What causes "`security find-identity` failed" in nikivdev/code?

Unlock the keychain: `security unlock-keychain ~/Library/Keychains/login.keychain-db`

`security find-identity` failed

Error message

`security find-identity` failed

What it means

list_codesign_identities shells out to macOS `security find-identity -v -p codesigning` and bails when the command exits non-zero. It means the keychain query itself failed, not that no identities exist (zero identities would parse to an empty list).

Source

Thrown at src/release_signing.rs:109

            println!("Env store: unable to read signing keys ({})", err);
            println!("Next: run `f env login` (cloud) and `f env unlock` (Touch ID), then retry.");
        }
    }

    println!();
    println!(
        "GitHub: `f release signing sync` will copy env store values into GitHub Actions secrets via `gh`."
    );
    Ok(())
}

fn list_codesign_identities() -> Result<Vec<String>> {
    let output = Command::new("security")
        .args(["find-identity", "-v", "-p", "codesigning"])
        .output()
        .context("failed to run `security find-identity`")?;
    if !output.status.success() {
        bail!("`security find-identity` failed");
    }
    let text = String::from_utf8_lossy(&output.stdout);
    let mut out = Vec::new();
    for line in text.lines() {
        // Example:
        //  1) <hash> "Developer ID Application: Name (TEAMID)"
        let Some(quoted) = line.split('"').nth(1) else {
            continue;
        };
        let name = quoted.trim();
        if !name.is_empty() {
            out.push(name.to_string());
        }
    }
    Ok(out)
}

fn store(opts: ReleaseSigningStoreOpts) -> Result<()> {

View on GitHub (pinned to a747e741ae)

Solutions

Unlock the keychain: `security unlock-keychain ~/Library/Keychains/login.keychain-db`
Run `security find-identity -v -p codesigning` manually to see the underlying error
Verify a login/default keychain exists (`security list-keychains`)
On CI, create/import a temporary keychain before calling `f release signing status`

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-check: security binary works and a keychain exists
security list-keychains > /dev/null 2>&1 || echo "no keychain available"

Try / catch

try {
  const out = execFileSync("security", ["find-identity", "-v", "-p", "codesigning"]);
} catch (e) {
  console.error("security find-identity failed; unlock keychain or run it manually to see why:", e.message);
}

Prevention

Unlock the login keychain before signing workflows, especially on CI
Run `security find-identity` manually once during machine setup to verify health
Avoid running codesigning steps on headless machines without an imported keychain

When it happens

Trigger: `security find-identity -v -p codesigning` returns a non-zero exit status while listing identities inside release signing `status`.

Common situations: Corrupted or locked keychain; missing codesigning policy support; `security` binary failing due to permissions (e.g. running in CI without a user keychain).

Related errors

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/56a1a40e9c3929f5. Report an issue: GitHub.