Missing signing identity for orca-notification-status helper

Error message

Missing signing identity for orca-notification-status helper

What it means

When signing the orca-notification-status helper, the code resolves a signing identity by checking (in order): CSC_NAME env var, `findInstalledMacSigningIdentity()` (keychain search), and '-' (ad-hoc) for non-release. Unlike the computer-use helper (error [10]), this path does NOT check ORCA_COMPUTER_MACOS_SIGN_IDENTITY. If none yield an identity, the build fails because macOS keys notification records to the code-signing identifier.

Source

Thrown at config/electron-builder.config.cjs:590

}

async function signMacNotificationStatusHelper(helperPath, packager) {
  if (!existsSync(helperPath)) {
    if (isMacRelease) {
      throw new Error(`Missing orca-notification-status helper at ${helperPath}`)
    }
    return
  }
  const codeSigningInfo =
    isMacRelease && process.env.CSC_LINK && packager?.codeSigningInfo?.value
      ? await packager.codeSigningInfo.value
      : null
  const identity =
    process.env.CSC_NAME ??
    findInstalledMacSigningIdentity(codeSigningInfo?.keychainFile) ??
    (isMacRelease ? null : '-')
  if (!identity) {
    throw new Error('Missing signing identity for orca-notification-status helper')
  }
  // Why: macOS keys notification records to the code-signing identifier; the
  // binary embeds the app's CFBundleIdentifier in __TEXT,__info_plist so this
  // (and any later) `codesign --force` derives the correct identifier. Sign
  // before the outer Orca.app is sealed, like the computer-use helper.
  const args = ['--force', '--sign', identity]
  if (isMacRelease) {
    args.push('--options', 'runtime', '--timestamp')
  }
  args.push(helperPath)
  execFileSync('codesign', args, { stdio: 'inherit' })
  execFileSync('codesign', ['--verify', '--strict', helperPath], { stdio: 'inherit' })
}

function codesignArgs(identity, targetPath) {
  const args = ['--force', '--deep', '--sign', identity]
  if (isMacRelease) {
    args.push(

View on GitHub (pinned to 1136503c6a)

Solutions

Set CSC_NAME to a valid signing identity visible in `security find-identity -v -p codesigning`.
For CI: ensure CSC_LINK (the .p12 base64) and CSC_KEY_PASSWORD are set so electron-builder imports the keychain, and that `findInstalledMacSigningIdentity` can find it via `codeSigningInfo?.keychainFile`.
If you set only ORCA_COMPUTER_MACOS_SIGN_IDENTITY for the computer-use helper, you must ALSO set CSC_NAME for this helper — they use different env var fallback chains.
Verify the certificate is valid and not expired.

Example fix

# before — only set computer-use identity
ORCA_MAC_RELEASE=1 ORCA_COMPUTER_MACOS_SIGN_IDENTITY="Developer ID Application: Team (ABC123)" pnpm package
# → passes error [10] but fails error [12]

# after — also set CSC_NAME
ORCA_MAC_RELEASE=1 ORCA_COMPUTER_MACOS_SIGN_IDENTITY="Developer ID Application: Team (ABC123)" CSC_NAME="Developer ID Application: Team (ABC123)" pnpm package

Defensive patterns

Strategy: validation

Validate before calling

// Check for CSC_NAME specifically (this helper doesn't use ORCA_COMPUTER_MACOS_SIGN_IDENTITY)
function assertNotificationSigningIdentity() {
  const identity = process.env.CSC_NAME
  if (!identity) {
    console.warn('orca-notification-status helper uses CSC_NAME, not ORCA_COMPUTER_MACOS_SIGN_IDENTITY')
  }
}

Prevention

Always set CSC_NAME for Mac release builds — the notification-status helper checks it but NOT ORCA_COMPUTER_MACOS_SIGN_IDENTITY.
Note the asymmetry: computer-use helper falls back to ORCA_COMPUTER_MACOS_SIGN_IDENTITY, notification-status does not.
Verify the keychain identity matches what CSC_NAME specifies.
Run `security find-identity -v -p codesigning` before release builds to confirm availability.

When it happens

Trigger: Running a Mac release build without CSC_NAME set and no Developer ID Application or Apple Distribution certificate in the keychain. The `findInstalledMacSigningIdentity` function returned null (no matching identity found, or `security find-identity` failed). Note: this helper does NOT fall back to ORCA_COMPUTER_MACOS_SIGN_IDENTITY, only CSC_NAME.

Common situations: CI without CSC_NAME or CSC_LINK configured. Local release build without certificates. CSC_LINK keychain not being searched by findInstalledMacSigningIdentity. Difference from computer-use signing: a developer who set only ORCA_COMPUTER_MACOS_SIGN_IDENTITY (not CSC_NAME) will pass error [10] but fail here.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/2fd90958227116e4. Report an issue: GitHub.