Xcode's build system runs codesign as a task like any other. When that task exits non-zero, the build system prints this line and stops. It is a status report, not a diagnosis. Searching for it directly is how people end up reading fifteen unrelated answers, because the same wrapper covers a dozen unrelated causes.
The real message is whatever codesign wrote to stderr immediately before. Everything below is about finding that line, and then about which page to read once you have it.
Getting at the actual error
In Xcode, open the Report navigator, find the failing build, and expand the CodeSign step. The full command and its output are inside, collapsed by default. The issue navigator shows only the wrapper, which is why the useful text feels missing.
On CI the problem is usually the log formatter. xcpretty and similar tools filter aggressively and routinely swallow the codesign stderr while keeping the wrapper. Keep the raw log alongside the pretty one.
# Keep the raw log even when piping through a formatter set -o pipefail xcodebuild archive \ -scheme MyApp \ -archivePath build/MyApp.xcarchive \ 2>&1 | tee build/raw.log | xcpretty # Then read what actually happened grep -n -i -B2 -A6 "codesign" build/raw.log | less
If the raw log still shows nothing beyond the wrapper, raise the verbosity of the signing step itself. OTHER_CODE_SIGN_FLAGS is passed straight through to codesign, so a verbose flag there ends up in the log.
xcodebuild archive \ -scheme MyApp \ -archivePath build/MyApp.xcarchive \ OTHER_CODE_SIGN_FLAGS="--verbose=4"
What the line above it means
These are the messages that account for most of the failures behind this wrapper, roughly in the order you are likely to meet them. Each links to a full page where one exists.
- User interaction is not allowed
- The keychain refused to hand over the private key without a prompt nobody can answer. See codesign wants to access key in your keychain for the partition list fix.
- errSecInternalComponent
- The same refusal with a less helpful name, almost always on a build server. See errSecInternalComponent.
- resource fork, Finder information, or similar detritus not allowed
- Extended attributes on a file inside the bundle. See the detritus error.
- no identity found
- codesign was given an identity name that matches nothing in the keychain search list. See no signing certificate found.
- Provisioning profile has app ID which does not match the bundle ID
- The profile and the target disagree about the identifier. See the app ID mismatch page.
- bundle format unrecognized, invalid, or unsuitable
- The thing being signed is not laid out as a valid bundle. Usually a framework assembled by a script with the wrong directory structure, or a symlink that does not resolve.
- code object is not signed at all
- Nested code inside the bundle was never signed. Check that embedded frameworks are set to Embed and Sign rather than Embed Without Signing.
- unsealed contents present in the bundle root
- Files were written into the bundle root after signing, often by a Run Script phase that runs too late. Move the phase before the signing step.
- The specified item could not be found in the keychain
- The identity genuinely is not there, as opposed to being inaccessible. See missing private key for signing certificate.
When there is genuinely nothing above it
Occasionally the step fails without useful stderr. Three things are worth checking before you go further, all of them cheap.
- Does the identity resolve at all? Run security find-identity with the same keychain the build uses, as the same user the build runs as.
- Is the build running as a different user than the one you tested by hand? A launch daemon or a runner service account has its own keychain search list, and nothing in it.
- Is the disk full? codesign writes a temporary copy of what it signs. A full volume on a build agent produces failures that look like signing problems and are not.
# Same keychain, same user, no prompt security find-identity -v -p codesigning # Reproduce the signing step by hand on the built product codesign --force --verbose=4 \ --sign "Apple Distribution: Acme Corp (ABCDE12345)" \ build/MyApp.app
Running codesign by hand on the built product is the fastest way to get an honest error, because nothing is filtering the output. If it succeeds by hand and fails in the build, the difference is environmental: the user, the keychain, or the search list.