more logging

Author: jasonzh0

.github/workflows/release.yml

@@ -33,11 +33,26 @@ jobs:
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
         run: |
           echo "$APPLE_CERTIFICATE" | base64 --decode > certificate.p12
-          security create-keychain -p "" build.keychain
+
+          # Create and configure keychain
+          security create-keychain -p "build" build.keychain
           security default-keychain -s build.keychain
-          security unlock-keychain -p "" build.keychain
-          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security
-          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "" build.keychain
+          security unlock-keychain -p "build" build.keychain
+          security set-keychain-settings -t 3600 -u build.keychain
+
+          # Import certificate
+          security import certificate.p12 -k build.keychain -P "$APPLE_CERTIFICATE_PASSWORD" -T /usr/bin/codesign -T /usr/bin/security -T /usr/bin/productbuild
+
+          # Allow codesign to access keychain without prompting
+          security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "build" build.keychain
+
+          # Add to search list
+          security list-keychains -d user -s build.keychain $(security list-keychains -d user | tr -d '"')
+
+          # Verify import was successful
+          echo "=== Verifying certificate import ==="
+          security find-identity -v -p codesigning build.keychain
+
           rm certificate.p12
 
       - name: Build application
@@ -48,10 +63,31 @@ jobs:
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
         run: |
-          # Find the signing identity
+          # List all available signing identities
+          echo "=== Available signing identities ==="
+          security find-identity -v -p codesigning build.keychain
+
+          # Find the signing identity (try Developer ID first, then any valid identity)
           IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep "Developer ID Application" | head -1 | awk -F'"' '{print $2}')
+
+          if [ -z "$IDENTITY" ]; then
+            echo "No Developer ID Application found, trying Apple Distribution..."
+            IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep "Apple Distribution" | head -1 | awk -F'"' '{print $2}')
+          fi
+
+          if [ -z "$IDENTITY" ]; then
+            echo "No Apple Distribution found, using first valid identity..."
+            IDENTITY=$(security find-identity -v -p codesigning build.keychain | grep -E "^[[:space:]]+[0-9]+" | head -1 | awk -F'"' '{print $2}')
+          fi
+
           echo "Using identity: $IDENTITY"
 
+          if [ -z "$IDENTITY" ]; then
+            echo "ERROR: No valid signing identity found!"
+            echo "Make sure APPLE_CERTIFICATE contains a Developer ID Application certificate"
+            exit 1
+          fi
+
           # Sign the native mouse-telemetry binary with hardened runtime
           if [ -f "native/mouse-telemetry" ]; then
             codesign --force --options runtime --timestamp --sign "$IDENTITY" native/mouse-telemetry