The keychain is macOS's encrypted store for secrets. Every Apple Developer certificate you import on a Mac lands in a keychain, paired with the private key that signs builds for it. Xcode and the codesign command both look up signing identities in keychains, so a misconfigured keychain is the most common cause of mystery signing failures on CI.
Keychains you will see
- Login keychain
- Unlocked automatically when a user logs in. Most developer Macs store signing identities here.
- System keychain
- Available to every user on the machine. Often used on CI runners so the signing process does not depend on a particular user being logged in.
- Custom keychain
- A keychain file you create explicitly (`security create-keychain`). CI scripts often build a throwaway keychain per job and delete it at the end.
Why CI builds fail with 'no signing certificate' errors
- The certificate was imported into a keychain that is not in the user's keychain search list.
- The keychain is locked, so codesign cannot read the private key. `security unlock-keychain` is the fix.
- The 'codesign' partition list on the imported key forbids non-interactive access. Run `security set-key-partition-list` to grant it.
- A different keychain on the runner has an expired certificate of the same type and codesign picks that one first.