Missing signing identity for Orca Computer Use helper app

Error message

Missing signing identity for Orca Computer Use helper app

What it means

When signing the Orca Computer Use helper app, the code resolves a signing identity by checking (in order): ORCA_COMPUTER_MACOS_SIGN_IDENTITY env var, CSC_NAME env var, `findInstalledMacSigningIdentity()` which searches the keychain for 'Developer ID Application' or 'Apple Distribution' (or 'Apple Development' for non-release), and finally '-' (ad-hoc) for non-release. If none yield an identity, the build fails because TCC permission grants attach to the helper's code identity.

Source

Thrown at config/electron-builder.config.cjs:564

async function signMacComputerUseHelper(helperAppPath, packager) {
  if (!existsSync(helperAppPath)) {
    if (isMacRelease) {
      throw new Error(`Missing Orca Computer Use helper app at ${helperAppPath}`)
    }
    return
  }
  const codeSigningInfo =
    isMacRelease && process.env.CSC_LINK && packager?.codeSigningInfo?.value
      ? await packager.codeSigningInfo.value
      : null
  const identity =
    process.env.ORCA_COMPUTER_MACOS_SIGN_IDENTITY ??
    process.env.CSC_NAME ??
    findInstalledMacSigningIdentity(codeSigningInfo?.keychainFile) ??
    (isMacRelease ? null : '-')
  if (!identity) {
    throw new Error('Missing signing identity for Orca Computer Use helper app')
  }
  // Why: TCC grants attach to this nested app's code identity. Sign it before
  // the outer Orca.app is sealed so production builds preserve that identity.
  execFileSync('codesign', codesignArgs(identity, helperAppPath), { stdio: 'inherit' })
  execFileSync('codesign', ['--verify', '--deep', '--strict', helperAppPath], {
    stdio: 'inherit'
  })
}

async function signMacNotificationStatusHelper(helperPath, packager) {
  if (!existsSync(helperPath)) {
    if (isMacRelease) {
      throw new Error(`Missing orca-notification-status helper at ${helperPath}`)
    }
    return
  }
  const codeSigningInfo =
    isMacRelease && process.env.CSC_LINK && packager?.codeSigningInfo?.value

View on GitHub (pinned to 1136503c6a)

Solutions

Set ORCA_COMPUTER_MACOS_SIGN_IDENTITY to the exact identity name (e.g., 'Developer ID Application: Your Name (TEAMID)'), or set CSC_NAME.
For CI with CSC_LINK: verify the .p12 was imported and the keychain path is passed to `security find-identity`. The `findInstalledMacSigningIdentity` function at line 620 searches the keychain from `codeSigningInfo?.keychainFile` or the default login keychain.
For local development: run `security find-identity -v -p codesigning` to list available identities. If none show a Developer ID, you can't do a release sign — use a non-release build instead.
Verify the certificate hasn't expired.

Example fix

# before — release build without identity
ORCA_MAC_RELEASE=1 pnpm package

# after — provide identity
ORCA_MAC_RELEASE=1 ORCA_COMPUTER_MACOS_SIGN_IDENTITY="Developer ID Application: Team (ABC123)" pnpm package

Defensive patterns

Strategy: validation

Validate before calling

// Check for a signing identity before starting a Mac release build
import { execFileSync } from 'child_process'
function assertSigningIdentityAvailable() {
  const output = execFileSync('security', ['find-identity', '-v', '-p', 'codesigning'], { encoding: 'utf8' })
  if (!/Developer ID Application|Apple Distribution/.test(output)) {
    throw new Error('No signing identity found — set ORCA_COMPUTER_MACOS_SIGN_IDENTITY or CSC_NAME')
  }
}

Prevention

Set ORCA_COMPUTER_MACOS_SIGN_IDENTITY (or CSC_NAME) in CI before Mac release builds.
For local testing, use non-release builds (don't set ORCA_MAC_RELEASE=1) to skip signing.
Verify certificates haven't expired before each release cycle.
In CI with CSC_LINK, verify the keychain import succeeds and the identity is findable.

When it happens

Trigger: Running a Mac release build (ORCA_MAC_RELEASE=1) without ORCA_COMPUTER_MACOS_SIGN_IDENTITY or CSC_NAME set, and no Developer ID Application or Apple Distribution certificate in the login keychain. The CSC_LINK keychain (imported from a base64 .p12) doesn't contain a matching identity. The `security find-identity` command failed silently (caught by the empty catch at line 638).

Common situations: CI without signing certificates configured. Local release build without a Developer ID certificate installed. CSC_LINK pointing to a .p12 that was imported to a temporary keychain that `findInstalledMacSigningIdentity` doesn't search. Certificate expired or revoked.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/0ddced63e2cb8506. Report an issue: GitHub.