Skip to content

Do not validate identity flag to allow for sha1 values#98

Merged
sindresorhus merged 3 commits intosindresorhus:mainfrom
gsabran:gui--allow-sha1-identity
Aug 30, 2025
Merged

Do not validate identity flag to allow for sha1 values#98
sindresorhus merged 3 commits intosindresorhus:mainfrom
gsabran:gui--allow-sha1-identity

Conversation

@gsabran
Copy link
Contributor

@gsabran gsabran commented Aug 29, 2025

When several code signing identities have the same name, codesign will fail:

security find-identity -v -p codesigning
 1) 3F60B8D9578EAEF1E13A7EEC1394D4CE34139555 "Developer ID Application: App Inc (FR57J8KL90)"
 2) 7952E8BC89E7BF5FCED31AF352783B7A34FADC0D "Developer ID Application: App Inc (FR57J8KL90)"
 
 
create-dmg 'build/myGreatApp.app' 'build/' --identity 'Developer ID Application: App Inc (FR57J8KL90)'
✖ Code signing failed. The DMG is fine, just not code signed.
Developer ID Application: App Inc (FR57J8KL90): ambiguous (matches "Developer ID Application: App Inc (FR57J8KL90)" and "Developer ID Application: App Inc (FR57J8KL90)" in /Users/me/Library/Keychains/login.keychain-db)

codesign will however work if you give it the matching sha1 for the identity to use.

This change allow to use sha1 as well as identity name by removing the validation for the identity flag that allows for only the name. Not validating seemed fine (instead of validating either possibilities) since codesign will fail when the identity is not valid:

create-dmg 'build/myGreatApp.app' 'build/' --identity '3F60B8D9578EAEF1E13A7EEC1394D4CE34139555'
ℹ Code signing identity: Developer ID Application: App Inc (FR57J8KL90)
✔ Created “myGreatApp 1.0.0.dmg”

create-dmg 'build/myGreatApp.app' 'build/' --identity 'bad-identity'
✖ Code signing failed. The DMG is fine, just not code signed.
bad-identity: no identity found

@sindresorhus sindresorhus merged commit b2eb4b3 into sindresorhus:main Aug 30, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants