[msbuild] Show a helpful error when codesign fails with errSecInternalComponent. Fixes #26183. - #26189
Conversation
…lComponent. When building over SSH, the login keychain is typically locked, and codesign fails with the cryptic 'errSecInternalComponent' error. Detect this specific error and emit an additional, actionable message telling the user to unlock the keychain first. Fixes #26183. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4792ee55-551d-4464-9466-65bd0d0f2fbc
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4792ee55-551d-4464-9466-65bd0d0f2fbc
There was a problem hiding this comment.
Pull request overview
This PR improves the MSBuild Codesign task’s diagnostics by detecting the errSecInternalComponent codesign failure and emitting an additional actionable message that points users to unlocking their keychain (a common cause when building over SSH).
Changes:
- Detect
errSecInternalComponentin codesign stderr and log an additional hint to unlock the login keychain. - Add localized resource string
E7184containing the new actionable error message.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| msbuild/Xamarin.MacDev.Tasks/Tasks/Codesign.cs | Adds detection of errSecInternalComponent and emits a dedicated hint error. |
| msbuild/Xamarin.Localization.MSBuild/MSBStrings.resx | Adds localized string E7184 for the new hint message. |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
/azp run xamarin-macios-sim-pr-tests |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This comment has been minimized.
This comment has been minimized.
|
/azp run xamarin-macios-sim-pr-tests |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
This comment has been minimized.
This comment has been minimized.
|
/azp run xamarin-macios-sim-pr-tests |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
…nce, use ordinal matching. Codesign.Sign runs for multiple items and in parallel, so the errSecInternalComponent hint could be logged many times. Guard it with an Interlocked flag so it's only logged once per task invocation, and match the error string using an ordinal comparison for consistent behavior across target frameworks. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4792ee55-551d-4464-9466-65bd0d0f2fbc
✅ API diff for current PR / commitNET (empty diffs)✅ API diff vs stableNET (empty diffs)ℹ️ Generator diffGenerator Diff: vsdrops (html) vsdrops (raw diff) gist (raw diff) - Please review changes) Pipeline on Agent |
This comment has been minimized.
This comment has been minimized.
🚀 [CI Build #c5c8cc1] Test results 🚀Test results✅ All tests passed on VSTS: test results. 🎉 All 203 tests passed 🎉 Tests counts✅ assembly-processing: All 1 tests passed. Html Report (VSDrops) Download macOS tests✅ Tests on macOS Monterey (12): All 5 tests passed. Html Report (VSDrops) Download Linux Build VerificationPipeline on Agent |
When you build/deploy an app over SSH, the login keychain is typically locked (there's no GUI login session to unlock it). In that state codesign can't access the signing identity's private key and fails with the cryptic Security-framework error
errSecInternalComponent, with no hint about what's actually wrong.This detects that specific error in the
CodesignMSBuild task and emits an additional, actionable error telling the user the keychain is likely locked and how to unlock it:The original codesign error is still shown as well, since
errSecInternalComponentisn't always caused by a locked keychain.Fixes #26183
🤖 Pull request created by Copilot