Skip to content

fix: The specified item could not be found in the keychain #1448

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kolipakakondal wants to merge 4 commits into from
Closed

fix: The specified item could not be found in the keychain #1448

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
37a1417
fix: The specified item could not be found in the keychain
kolipakakondal Apr 24, 2026
acf956f
fix: print diagnostics to check the issue
kolipakakondal Apr 24, 2026
8a7414a
fix: add Apple Developer ID intermediate CAs
kolipakakondal Apr 24, 2026
13eb446
fix: import AppleIncRootCertificate also
kolipakakondal Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 31 additions & 7 deletions .github/workflows/nightly.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ name: Nightly builds
on:
schedule:
- cron: "0 0 * * *"
pull_request:
branches:
- master
- release/**
Comment on lines +9 to +12
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Critical: pull_request trigger will overwrite production nightly artifacts and expose signing secrets on every PR.

This workflow is not a build-only pipeline — downstream steps perform destructive, production-impacting actions that must not run for PRs:

  • Line 235: aws s3 rm s3://${{ secrets.DL_BUCKET }}/dl/idf-eclipse-plugin/updates/nightly --recursive wipes the live nightly update site.
  • Lines 236–238: publicly re-upload the PR's build output to the live nightly location and invalidate CloudFront.
  • The workflow also consumes Azure Key Vault signing, Apple codesign certs, and notarization credentials. For same-repo PRs these secrets are passed to code under review (supply-chain risk); for fork PRs the secrets are unavailable and the run will fail partway through after already having performed work.

Net effect: every PR merged-or-not against master/release/** will replace the published nightly build with artifacts from an unmerged branch, and potentially sign/notarize unreviewed code with production credentials.

If the intent is only to validate that the build/codesign/keychain change works in CI before merge, please either (a) revert this trigger and test via workflow_dispatch on a branch, or (b) split the workflow so only the build + codesign verification steps run on pull_request, while az login, notarization, and all S3/CloudFront publishing steps remain gated to schedule (or push to master).

🛡️ Suggested minimal guard (Option B sketch)

At minimum, gate the publish/notarize steps so they never run for PRs. For example, add if: github.event_name != 'pull_request' to each of:

  • Authenticate to Azure
  • Get Azure Key Vault Access Token
  • Sign JAR files with Azure Key Vault
  • Notarization of Espressif-IDE dmg files
  • Upload build assets to dl.espressif.com

…and consider whether Codesign Espressif-IDE itself should also be skipped on PR events, given the macOS cert secret exposure.

Alternatively, keep the PR trigger only on a dedicated validation workflow that performs mvn clean install and the keychain/codesign smoke test without secrets that touch production.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/nightly.yml around lines 9 - 12, The workflow currently
triggers on pull_request and can run destructive publishing and secret-consuming
steps; change triggers or gate risky steps so PRs cannot publish or use
production secrets. Either remove or restrict the pull_request trigger and run
PR validation via workflow_dispatch on a branch, or keep pull_request only for
build/codesign smoke-tests and add if: github.event_name != 'pull_request' (or
equivalent) to each sensitive job/step such as "Authenticate to Azure", "Get
Azure Key Vault Access Token", "Sign JAR files with Azure Key Vault", "Codesign
Espressif-IDE", "Notarization of Espressif-IDE dmg files", and "Upload build
assets to dl.espressif.com"/S3/CloudFront publish steps (the aws s3 rm / upload
/ CloudFront invalidation steps) so they never run for PR events.


permissions:
contents: read
Expand Down Expand Up @@ -122,23 +126,43 @@ jobs:
/usr/bin/security unlock-keychain -p espressif build.keychain
/usr/bin/security import certificate.p12 -k build.keychain -P $MACOS_CERTIFICATE_PWD -T /usr/bin/codesign
/usr/bin/security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k espressif build.keychain

/usr/bin/security list-keychains -d user -s build.keychain $(security list-keychains -d user | sed s/\"//g)

curl -fsSL https://www.apple.com/certificateauthority/DeveloperIDCA.cer -o DeveloperIDCA.cer
curl -fsSL https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer -o DeveloperIDG2CA.cer
curl -fsSL https://www.apple.com/appleca/AppleIncRootCertificate.cer -o AppleIncRootCertificate.cer
/usr/bin/security import DeveloperIDCA.cer -k build.keychain || true
/usr/bin/security import DeveloperIDG2CA.cer -k build.keychain || true
/usr/bin/security import AppleIncRootCertificate.cer -k build.keychain || true

echo "---- Identities (default search list) ----"
/usr/bin/security find-identity -v -p codesigning || true
/usr/bin/security find-identity -v || true
echo "---- Identities in build.keychain ----"
/usr/bin/security find-identity -v -p codesigning build.keychain || true
echo "---- Verify leaf cert chain ----"
/usr/bin/security find-certificate -c "Developer ID Application" -p build.keychain > leaf.pem || true
/usr/bin/security verify-cert -c leaf.pem -p codeSign -L 2>&1 || true
echo "---- end ----"

SIGN_ID="QWXF6GB4AV"

echo "codesigning espressif-ide-macosx.cocoa.x86_64"
/usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/x86_64/Espressif-IDE.app -v
/usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "$SIGN_ID" $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/x86_64/Espressif-IDE.app -v
/usr/bin/codesign -v -vvv --deep $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/x86_64/Espressif-IDE.app

echo "codesigning espressif-ide-macosx.cocoa.aarch64"
/usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/aarch64/Espressif-IDE.app -v
/usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "$SIGN_ID" $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/aarch64/Espressif-IDE.app -v
/usr/bin/codesign -v -vvv --deep $PWD/releng/com.espressif.idf.product/target/products/com.espressif.idf.product/macosx/cocoa/aarch64/Espressif-IDE.app

echo "Creating dmg for espressif-ide-macosx.cocoa.x86_64"
$PWD/releng/ide-dmg-builder/ide-dmg-builder.sh
/usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg -v
/usr/bin/codesign --entitlements $PWD/releng/com.espressif.idf.product/entitlements/espressif-ide.entitlement --options runtime --force -s "$SIGN_ID" $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg -v
/usr/bin/codesign -v -vvv --deep $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-x86_64.dmg

echo "Creating dmg for espressif-ide-macosx.cocoa.aarch64"
$PWD/releng/ide-dmg-builder/ide-dmg-builder-aarch64.sh
/usr/bin/codesign --options runtime --force -s "ESPRESSIF SYSTEMS (SHANGHAI) CO., LTD. (QWXF6GB4AV)" $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg -v
/usr/bin/codesign --options runtime --force -s "$SIGN_ID" $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg -v
/usr/bin/codesign -v -vvv --deep $PWD/releng/ide-dmg-builder/Espressif-IDE-macosx-cocoa-aarch64.dmg

- name: Notarization of Espressif-IDE dmg files
Expand Down
Loading