Discrepancy in private-key arg passed to app-store-connect publish

[fondeadora-tech]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Which mobile framework are you using?

Flutter (Dart)

Steps to reproduce

1. Run a workflow
2. In the Publishing (iOS) step we’re sometimes (not always) getting an error:

   app-store-connect publish: error: argument --private-key: Provided value in environment variable "APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY" is not valid. Provided value is not a valid PEM encoded private key
   
   Failed to publish ********_app.ipa to App Store Connect.
   

3. We notice that the builds that fail pass a different set of arguments to the app-store-connect publish those that succeed

Expected results

It should pass the correct keys, like this build (67941acc6ac40e778f30f713):

app-store-connect publish --path /Users/builder/clone/build/ios/ipa/********_app.ipa --key-id @env:APP_STORE_CONNECT_KEY_IDENTIFIER --issuer-id @env:APP_STORE_CONNECT_ISSUER_ID --private-key @env:APP_STORE_CONNECT_PRIVATE_KEY

This is expected and consistent with the codemagic.yaml config file, and correctly publishes the file to the App Store.

Actual results

It passes a different set of values to the publish command:

app-store-connect publish --path /Users/builder/clone/build/ios/ipa/********_app.ipa --key-id ******** --issuer-id ******** --private-key @env:APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY

This results in an error when publishing:

app-store-connect publish: error: argument --private-key: Provided value in environment variable "APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY" is not valid. Provided value is not a valid PEM encoded private key

Where is that variable APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY coming from? It’s not defined anywhere in our config, nor is it documented.

Build id (optional)

679915f5c65d7c5cb7e6b073

[dam-ease]

Hello @fondeadora-tech,
Can you please check under your environment variables, you seem to have the variable APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY defined there. Although it isn't defined in the publishing step, it's part of a group defined in your workflow, hence it might be read.

Please can you remove this variable or move it to another group not defined in your workflow and run this build again?

[fondeadora-tech]

I just re-ran the workflow after removing the environment variable and got the same result:

app-store-connect publish --path /Users/builder/clone/build/ios/ipa/********_app.ipa --key-id ******** --issuer-id ******** --private-key @env:APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY
…
app-store-connect publish: error: argument --private-key: Provided value in environment variable "APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY" is not valid. Provided value is not a valid PEM encoded private key

[dam-ease]

Alright, seeing that it reproduces, let's focus on the main part of the error:

Provided value in environment variable "" is not valid. Provided value is not a valid PEM encoded private key

Please can you confirm that theAPP_STORE_CONNECT_PRIVATE_KEY variable you have includes -----BEGIN OPENSSH PRIVATE KEY----- and -----END OPENSSH PRIVATE KEY----- lines (depending on the key format it can be RSA instead of OPENSSH)

[fondeadora-tech]

Please note that in the original issue I mentioned that sometimes the builds complete successfully, when the correct keys are passed (APP_STORE_CONNECT_PRIVATE_KEY) to the app-store-connect publish command.

It should pass the correct keys, like this build (67941acc6ac40e778f30f713):

app-store-connect publish --path /Users/builder/clone/build/ios/ipa/********_app.ipa --key-id @env:APP_STORE_CONNECT_KEY_IDENTIFIER --issuer-id @env:APP_STORE_CONNECT_ISSUER_ID --private-key @env:APP_STORE_CONNECT_PRIVATE_KEY
This is expected and consistent with the codemagic.yaml config file, and correctly publishes the file to the App Store.

So that means the value for APP_STORE_CONNECT_PRIVATE_KEY is correct.

The problem is that sometimes (no idea when) the command is called with the other key APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY:

app-store-connect publish --path /Users/builder/clone/build/ios/ipa/********_app.ipa --key-id ******** --issuer-id ******** --private-key @env:APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY
…
app-store-connect publish: error: argument --private-key: Provided value in environment variable "APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY" is not valid. Provided value is not a valid PEM encoded private key

That is the issue and what we’re trying to understand and get fixed.

[dam-ease]

Hey @fondeadora-tech,
Apologies for not getting back sooner. I was able to reproduce seeing this variable APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY once on my end as well but the publish was successful eitherways, my thoughts here is that this could sometimes appear as this in the script but the PRIVATE_KEY is still being used here - https://github.com/codemagic-ci-cd/cli-tools/blob/master/docs/app-store-connect/publish.md#--private-keyprivate_key. Can you try removing the variable APP_STORE_CONNECT_PRIVATE_KEY and let it pick the value from your .p8 file or re-add the value of your APP_STORE_CONNECT_PRIVATE_KEY

[dam-ease]

Hello @fondeadora-tech
How's it going on your end?
Just following up on my previous message.
If there is anything I can assist you with, please don't hesitate to let me know.