expo / expo/eas-cli

[local build] iOS: "0 valid identities found" on macOS Tahoe 26 - Distribution certificate not recognized in temp keychain

Open
#3,645 1 comment 0 reactions 0 assignees View on GitHub
needs review
Dominant language
TypeScript
Stars
1.4k
Forks
236
Avg merge
3d 1h
Merged PRs (30d)
91

Description

### Build/Submit details page URL

_No response_

### Summary

EAS local builds on macOS Tahoe 26 (26.4.1 / 25E253) fail at PREPARE_CREDENTIALS
with "Distribution certificate hasn't been imported successfully". The certificate
is successfully imported (find-certificate confirms it), but security find-identity
returns 0 valid identities. This appears to be a macOS Tahoe compatibility issue
with the temporary keychain mechanism used by EAS local builds.

### Managed or bare?

Managed

### Environment

npx expo-env-info

### Error output

[PREPARE_CREDENTIALS] [DIAG-1] find-identity -v ALLE: 0 valid identities found
[PREPARE_CREDENTIALS] [DIAG-2] find-identity -v -p codesigning: 0 valid identities found
[PREPARE_CREDENTIALS] [DIAG-3] find-certificate (filtered): SHA-1 hash: 3A50325D796B9014D4F4FF06B7D708A42BF20E11 "iPhone Distribution: Jannis Pohl (WRV9RQW49Z)"
[PREPARE_CREDENTIALS] [FIX-1] explicit security import OK
[PREPARE_CREDENTIALS] [FIX-2] set-key-partition-list OK
Error: Distribution certificate with fingerprint 3A50325D796B9014D4F4FF06B7D708A42BF20E11 hasn't been imported successfully

### Reproducible demo or steps to reproduce from a blank project

1. Install any Expo managed project on macOS Tahoe 26.4.1 (25E253)
2. Run: eas build --platform ios --profile preview --local
3. Build fails at PREPARE_CREDENTIALS phase

Root cause:
- EAS creates a temporary keychain
- Imports distribution certificate into it (FIX-1, FIX-2, FIX-3 all report OK)
- find-certificate confirms certificate IS in the keychain
- BUT security find-identity -v -p codesigning returns "0 valid identities found"
- This appears to be a macOS Tahoe 26 security policy change affecting
temporary keychains

Workarounds tried (none worked):
- Generating a new distribution certificate via eas credentials
- Downloading credentials.json locally
- Manually importing p12 into login keychain

Note: Cloud builds (without --local) work fine. Issue is specific to
--local flag on macOS Tahoe 26.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.