`codesign` is the macOS command-line tool that signs and verifies Apple binaries. xcodebuild calls it during the archive and export steps; fastlane gym, EAS Build, and every iOS CI plugin eventually shell out to it. Knowing what it does is the difference between staring at 'Code Signing Error' for an hour and fixing the build in two minutes.
Sign a build
bash
codesign --force --sign "Apple Distribution: Acme Corp (ABCDE12345)" \ --entitlements MyApp.entitlements \ --options runtime \ --timestamp \ MyApp.app
Verify a signature
bash
# Quick health check codesign --verify --verbose=4 MyApp.app # Show identity, timestamp, hardened runtime, and entitlements codesign -dvv --entitlements :- MyApp.app
Common errors and what they mean
- errSecInternalComponent
- The keychain refused codesign access to the private key. Run `security set-key-partition-list -S apple-tool:,apple: -k <pw> <keychain>` after importing the .p12 on CI.
- User interaction is not allowed
- Same keychain partition list issue, surfaced when the keychain is locked. Unlock it with `security unlock-keychain` first.
- no identity found
- The certificate is not in any keychain in the search list, or the keychain is locked, or you typed the identity name wrong.
- resource fork, Finder information, or similar detritus not allowed
- Some file inside the bundle has extended attributes that codesign refuses to sign over. Run `xattr -cr MyApp.app` before signing.