What causes "codesign failed for {} (identity {:?})" in denoland/deno?

Read the codesign error line printed above this bail — it names the actual failure.

codesign failed for {} (identity {:?})

Error message

codesign failed for {} (identity {:?})

What it means

A direct codesign(1) invocation (`codesign --sign <identity> [--entitlements <ent>] <target>`) exited non-zero. The child's stderr is inherited, so codesign's own diagnostic (the real cause) is printed just above this bail line. Common root causes: identity not found/expired/revoked, locked keychain, malformed entitlements plist, or network failure reaching Apple's timestamp server.

Source

Thrown at cli/tools/desktop.rs:2788

  cmd.arg("--force");
  if !adhoc {
    cmd.arg("--timestamp").arg("--options").arg("runtime");
  }
  if let Some(ident) = signing_identifier {
    cmd.arg("--identifier").arg(ident);
  }
  cmd.arg("--sign").arg(identity);
  if let Some(ent) = entitlements {
    cmd.arg("--entitlements").arg(ent);
  }
  cmd.arg(target);
  let status = cmd
    .stdout(std::process::Stdio::null())
    .stderr(std::process::Stdio::inherit())
    .status()
    .context("failed to invoke codesign(1)")?;
  if !status.success() {
    bail!(
      "codesign failed for {} (identity {:?})",
      target.display(),
      identity,
    );
  }
  Ok(())
}

/// Re-sign the cached laufey.app's binaries so the running binary's
/// identifier matches its host bundle's `CFBundleIdentifier`. Run once
/// per fresh download; HMR mode runs laufey.app directly (no per-project
/// wrapper), so without this UN sees `Identifier=laufey` /
/// `CFBundleIdentifier=com.deno.desktop` and refuses notification
/// authorization. Best-effort: failures here are logged but don't
/// abort the install, since most desktop features still work without
/// notifications.
#[cfg(target_os = "macos")]
fn harmonize_cached_laufey_identifiers(

View on GitHub (pinned to f7822238ca)

Solutions

Read the codesign error line printed above this bail — it names the actual failure.
List usable identities with `security find-identity -v -p codesigning` and copy the exact string into macos.codesignIdentity.
On CI/SSH, import the cert+key into a keychain and run `security unlock-keychain` first.
For local testing, switch to ad-hoc signing with identity "-".
Validate entitlements files with `plutil -lint` if entitlements are in play.

Example fix

# before: identity string that doesn't match any installed cert
"codesignIdentity": "Developer ID: ACME"

# after: exact string from `security find-identity -v -p codesigning`
"codesignIdentity": "Developer ID Application: ACME Inc (A1B2C3D4E5)"

Defensive patterns

Strategy: try-catch

Validate before calling

# Verify the identity exists and can sign before building
security find-identity -v -p codesigning | grep -F "$IDENTITY" || {
  echo "identity '$IDENTITY' not available for codesigning"; exit 1;
}
security unlock-keychain ~/Library/Keychains/login.keychain-db

Try / catch

deno desktop ... 2>&1 | tee build.log || {
  echo "--- codesign failed; codesign(1) diagnostic above ---";
  grep -m1 codesign build.log;
  exit 1;
}

Prevention

Unlock the keychain (and import the cert) as an explicit CI step before packaging.
Pin the exact identity string from `security find-identity -v -p codesigning` in CI secrets, not a paraphrase.
Use ad-hoc identity '-' for local iterations; reserve real identities for release jobs.
Watch certificate expiry dates — renew before the release pipeline breaks.

When it happens

Trigger: Any of: the identity string doesn't match an installed certificate; the certificate lacks a private key or the codesigning capability; the login keychain is locked (common over SSH); the entitlements file is malformed; or a strict signing needs the timestamp server and the network is blocked.

Common situations: CI machines where the cert was never imported or the keychain wasn't unlocked; identity names pasted with a typo or from an expired provisioning setup; corporate networks blocking timestamp.apple.com.

Related errors

AI-assisted analysis of denoland/deno@f7822238ca (2026-08-20). Data as JSON: /api/errors/572c9627062f467a. Report an issue: GitHub.