Repository navigation
fix(ci): stop the helper keychain auto-locking mid-build; smoke takes -R=<text> - #459
Merged
theogravity merged 1 commit intoOct 26, 2026
Merged
Conversation
… -R=<text> The search-list fix worked: the darwin-arm64 shards signed the helper and notarized cleanly. Two more blockers then surfaced on run 40328004030: - Both darwin-x64 shards hung ~8 minutes into cargo build, exactly where the helper's build script codesigns. A fresh keychain defaults to locking after 300 idle seconds (show-keychain-info on the mini: lock-on-sleep timeout=300s); arm64 signed inside the window, x64's slower cross-build did not, and codesign waits forever for an unlock no headless runner can answer. A bare set-keychain-settings clears the timers in all four keychain blocks. - The helper identity check passed every requirement check by failing: codesign -v takes requirement TEXT only as -R=<text> (usage: -R=<req string>|-R <req file path>); the space form is always read as a file, so smoke died with 'invalid requirement specification'. Verified on the mini: space form fails identically on any app, -R= parses and evaluates. While here, the keychain list became prepend-only, never owned: shards share the runner user's keychain domain, and the whole-list restore (or trap restoring login) can take the list back from under a build still signing. The trap now removes only its own keychain. Simulated on the mini: sibling entries survive.
theogravity
deleted the
fix/desktop-signing-autolock-and-smoke-requirement
branch
October 26, 2026 15:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #458 (run 40328004030: the darwin-arm64 shards SIGNED and notarized cleanly - the search-list fix works). Two blockers remained:
security show-keychain-info: lock-on-sleep timeout=300s); arm64 signed inside the window, the slower x64 cross-build did not, and codesign waits forever for an unlock no headless runner can answer. A baresecurity set-keychain-settingsclears the timers in all four keychain blocks.codesign -vtakes requirement text only as-R=<text>(its usage line:-R=<req string>|-R <req file path>); the space form is always read as a file path, so it died with "invalid requirement specification". Verified on the mini: the space form fails identically on any signed app;-R=parses and evaluates.Also made the search list prepend-only (never owned): shards share the runner user's keychain domain, and a whole-list restore could take it back from under a build still signing; the trap now removes only its own keychain. Simulated on the mini - sibling entries survive.
Drift test (duplicated bodies), actionlint, bash -n, and the smoke wiring test all pass.