{"record":{"id":"4731be03c1c73f1f","repo":"denoland/deno","slug":"macos-codesignidentity-is-empty","errorCode":null,"errorMessage":"macos.codesignIdentity is empty","messagePattern":"macos\\.codesignIdentity is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/desktop.rs","lineNumber":2600,"sourceCode":"/// Re-uses the JIT entitlements that ship with the laufey CEF bundle\n/// (`Contents/Frameworks/<helper>.app/Contents/Resources/...entitlements...`\n/// or, more robustly, the per-helper entitlements laufey bundles next to\n/// each helper). When entitlements aren't present we fall back to\n/// signing without them — the binary will still launch but V8 won't\n/// get JIT permission.\nfn codesign_macos_bundle(\n  app_bundle: &Path,\n  identity: &str,\n) -> Result<(), AnyError> {\n  if !cfg!(target_os = \"macos\") {\n    bail!(\n      \"codesigning requires a macOS build host (uses `codesign(1)`). \\\n       Run `deno desktop` on macOS, or drop `macos.codesignIdentity` \\\n       from your deno.json when cross-building.\"\n    );\n  }\n  if identity.is_empty() {\n    bail!(\"macos.codesignIdentity is empty\");\n  }\n  log::info!(\n    \"{} bundle with identity {:?}\",\n    colors::green(\"Codesigning\"),\n    identity,\n  );\n\n  // Read the bundle id from the main Info.plist so we can override the\n  // signed identifier on `Contents/MacOS/laufey`. The default identifier\n  // codesign infers from a bare Mach-O binary is `laufey` (the basename),\n  // which doesn't match the .app's CFBundleIdentifier — and UN refuses\n  // notification authorization when the running binary's signed id\n  // doesn't match the bundle's id. Forcing `--identifier=<bundle_id>`\n  // makes them match.\n  let bundle_id = read_bundle_identifier(app_bundle)?;\n\n  // Sign helpers first (inside → outside). The order within helpers\n  // doesn't matter — they don't nest into each other.","sourceCodeStart":2582,"sourceCodeEnd":2618,"githubUrl":"https://github.com/denoland/deno/blob/f7822238cab635a3a19f99f493f675fa81a7f9d8/cli/tools/desktop.rs#L2582-L2618","documentation":"After the macOS-host check, codesign_macos_bundle rejects an empty signing identity string. The macos.codesignIdentity key is present in deno.json but its value is \"\" — an identity that cannot exist, and passing it to codesign(1) would only fail later with a more confusing error.","triggerScenarios":"deno.json contains \"macos\": { \"codesignIdentity\": \"\" } — typically from a template placeholder never filled in, or from env-var interpolation (\"codesignIdentity\": \"$SIGN_ID\") where the variable is unset and yields an empty string.","commonSituations":"Scaffolded desktop projects with placeholder config; CI where the secrets-to-config mapping produced an empty value; local testing where someone enabled the key 'to be filled later'.","solutions":["Set a real identity, e.g. \"Apple Development: dev@acme.com (ABCD1234)\" or \"Developer ID Application: ACME Inc (TEAMID)\".","If you don't intend to sign, delete the macos.codesignIdentity key entirely instead of leaving it empty.","For unsigned local testing, ad-hoc signing with identity \"-\" is a non-empty value codesign accepts."],"exampleFix":"// before\n\"macos\": { \"codesignIdentity\": \"\" }\n\n// after (real identity)\n\"macos\": { \"codesignIdentity\": \"Developer ID Application: ACME Inc (TEAMID)\" }\n// or remove the key entirely to skip signing","handlingStrategy":"validation","validationCode":"const identity = config.desktop?.macos?.codesignIdentity;\nif (identity !== undefined && identity.trim() === \"\") {\n  throw new Error(\"macos.codesignIdentity must be a real identity or absent\");\n}","typeGuard":"function isValidIdentity(v: unknown): v is string {\n  return typeof v === \"string\" && v.trim().length > 0;\n}","tryCatchPattern":null,"preventionTips":["Fail fast in config loading on empty-string values for signing keys instead of shipping them.","If templating config from env vars, substitute a sentinel and delete the key when unset.","Run `security find-identity -v -p codesigning` once and paste the exact identity string."],"tags":["desktop","macos","codesign","config"],"backgroundTag":"empty-config-value","analyzedSha":"f7822238cab635a3a19f99f493f675fa81a7f9d8","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}