This is an automated email from the ASF dual-hosted git repository. leginee pushed a commit to branch mac-vcl-button-contrast in repository https://gitbox.apache.org/repos/asf/openoffice.git
commit b58e50cb386acc12e62e2adcc1604136aac49de4 Author: peter kovacs <[email protected]> AuthorDate: Thu Sep 10 05:47:58 2026 +0200 solenv: let mac-silicon-sign.sh sign from a named keychain Add -k/--keychain, also settable through MACOSX_CODESIGNING_KEYCHAIN, and pass it through to codesign. Without it the identity has to live in the keychain search list, which in practice means the login keychain. That matters for anything unattended. A build machine keeps its signing identity in a dedicated keychain it unlocks for the build rather than in the login keychain, and sharing the login keychain with whatever Xcode is managing there invites collisions - two identically named Apple Development certificates in it are enough to make codesign fail with "ambiguous" and abort the packaging step. Co-Authored-By: Claude Opus 5 <[email protected]> --- main/solenv/bin/mac-silicon-sign.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/main/solenv/bin/mac-silicon-sign.sh b/main/solenv/bin/mac-silicon-sign.sh index b7258cdfcd..30594c0b46 100755 --- a/main/solenv/bin/mac-silicon-sign.sh +++ b/main/solenv/bin/mac-silicon-sign.sh @@ -8,6 +8,7 @@ # -i, --identity ID codesign identity; "-" = ad-hoc (default, or # $MACOSX_CODESIGNING_IDENTITY when set) # -e, --entitlements entitlements plist (default: mac-silicon-entitlements.plist) +# -k, --keychain PATH keychain holding the identity (default: the search list) # --hardened force hardened runtime even for an ad-hoc signature # (implied by a real identity) # --verify only report the current signing state, change nothing @@ -27,6 +28,7 @@ set -euo pipefail SRCDIR=$(cd "$(dirname "$0")" && pwd) IDENTITY="${MACOSX_CODESIGNING_IDENTITY:--}" ENTITLEMENTS="$SRCDIR/mac-silicon-entitlements.plist" +KEYCHAIN="${MACOSX_CODESIGNING_KEYCHAIN:-}" HARDENED=no VERIFY_ONLY=no TARGETS=() @@ -35,6 +37,7 @@ while [ $# -gt 0 ]; do case "$1" in -i|--identity) IDENTITY="$2"; shift 2 ;; -e|--entitlements) ENTITLEMENTS="$2"; shift 2 ;; + -k|--keychain) KEYCHAIN="$2"; shift 2 ;; --hardened) HARDENED=yes; shift ;; --verify) VERIFY_ONLY=yes; shift ;; -h|--help) sed -n '2,25p' "$0"; exit 0 ;; @@ -59,6 +62,9 @@ sign_one() { if [ "$HARDENED" = yes ]; then args+=(--options runtime --entitlements "$ENTITLEMENTS") fi + if [ -n "$KEYCHAIN" ]; then + args+=(--keychain "$KEYCHAIN") + fi codesign "${args[@]}" "$@" "$path" }
