Hello I am having trouble with MacOS signing in CI. I have everything I need to create a pkg inside the CI, the keychain, the certs, and everything else. It seems to get stuck on the PackagePkg task, I believe its because of the issue mentioned in this article https://localazy.com/blog/how-to-automatically-sign-macos-apps-using-github-actions. About how its asking the computer for input on allowing the keychain to be accessed. Here is the relevant github action yml, I am not sure how to fix it myself, as you need to sign the pkg during the build, and not after, and compose doesnt seem to have a way to force it like the article does like this

/usr/bin/codesign --force -s <identity-id> ./path/to/you/app -v

- name: Build MacOS Package
      if: ${{ matrix.runtime == 'osx-x64' }}
      run: |
        echo ${{ secrets.APPLE_CERT }} | base64 --decode > certificate.p12
        security create-keychain -p ${{ secrets.APPLE_KEYCHAIN_PASSWORD }} build.keychain 
        security default-keychain -s build.keychain
        security unlock-keychain -p ${{ secrets.APPLE_KEYCHAIN_PASSWORD }} build.keychain
        security import certificate.p12 -k build.keychain -P ${{ secrets.APPLE_CERT_PASSWORD }} -T /usr/bin/codesign
        security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k ${{ secrets.APPLE_KEYCHAIN_PASSWORD }} build.keychain

        ./gradlew packagePkg notarizePkg \
        -Pcompose.desktop.mac.sign=true \
        -Pcompose.desktop.mac.signing.identity=${{ secrets.APPLE_IDENTITY }} \
        -Pcompose.desktop.mac.notarization.appleID=${{ secrets.APPLE_ID }} \
        -Pcompose.desktop.mac.notarization.password=${{ secrets.APPLE_PASSWORD }}

@alexey.tsvetkov ^^^

Any update on this?

@Mitchell Syer hi! You need to pass

-Pcompose.desktop.mac.signing.keychain=<PATH_TO_KEYCHAIN>

. However, the current version accepts only absolute paths (this should be considered a bug). So the easiest fix for you should be something like this:

export KEYCHAIN=$(pwd)/build.keychain
./gradlew packagePkg notarizePkg \
  -Pcompose.desktop.mac.sign=true \
  -Pcompose.desktop.mac.signing.identity=${{ secrets.APPLE_IDENTITY }} \
  -Pcompose.desktop.mac.signing.keychain=$KEYCHAIN \
  -Pcompose.desktop.mac.notarization.appleID=${{ secrets.APPLE_ID }} \
  -Pcompose.desktop.mac.notarization.password=${{ secrets.APPLE_PASSWORD }}

Thanks! That sounds like it should work for me