSigningInfo?.keychainFile) ??\n    (isMacRelease ? null : '-')\n  if (!identity) {\n    throw new Error('Missing signing identity for Orca Computer Use helper app')\n  }\n  // Why: TCC grants attach to this nested app's code identity. Sign it before\n  // the outer Orca.app is sealed so production builds preserve that identity.\n  execFileSync('codesign', codesignArgs(identity, helperAppPath), { stdio: 'inherit' })\n  execFileSync('codesign', ['--verify', '--deep', '--strict', helperAppPath], {\n    stdio: 'inherit'\n  })\n}\n\nasync function signMacNotificationStatusHelper(helperPath, packager) {\n  if (!existsSync(helperPath)) {\n    if (isMacRelease) {\n      throw new Error(`Missing orca-notification-status helper at ${helperPath}`)\n    }\n    return\n  }\n  const codeSigningInfo =\n    isMacRelease && process.env.CSC_LINK && packager?.codeSigningInfo?.value","sourceCodeStart":546,"sourceCodeEnd":582,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/electron-builder.config.cjs#L546-L582","documentation":"When signing the Orca Computer Use helper app, the code resolves a signing identity by checking (in order): ORCA_COMPUTER_MACOS_SIGN_IDENTITY env var, CSC_NAME env var, `findInstalledMacSigningIdentity()` which searches the keychain for 'Developer ID Application' or 'Apple Distribution' (or 'Apple Development' for non-release), and finally '-' (ad-hoc) for non-release. If none yield an identity, the build fails because TCC permission grants attach to the helper's code identity.","triggerScenarios":"Running a Mac release build (ORCA_MAC_RELEASE=1) without ORCA_COMPUTER_MACOS_SIGN_IDENTITY or CSC_NAME set, and no Developer ID Application or Apple Distribution certificate in the login keychain. The CSC_LINK keychain (imported from a base64 .p12) doesn't contain a matching identity. The `security find-identity` command failed silently (caught by the empty catch at line 638).","commonSituations":"CI without signing certificates configured. Local release build without a Developer ID certificate installed. CSC_LINK pointing to a .p12 that was imported to a temporary keychain that `findInstalledMacSigningIdentity` doesn't search. Certificate expired or revoked.","solutions":["Set ORCA_COMPUTER_MACOS_SIGN_IDENTITY to the exact identity name (e.g., 'Developer ID Application: Your Name (TEAMID)'), or set CSC_NAME.","For CI with CSC_LINK: verify the .p12 was imported and the keychain path is passed to `security find-identity`. The `findInstalledMacSigningIdentity` function at line 620 searches the keychain from `codeSigningInfo?.keychainFile` or the default login keychain.","For local development: run `security find-identity -v -p codesigning` to list available identities. If none show a Developer ID, you can't do a release sign — use a non-release build instead.","Verify the certificate hasn't expired."],"exampleFix":"# before — release build without identity\nORCA_MAC_RELEASE=1 pnpm package\n\n# after — provide identity\nORCA_MAC_RELEASE=1 ORCA_COMPUTER_MACOS_SIGN_IDENTITY=\"Developer ID Application: Team (ABC123)\" pnpm package","handlingStrategy":"validation","validationCode":"// Check for a signing identity before starting a Mac release build\nimport { execFileSync } from 'child_process'\nfunction assertSigningIdentityAvailable() {\n  const output = execFileSync('security', ['find-identity', '-v', '-p', 'codesigning'], { encoding: 'utf8' })\n  if (!/Developer ID Application|Apple Distribution/.test(output)) {\n    throw new Error('No signing identity found — set ORCA_COMPUTER_MACOS_SIGN_IDENTITY or CSC_NAME')\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set ORCA_COMPUTER_MACOS_SIGN_IDENTITY (or CSC_NAME) in CI before Mac release builds.","For local testing, use non-release builds (don't set ORCA_MAC_RELEASE=1) to skip signing.","Verify certificates haven't expired before each release cycle.","In CI with CSC_LINK, verify the keychain import succeeds and the identity is findable."],"tags":["electron-builder","macos","code-signing","certificates","keychain","computer-use"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}