What causes "failed to convert APPLE_SIGNING_IDENTITY to string" in tauri-apps/tauri?

Inspect the variable: `python3 -c "import os;print(os.environ['APPLE_SIGNING_IDENTITY'].encode())"` or `env | grep APPLE_SIGNING_IDENTITY | xxd | head`.

tauri-apps/tauri · error

failed to convert APPLE_SIGNING_IDENTITY to string

Error message

failed to convert APPLE_SIGNING_IDENTITY to string

What it means

When bundling for macOS, the CLI overrides the config's signing identity with the APPLE_SIGNING_IDENTITY environment variable. to_str() on the OsString returns None when the variable contains non-UTF-8 bytes, and this expect panics. The value itself is only parsed, so any valid UTF-8 identity string works; only the encoding can fail.

Source

Thrown at crates/tauri-cli/src/interface/rust.rs:1451

      }
      depends_rpm.push(requires);
    }
  }

  #[cfg(windows)]
  {
    if let crate::helpers::config::WebviewInstallMode::FixedRuntime { path } =
      &config.windows.webview_install_mode
    {
      resources.push(path.display().to_string());
    }
  }

  let signing_identity = match std::env::var_os("APPLE_SIGNING_IDENTITY") {
    Some(signing_identity) => Some(
      signing_identity
        .to_str()
        .expect("failed to convert APPLE_SIGNING_IDENTITY to string")
        .to_string(),
    ),
    None => config.macos.signing_identity,
  };

  let provider_short_name = match std::env::var_os("APPLE_PROVIDER_SHORT_NAME") {
    Some(provider_short_name) => Some(
      provider_short_name
        .to_str()
        .expect("failed to convert APPLE_PROVIDER_SHORT_NAME to string")
        .to_string(),
    ),
    None => config.macos.provider_short_name,
  };

  let (resources, resources_map) = match resources {
    BundleResources::List(paths) => (Some(paths), None),
    BundleResources::Map(map) => (None, Some(map)),

View on GitHub (pinned to 52e4b6e71d)

Solutions

Inspect the variable: `python3 -c "import os;print(os.environ['APPLE_SIGNING_IDENTITY'].encode())"` or `env | grep APPLE_SIGNING_IDENTITY | xxd | head`.
Re-export it as plain ASCII/UTF-8: `export APPLE_SIGNING_IDENTITY="Apple Development: Team (ID)"`.
Re-enter the CI secret (delete and re-create) ensuring plain text.
Find valid identities with `security find-identity -v -p codesigning` and copy one exactly.

Example fix

# before: contains invalid bytes (e.g. 0xff prefix)
export APPLE_SIGNING_IDENTITY=$'\xffApple Development'

# after
export APPLE_SIGNING_IDENTITY="Apple Development: AB12CD34EF (1234567890)"

Defensive patterns

Strategy: validation

Validate before calling

# Reject non-UTF-8 before building
python3 - <<'EOF'
import os, sys
v = os.environb.get(b'APPLE_SIGNING_IDENTITY')
if v is not None:
    try: v.decode('utf-8')
    except UnicodeDecodeError:
        sys.exit('APPLE_SIGNING_IDENTITY is not valid UTF-8')
EOF

Prevention

Enter codesigning secrets as plain ASCII and re-create CI secrets rather than copying from formatted docs.
Use `security find-identity -v -p codesigning` output as the canonical string to export.
Add a UTF-8 env preflight in CI before tauri build on macOS.

When it happens

Trigger: Running `tauri build`/`tauri ios build` on macOS with APPLE_SIGNING_IDENTITY exported containing raw non-UTF-8 bytes — a mis-encoded export line in a sourced script, a CI secret saved with a bad encoding, or a locale-mangled value.

Common situations: CI secrets defined with stray bytes/BOM; shell profiles written by tools in non-UTF-8 locales; identities pasted from rich text introducing invisible invalid bytes.

Related errors

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/a3f989cf10f4dd16. Report an issue: GitHub.