Github Actions MacOS 11 build fails even with --no-sign option

[gambhiro]

Describe the bug

When building in Github Actions on MacOS 11, the build goes well until the very end, but there is fails even when using the --no-sign option.

#865 seem related but the app should still build and work on Mac OS 11 as before, or did I miss something?

To Reproduce

Example workflow action: https://github.com/gambhiro/pyqt6-build-example/blob/main/.github/workflows/briefcase_build.yml

From the build log:

 Signing macOS/app/Small App/Small App.app/Contents/Resources/app_packages/PyQt6/Qt6/lib/QtBluetooth.framework/Versions/A/QtBluetooth
Signing macOS/app/Small App/Small App.app/Contents/Resources/app_packages/PyQt6/Qt6/lib/QtBluetooth.framework
Signing macOS/app/Small App/Small App.app
   | ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╸ 99.7% • 00:01

Unable to code sign /Users/runner/work/pyqt6-build-example/pyqt6-build-example/macOS/app/Small App/Small App.app.

Expected behavior

I used to use briefcace 0.3.7, and the MacOS 11 build was working with --no-sign. It would build the .dmg in Github Actions, and the user could add the app in Applications, although having to explicitly allow it to run in their security preferences (due to the unknown developer warning).

Environment:

• Operating System: Github Actions MacOS 11
• Python version: 3.9
• Software versions:
  • Briefcase: 0.3.11

[freakboy3742]

Thanks for the report; it's a little difficult to confirm as you've only provided a 3 line snippet of the log, rather than the full build log - but it appears the issue is with the signing of the app, not the DMG.

This isn't related to #865; that's about changing the interpretation of the signing options, rather than changing anything about what is signed.

I can also confirm that signing can work - Briefcase's CI signs apps (including a PySide app) as part of the build process.

Three suggestions to try in your case:

• Update the base image used in the build to macOS-12. macOS-12 is used to build the support package that is embedded in the app, and although the binary is backwards compatible, it's possible there's something incompatible in the signing process. A lot of the Apple ecosystem assumes you're always developing with the most recent tools available.
• Add --no-sign to the build command. This will have consequences on the portability of the app that is generated, but will obviously avoid any signing problems :-)
• Import a signing identity into the build machine. Unfortunately, I don't have any specific instructions for how to do this (this is logged as Document how to use Briefcase in CI #400), but I know it can be done (e.g., https://github.com/simonw/datasette-app does in-CI signing of artefacts).

[victorswed]

@freakboy3742
I have a similar issue
Python version: 3.9
macOS: 11.6.1

I tested with multiple versions:
0.3.7 - the --no-sign option works on the first attempt.
0.3.9 - the --no-sign option doesn't work on the first attempt but the adhoc signing works.
0.3.10 and higher - the --no-sign option doesn't work on the first attempt and the adhoc signing fails, in order to resolve it, I had to run the command twice
briefcase --no-sign package -vvvv || briefcase --no-sign package -vvvv

[freakboy3742]

@victorswed It's impossible to diagnose a problem when you haven't provided any details about the failure; if you're having a problem, please open a new ticket, with the full failure logs output by Briefcase.

• Briefcase is currently at v0.3.14
• We perform adhoc signing operations as part of CI.
• The use of macOS 11 is likely a cause as well. Apple very strongly assumes that developers keep their development systems up to date. We have seen issues in the past that are fixed by upgrading macOS versions, because fixes aren't back ported to older releases.