From db6abdefd3220ec2f93fb2d8b000f04e61e31f0d Mon Sep 17 00:00:00 2001 From: metatroncubeswdev Date: Sat, 31 Oct 2026 15:15:32 -0400 Subject: [PATCH] Codemagic: pass the iOS certificate key base64-encoded and stop on signing errors Co-Authored-By: Claude Opus 5.5 --- codemagic.yaml | 9 ++++++--- docs/app-store-release.md | 4 ++-- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/codemagic.yaml b/codemagic.yaml index 30ab398..7812232 100644 --- a/codemagic.yaml +++ b/codemagic.yaml @@ -3,7 +3,7 @@ # Needed in Codemagic (Team settings / app settings): # - Environment variable group "nk_app": SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, MEDIA_BASE_URL # - App Store Connect API key integration "clickstocart-app" (Developer Portal) (iOS) -# - Variable CERTIFICATE_PRIVATE_KEY (secure) in group "nk_ios_signing" (iOS signing) +# - Variable CERTIFICATE_PRIVATE_KEY_BASE64 (secure) in group "nk_ios_signing" (iOS signing) # - Android keystore uploaded with reference name "nk_upload_keystore" (Android) # - Variable GCLOUD_SERVICE_ACCOUNT_CREDENTIALS in group "nk_google_play" (Android publishing) @@ -42,7 +42,7 @@ workflows: environment: groups: - nk_app - - nk_ios_signing # CERTIFICATE_PRIVATE_KEY (secure) + - nk_ios_signing # CERTIFICATE_PRIVATE_KEY_BASE64 (secure) vars: BUNDLE_ID: com.metatroncubesolutions.nangaKathai flutter: stable @@ -57,9 +57,12 @@ workflows: - *write_env - *checks # Fetches the Apple Distribution certificate and App Store profile through the API key, - # creating them on the first run. CERTIFICATE_PRIVATE_KEY is the certificate's key. + # creating them on the first run. The certificate's private key is stored base64-encoded + # on one line, because multi-line values lose their line breaks when pasted into Codemagic. - name: Set up App Store code signing script: | + set -e + export CERTIFICATE_PRIVATE_KEY="$(echo "$CERTIFICATE_PRIVATE_KEY_BASE64" | base64 --decode)" keychain initialize app-store-connect fetch-signing-files "$BUNDLE_ID" --type IOS_APP_STORE --create keychain add-certificates diff --git a/docs/app-store-release.md b/docs/app-store-release.md index 3079ca2..16148e5 100644 --- a/docs/app-store-release.md +++ b/docs/app-store-release.md @@ -28,8 +28,8 @@ each store release. Build numbers are set automatically by Codemagic. - In Codemagic, open Team settings > Team integrations > Developer Portal and add the key with the name **`clickstocart-app`** (already added; it works for every app in the Apple team). 3. **iOS signing (automatic).** The build creates the Apple Distribution certificate and the App Store profile itself through the API key, so no profiles are made by hand. - - Create a variable group **`nk_ios_signing`** with `CERTIFICATE_PRIVATE_KEY` (secure). - - Its value is the full contents of `C:\Users\manes\nk-keys\ios_distribution_private_key`, including the BEGIN and END lines. + - Create a variable group **`nk_ios_signing`** with `CERTIFICATE_PRIVATE_KEY_BASE64` (secure). + - Its value is the one line in `C:\Users\manes\nk-keys\ios_distribution_private_key.base64.txt`. - The API key needs the **Admin** role, or App Manager with access to Certificates, Identifiers & Profiles. - Apple allows only a few distribution certificates per team. If the limit is reached, revoke an unused one on developer.apple.com. 4. **Android signing.** On the same page, under Android keystores, upload