{"record":{"id":"572c9627062f467a","repo":"denoland/deno","slug":"codesign-failed-for-identity","errorCode":null,"errorMessage":"codesign failed for {} (identity {:?})","messagePattern":"codesign failed for (.+?) \\(identity (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/desktop.rs","lineNumber":2788,"sourceCode":"  cmd.arg(\"--force\");\n  if !adhoc {\n    cmd.arg(\"--timestamp\").arg(\"--options\").arg(\"runtime\");\n  }\n  if let Some(ident) = signing_identifier {\n    cmd.arg(\"--identifier\").arg(ident);\n  }\n  cmd.arg(\"--sign\").arg(identity);\n  if let Some(ent) = entitlements {\n    cmd.arg(\"--entitlements\").arg(ent);\n  }\n  cmd.arg(target);\n  let status = cmd\n    .stdout(std::process::Stdio::null())\n    .stderr(std::process::Stdio::inherit())\n    .status()\n    .context(\"failed to invoke codesign(1)\")?;\n  if !status.success() {\n    bail!(\n      \"codesign failed for {} (identity {:?})\",\n      target.display(),\n      identity,\n    );\n  }\n  Ok(())\n}\n\n/// Re-sign the cached laufey.app's binaries so the running binary's\n/// identifier matches its host bundle's `CFBundleIdentifier`. Run once\n/// per fresh download; HMR mode runs laufey.app directly (no per-project\n/// wrapper), so without this UN sees `Identifier=laufey` /\n/// `CFBundleIdentifier=com.deno.desktop` and refuses notification\n/// authorization. Best-effort: failures here are logged but don't\n/// abort the install, since most desktop features still work without\n/// notifications.\n#[cfg(target_os = \"macos\")]\nfn harmonize_cached_laufey_identifiers(","sourceCodeStart":2770,"sourceCodeEnd":2806,"githubUrl":"https://github.com/denoland/deno/blob/f7822238cab635a3a19f99f493f675fa81a7f9d8/cli/tools/desktop.rs#L2770-L2806","documentation":"A direct codesign(1) invocation (`codesign --sign <identity> [--entitlements <ent>] <target>`) exited non-zero. The child's stderr is inherited, so codesign's own diagnostic (the real cause) is printed just above this bail line. Common root causes: identity not found/expired/revoked, locked keychain, malformed entitlements plist, or network failure reaching Apple's timestamp server.","triggerScenarios":"Any of: the identity string doesn't match an installed certificate; the certificate lacks a private key or the codesigning capability; the login keychain is locked (common over SSH); the entitlements file is malformed; or a strict signing needs the timestamp server and the network is blocked.","commonSituations":"CI machines where the cert was never imported or the keychain wasn't unlocked; identity names pasted with a typo or from an expired provisioning setup; corporate networks blocking timestamp.apple.com.","solutions":["Read the codesign error line printed above this bail — it names the actual failure.","List usable identities with `security find-identity -v -p codesigning` and copy the exact string into macos.codesignIdentity.","On CI/SSH, import the cert+key into a keychain and run `security unlock-keychain` first.","For local testing, switch to ad-hoc signing with identity \"-\".","Validate entitlements files with `plutil -lint` if entitlements are in play."],"exampleFix":"# before: identity string that doesn't match any installed cert\n\"codesignIdentity\": \"Developer ID: ACME\"\n\n# after: exact string from `security find-identity -v -p codesigning`\n\"codesignIdentity\": \"Developer ID Application: ACME Inc (A1B2C3D4E5)\"","handlingStrategy":"try-catch","validationCode":"# Verify the identity exists and can sign before building\nsecurity find-identity -v -p codesigning | grep -F \"$IDENTITY\" || {\n  echo \"identity '$IDENTITY' not available for codesigning\"; exit 1;\n}\nsecurity unlock-keychain ~/Library/Keychains/login.keychain-db","typeGuard":null,"tryCatchPattern":"deno desktop ... 2>&1 | tee build.log || {\n  echo \"--- codesign failed; codesign(1) diagnostic above ---\";\n  grep -m1 codesign build.log;\n  exit 1;\n}","preventionTips":["Unlock the keychain (and import the cert) as an explicit CI step before packaging.","Pin the exact identity string from `security find-identity -v -p codesigning` in CI secrets, not a paraphrase.","Use ad-hoc identity '-' for local iterations; reserve real identities for release jobs.","Watch certificate expiry dates — renew before the release pipeline breaks."],"tags":["desktop","macos","codesign","signing","keychain"],"backgroundTag":"codesign-failed","analyzedSha":"f7822238cab635a3a19f99f493f675fa81a7f9d8","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}