{"record":{"id":"2fd90958227116e4","repo":"stablyai/orca","slug":"missing-signing-identity-for-orca-notification-sta","errorCode":null,"errorMessage":"Missing signing identity for orca-notification-status helper","messagePattern":"Missing signing identity for orca-notification-status helper","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"config/electron-builder.config.cjs","lineNumber":590,"sourceCode":"}\n\nasync function signMacNotificationStatusHelper(helperPath, packager) {\n  if (!existsSync(helperPath)) {\n    if (isMacRelease) {\n      throw new Error(`Missing orca-notification-status helper at ${helperPath}`)\n    }\n    return\n  }\n  const codeSigningInfo =\n    isMacRelease && process.env.CSC_LINK && packager?.codeSigningInfo?.value\n      ? await packager.codeSigningInfo.value\n      : null\n  const identity =\n    process.env.CSC_NAME ??\n    findInstalledMacSigningIdentity(codeSigningInfo?.keychainFile) ??\n    (isMacRelease ? null : '-')\n  if (!identity) {\n    throw new Error('Missing signing identity for orca-notification-status helper')\n  }\n  // Why: macOS keys notification records to the code-signing identifier; the\n  // binary embeds the app's CFBundleIdentifier in __TEXT,__info_plist so this\n  // (and any later) `codesign --force` derives the correct identifier. Sign\n  // before the outer Orca.app is sealed, like the computer-use helper.\n  const args = ['--force', '--sign', identity]\n  if (isMacRelease) {\n    args.push('--options', 'runtime', '--timestamp')\n  }\n  args.push(helperPath)\n  execFileSync('codesign', args, { stdio: 'inherit' })\n  execFileSync('codesign', ['--verify', '--strict', helperPath], { stdio: 'inherit' })\n}\n\nfunction codesignArgs(identity, targetPath) {\n  const args = ['--force', '--deep', '--sign', identity]\n  if (isMacRelease) {\n    args.push(","sourceCodeStart":572,"sourceCodeEnd":608,"githubUrl":"https://github.com/stablyai/orca/blob/1136503c6a231a16dce8f921f6fadb63d181e8db/config/electron-builder.config.cjs#L572-L608","documentation":"When signing the orca-notification-status helper, the code resolves a signing identity by checking (in order): CSC_NAME env var, `findInstalledMacSigningIdentity()` (keychain search), and '-' (ad-hoc) for non-release. Unlike the computer-use helper (error [10]), this path does NOT check ORCA_COMPUTER_MACOS_SIGN_IDENTITY. If none yield an identity, the build fails because macOS keys notification records to the code-signing identifier.","triggerScenarios":"Running a Mac release build without CSC_NAME set and no Developer ID Application or Apple Distribution certificate in the keychain. The `findInstalledMacSigningIdentity` function returned null (no matching identity found, or `security find-identity` failed). Note: this helper does NOT fall back to ORCA_COMPUTER_MACOS_SIGN_IDENTITY, only CSC_NAME.","commonSituations":"CI without CSC_NAME or CSC_LINK configured. Local release build without certificates. CSC_LINK keychain not being searched by findInstalledMacSigningIdentity. Difference from computer-use signing: a developer who set only ORCA_COMPUTER_MACOS_SIGN_IDENTITY (not CSC_NAME) will pass error [10] but fail here.","solutions":["Set CSC_NAME to a valid signing identity visible in `security find-identity -v -p codesigning`.","For CI: ensure CSC_LINK (the .p12 base64) and CSC_KEY_PASSWORD are set so electron-builder imports the keychain, and that `findInstalledMacSigningIdentity` can find it via `codeSigningInfo?.keychainFile`.","If you set only ORCA_COMPUTER_MACOS_SIGN_IDENTITY for the computer-use helper, you must ALSO set CSC_NAME for this helper — they use different env var fallback chains.","Verify the certificate is valid and not expired."],"exampleFix":"# before — only set computer-use identity\nORCA_MAC_RELEASE=1 ORCA_COMPUTER_MACOS_SIGN_IDENTITY=\"Developer ID Application: Team (ABC123)\" pnpm package\n# → passes error [10] but fails error [12]\n\n# after — also set CSC_NAME\nORCA_MAC_RELEASE=1 ORCA_COMPUTER_MACOS_SIGN_IDENTITY=\"Developer ID Application: Team (ABC123)\" CSC_NAME=\"Developer ID Application: Team (ABC123)\" pnpm package","handlingStrategy":"validation","validationCode":"// Check for CSC_NAME specifically (this helper doesn't use ORCA_COMPUTER_MACOS_SIGN_IDENTITY)\nfunction assertNotificationSigningIdentity() {\n  const identity = process.env.CSC_NAME\n  if (!identity) {\n    console.warn('orca-notification-status helper uses CSC_NAME, not ORCA_COMPUTER_MACOS_SIGN_IDENTITY')\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set CSC_NAME for Mac release builds — the notification-status helper checks it but NOT ORCA_COMPUTER_MACOS_SIGN_IDENTITY.","Note the asymmetry: computer-use helper falls back to ORCA_COMPUTER_MACOS_SIGN_IDENTITY, notification-status does not.","Verify the keychain identity matches what CSC_NAME specifies.","Run `security find-identity -v -p codesigning` before release builds to confirm availability."],"tags":["electron-builder","macos","code-signing","certificates","keychain","notifications"],"backgroundTag":null,"analyzedSha":"1136503c6a231a16dce8f921f6fadb63d181e8db","analyzedAt":"2026-08-12T23:15:58.167Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}