iOS codesigning not being decoded

[CillianMyles]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Which mobile framework are you using?

Flutter (Dart)

Steps to reproduce

1. setup Apple Store Connect api key
2. create Distribution Certificate in Xcode and export .p12
3. create Profile at https://developer.apple.com/account/resources/profiles/list and link to app and Cert
4. run workflow based on codemagic.yaml:

---
workflows:

  mobile-workflow:
    name: Mobile Workflow
    instance_type: mac_mini_m1
    max_build_duration: 60

    integrations:
      app_store_connect: faraday.p8

    environment:
      groups:
        - keystore_credentials
        - google_play_credentials
        - appstore_credentials

      ios_signing:
        distribution_type: app_store
        bundle_identifier: com.cillianmyles.faradaysounds

      vars:
        CM_KEYSTORE_PATH: '/tmp/keystore.keystore'
        # (set in secrets dashboard):
        #  CM_KEYSTORE_PASSWORD
        #  CM_KEY_ALIAS
        #  CM_KEY_PASSWORD
        #  CM_KEYSTORE
        #  GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
        #  APP_STORE_CONNECT_KEY_IDENTIFIER
        #  APP_STORE_CONNECT_ISSUER_ID
        #  APP_STORE_CONNECT_PRIVATE_KEY

      java: 17
      xcode: latest
      cocoapods: 1.15.2

    cache:
      cache_paths:
        - $FLUTTER_ROOT/.pub-cache
        - $HOME/.gradle/caches
        - $HOME/Library/Caches/CocoaPods

    triggering:
      events:
        - tag
      cancel_previous_builds: true

    scripts:
      - name: 🐦 Set up Flutter
        script: |
          git submodule update --init
          ./flutterw doctor

      - name: 📦 Get Dependencies
        script: |
          pod repo update
          ./flutterw pub get

      - name: 🍎 Build iOS App
        script: |
          keychain initialize
          keychain add-certificates
          xcode-project use-profiles --project $FCI_BUILD_DIR/ios/Runner.xcodeproj
          ./flutterw build ipa --release --export-options-plist $FCI_BUILD_DIR/ios/export.plist

      - name: 🤖 Build Android App
        script: |
          echo "flutter.sdk=$HOME/programs/flutter" > "$FCI_BUILD_DIR/android/local.properties"
          echo $CM_KEYSTORE | base64 --decode > $CM_KEYSTORE_PATH
          ./flutterw build appbundle --release
          android-app-bundle build-universal-apk \
            --bundle build/**/outputs/**/*.aab \
            --ks $CM_KEYSTORE_PATH \
            --ks-pass $CM_KEYSTORE_PASSWORD \
            --ks-key-alias $CM_KEY_ALIAS \
            --key-pass $CM_KEY_PASSWORD

    artifacts:
      - build/**/outputs/**/*.aab
      - build/**/outputs/**/*.apk
      - build/**/outputs/**/mapping.txt
      - build/ios/ipa/*.ipa
      - "/tmp/xcodebuild_logs/*.log"
      - flutter_drive.log

    publishing:
      email:
        recipients:
          - [email protected]

      google_play:
        credentials: $GCLOUD_SERVICE_ACCOUNT_CREDENTIALS
        track: internal
        submit_as_draft: false

      app_store_connect:
        auth: integration
        submit_to_testflight: true

Expected results

Successfully creates signed iOS app

Actual results

"Build iOS App" step fails:

Saved export options to /Users/builder/export_options.plist
Downloading ios tools...                                         2,125ms
Downloading ios-profile tools...                                 1,690ms
 1,690ms
Downloading ios-release tools...                                    9.1s
"/Users/builder/clone/ios/export.plist" property list does not exist.


Build failed :|
Step 7 script `🍎 Build iOS App` exited with status code 1

This looks like it is about the export options plist location, but I don't think it is since I have the exact same setup for another project which works flawlessly.

Also an error which appears in the logs of this project, but not the one which works:

security: SecKeychainItemImport: Unable to decode the provided data.

I think there is some issue with the signing certificate or profile, but not honestly sure? I've deleted them both and re-created twice to check if it was just something dumb on my end.

Any ideas would be appreciated,
Cillian

Build id (optional)

67cabbb6f52d018522ae148a

[CillianMyles]

PS - I have tried specifying the options file like so:

./flutterw build ipa --release --export-options-plist=/Users/builder/export_options.plist

What does not work, and I wouldn't expect to have to do this, as mentioned I have another Codemagic Flutter project with the exact same codemagic.yaml and setup and it works.

[dam-ease]

Hey @CillianMyles,
When you run xcode-project use-profile, the options for exporting the project is saved to /Users/builder/export_options.plist, hence in your build ipa, you need to use as is:

flutter build ipa -- release \
   --export-options-plist=/Users/builder/export_options.plist

From your build logs, I see you are using /ios/export.plist which doesn't exist. Although from your last comment, you shared you tried with /Users/builder/export_options.plist, I can't find the build ID with this in your Team builds, can you please share it with me? It will be really helpful.
Another thing you could try here is separating the steps. You don't need to run the

keychain initialize
keychain add-certificates

again in the build iOS step as this has been done earlier since you are using code signing identities. Please remove that and add the:

xcode-project use-profiles 

in a separate step before the build step and share how it goes please.

[CillianMyles]

Here is a recent build from the other project, with exact same setup, that does work:

67c2faf490c558076f16e1b8

---

Here is a previous build of this project:

67c46bc55a2f597d9184b7b6

... which pointed to the export_options.plist as you mentioned:

keychain initialize
keychain add-certificates
xcode-project use-profiles --project $FCI_BUILD_DIR/ios/Runner.xcodeproj
./flutterw build ipa --release –export-options-plist=/Users/builder/export_options.plist

... which failed ❌

---

Here is the build:

67dbae917f56b8f190408dad

... where I tried your suggestion:

      - name: 🔑 Setup iOS Signing
        script: |
          xcode-project use-profiles --project $FCI_BUILD_DIR/ios/Runner.xcodeproj

      - name: 🍎 Build iOS App
        script: |
          ./flutterw build ipa --release --export-options-plist=/Users/builder/export_options.plist

... which succeeded ✅

[CillianMyles]

And finally after fixing a Google Play API issue, a successful build and publish:

67dbb3cc562cb797d41774ee

Thank you 🙏

[CillianMyles]

To be clear... the answer was to change this:

      - name: 🍎 Build iOS App
        script: |
          keychain initialize
          keychain add-certificates
          xcode-project use-profiles --project $FCI_BUILD_DIR/ios/Runner.xcodeproj
          ./flutterw build ipa --release --export-options-plist $FCI_BUILD_DIR/ios/export.plist

... into this:

      - name: 🔑 Setup iOS Signing
        script: |
          xcode-project use-profiles --project $FCI_BUILD_DIR/ios/Runner.xcodeproj

      - name: 🍎 Build iOS App
        script: |
          ./flutterw build ipa --release --export-options-plist=/Users/builder/export_options.plist