Baike.dev
Log in
Back to tool/Back to issues
#29856·fastlane

Codesign error when using custom keychain in CI environment

Author: mtnairCreated Jan 12, 2026Updated Sep 20, 2026

New Issue Checklist

Issue Description

My problem is kinda weird, please let me explain: Before the christmas holidays, our iOS pipeline using fastlane was working normal. At the start of the new year, we moved our app to a new developer account and created a new App Store Connect API key as well as new development+distribution certificates and provisioning profiles using match. We also updated fastlane from 2.229.0 to 2.230.0 in the same step. We updated our project in Xcode to use the new profiles and team identifier. But when we tried to build the app in our self-hosted Azure DevOps pipeline with an agent on a Mac mini in our office, the build always failed with an generic error during signing (errSecInternalComponent):

▸ /usr/bin/codesign --force --sign 4A579B0D5D82D72561B891EFDDC3F9D75483A262 --preserve-metadata=identifier,entitlements '/Users/_svc_devops/Library/Developer/Xcode/DerivedData/App-dozmmvrmdbwiaaewelvxdymdaeic/Build/Intermediates.noindex/ArchiveIntermediates/App Release/InstallationBuildProductsLocation/Applications/App.app/Frameworks/Capacitor.framework'
▸ /Users/_svc_devops/Library/Developer/Xcode/DerivedData/App-dozmmvrmdbwiaaewelvxdymdaeic/Build/Intermediates.noindex/ArchiveIntermediates/App Release/InstallationBuildProductsLocation/Applications/App.app/Frameworks/Capacitor.framework: errSecInternalComponent
▸ Command PhaseScriptExecution failed with a nonzero exit code

Our Fastfile looks like this:

default_platform(:ios)

platform :ios do
  before_all do |lane, options|
    app_store_connect_api_key({
      key_id: "OURKEYID1234",
      issuer_id: "our-issuer-id",
      key_filepath: "./fastlane/AuthKey_OURKEYID1234.p8",
      in_house: false,
    })
  end

  desc "Build App"
  lane :build do |options|
    delete_keychain(name: "fastlane_keychain") if File.exist?(File.expand_path("~/Library/Keychains/fastlane_keychain-db"))

    create_keychain(
      name: "fastlane_keychain",
      password: "temppassword",
      default_keychain: false,
      unlock: true,
      timeout: 3600,
    )

    match(
      git_url: "https://url/to/our/codesigning/repo.git",
      type: "appstore",
      readonly: true,
      force_for_new_devices: true,
      keychain_name: "fastlane_keychain",
      keychain_password: "temppassword",
    )

    gym(
      scheme: "App Release",
      export_method: "app-store",
      export_options: {
        provisioningProfiles: {
          "our.bundle.identifier": "match AppStore our.bundle.identifier"
        },
        testFlightInternalTestingOnly: options[:internal],
      },
      build_path: "./build",
      workspace: "./App.xcworkspace",
    )

    delete_keychain(name: 'fastlane_keychain')
  end
end

We wanted to create a separate keychain every time the pipeline is run to avoid inconsistencies and other problems we encountered when we were using the default login keychain for match. During our investigation of what the problem could be, we tried different things, like downgrading fastlane to 2.229.1 and then down to 2.229.0, what didn't solve the problem. We then found the solution that was working for us: Reordering the keychains in "security list-keychains", so that our custom keychain is at the top:

bash
    match(...)

    sh <<~EOS
      security list-keychains -d user -s \
        ~/Library/Keychains/fastlane_keychain-db \
        $(security list-keychains -d user | sed s/\\"//g | grep -v 'fastlane_keychain-db')
    EOS

    gym(...)

We still don't understand why this works, but for now this is our solution. We also looked into gym if it was possible to pass a custom keychain name to be preferred, but in the documentation we didn't find anything.

Oh, and a final information: When we tried to run the fastlane command manually in the bash shell as the user the agent runs on, we didn't have to include the command to reorder the keychains, the build succeeded every time. It seems that it only occurs in non-interactive environments.

Command executed

bundle exec fastlane ios build internal:true

Complete output when running fastlane, including the stack trace and command used

fastlane error.txt

Environment

✅ fastlane environment ✅

Stack

Key Value
OS 26.2
Ruby 3.4.4
Bundler? true
Git git version 2.49.0
Installation Source /opt/homebrew/lib/ruby/gems/3.4.0/bin/fastlane
Host macOS 26.2 (25C56)
Ruby Lib Dir /opt/homebrew/Cellar/ruby/3.4.4/lib
OpenSSL Version OpenSSL 3.5.0 8 Apr 2025
Is contained false
Is homebrew false
Is installed via Fabric.app false
Xcode Path /Applications/Xcode.app/Contents/Developer/
Xcode Version 26.2
Swift Version 6.2.3

System Locale

Variable Value
LANG en_US.UTF-8 ✅
LC_ALL
LANGUAGE

fastlane files:

`./fastlane/Fastfile`
ruby
default_platform(:ios)

platform :ios do
  before_all do |lane, options|
    app_store_connect_api_key({
      key_id: "OURKEYID1234",
      issuer_id: "our-issuer-id",
      key_filepath: "./fastlane/AuthKey_OURKEYID1234.p8",
      in_house: false,
    })
  end

  desc "Deploy to TestFlight"
  lane :deploy do |options|
    build(options)

    pilot(
      changelog: options[:changelog],
    )
  end

  desc "Build App"
  lane :build do |options|
    delete_keychain(name: "fastlane_keychain") if File.exist?(File.expand_path("~/Library/Keychains/fastlane_keychain-db"))

    create_keychain(
      name: "fastlane_keychain",
      password: "temppassword",
      default_keychain: false,
      unlock: true,
      timeout: 3600,
    )

    match(
      git_url: "https://url/to/our/codesigning/repo.git",
      type: "appstore",
      readonly: true,
      force_for_new_devices: true,
      keychain_name: "fastlane_keychain",
      keychain_password: "temppassword",
    )

    # Die Fastlane-Keychain muss ganz oben in der Liste der zu verwendenden Keychains stehen
    sh <<~EOS
      security list-keychains -d user -s \
      ~/Library/Keychains/fastlane_keychain-db \
      $(security list-keychains -d user | sed s/\\"//g)
    EOS

    gym(
      scheme: "App Release",
      export_method: "app-store",
      export_options: {
        provisioningProfiles: {
          "our.bundle.identifier": "match AppStore our.bundle.identifier"
        },
        testFlightInternalTestingOnly: options[:internal],
      },
      build_path: "./build",
      workspace: "./App.xcworkspace",
    )

    delete_keychain(name: 'fastlane_keychain')
  end
end
`./fastlane/Appfile`
ruby
app_identifier("our.bundle.identifier")
team_id("OURTEAMID")

fastlane gems

Gem Version Update-Status
fastlane 2.230.0 ✅ Up-To-Date

Loaded fastlane plugins:

No plugins Loaded

Loaded gems
Gem Version
error_highlight 0.7.0
did_you_mean 2.0.0
syntax_suggest 2.0.2
bundler 2.6.9
pathname 0.4.0
rake 13.3.1
CFPropertyList 3.0.8
abbrev 0.1.2
public_suffix 7.0.2
addressable 2.8.8
artifactory 3.0.17
atomos 0.1.3
aws-eventstream 1.4.0
aws-partitions 1.1202.0
aws-sigv4 1.12.1
base64 0.2.0
bigdecimal 4.0.1
jmespath 1.6.2
logger 1.7.0
aws-sdk-core 3.241.3
aws-sdk-kms 1.120.0
aws-sdk-s3 1.211.0
babosa 1.0.4
claide 1.1.0
colored 1.2
colored2 3.1.2
highline 2.0.3
commander 4.6.0
csv 3.3.5
declarative 0.0.20
digest-crc 0.7.0
domain_name 0.6.20240107
dotenv 2.8.1
emoji_regex 3.2.3
excon 0.112.0
faraday-em_http 1.0.0
faraday-em_synchrony 1.0.1
faraday-excon 1.1.0
faraday-httpclient 1.0.1
multipart-post 2.4.1
faraday-multipart 1.2.0
faraday-net_http 1.0.2
faraday-net_http_persistent 1.2.0
faraday-patron 1.0.0
faraday-rack 1.0.0
faraday-retry 1.0.3
ruby2_keywords 0.0.5
faraday 1.10.4
http-cookie 1.0.8
faraday-cookie_jar 0.0.8
faraday_middleware 1.2.1
fastimage 2.4.0
sysrandom 1.0.5
fastlane-sirp 1.0.0
gh_inspector 1.1.3
jwt 2.10.2
multi_json 1.19.1
os 1.1.4
signet 0.21.0
googleauth 1.8.1
mutex_m 0.3.0
httpclient 2.9.0
mini_mime 1.1.5
trailblazer-option 0.1.2
uber 0.1.0
representable 3.2.0
retriable 3.1.2
rexml 3.4.4
google-apis-core 0.11.3
google-apis-androidpublisher_v3 0.54.0
google-apis-playcustomapp_v1 0.13.0
google-cloud-env 1.6.0
google-apis-iamcredentials_v1 0.17.0
google-apis-storage_v1 0.31.0
google-cloud-errors 1.5.0
google-cloud-core 1.8.0
google-cloud-storage 1.47.0
json 2.18.0
mini_magick 4.13.2
naturally 2.3.0
nkf 0.2.0
optparse 0.8.1
plist 3.7.2
rubyzip 2.4.1
security 0.1.5
simctl 1.6.10
terminal-notifier 2.0.0
unicode-display_width 2.6.0
terminal-table 3.0.2
tty-screen 0.8.2
tty-cursor 0.7.1
tty-spinner 0.9.3
word_wrap 1.0.0
nanaimo 0.4.0
xcodeproj 1.27.0
rouge 3.28.0
xcpretty 0.4.1
xcpretty-travis-formatter 1.0.1
ostruct 0.6.3

generated on: 2026-01-12

Source: fastlane/fastlane

View original on GitHubView discussion on GitHub