The three keychain errors that were all the same missing command

I lost the better part of a day to headless code signing, and the whole time I thought I was fighting three unrelated bugs.

First, the build just hung — forever — at "[CP] Embed Pods Frameworks." No error, no timeout, just silence until the CI job itself timed out an hour later. Turns out codesign was trying to pop an interactive "Allow keychain access?" dialog. There's no screen on a CI runner to click Allow on, so the process just waits for a click that will never come.

Once I fixed that, I got "No certificate for team X" — even though I'd just imported the certificate two steps earlier, successfully, no errors. The cert was sitting right there in a temporary keychain. The problem was that nothing had told codesign and xcodebuild to actually look in that keychain — importing a cert and adding its keychain to the search list are two different steps, and I'd only done the first one.

Fixed that too, and hit a third error: SecItemCopyMatching: The specified item could not be found in the keychain, thrown by security set-key-partition-list. The key import had worked. This command runs one step later, and it couldn't find the key to apply its ACL — because the password I'd passed to -k didn't character-for-character match the password I'd used to unlock the keychain two lines above it in the same script. A typo in a variable name, effectively.

Three different error messages, three different points in the script, and the root cause every time was the same category of mistake: something about the keychain wasn't fully "there" from the next command's point of view, even though it looked fine from mine. The fix for all three ended up being three lines, in this order, right after import:

security list-keychains -d user -s /tmp/my.keychain login.keychain
security set-keychain-settings -lut 3600 /tmp/my.keychain
# (then, only after that): security set-key-partition-list -S apple-tool:,apple: -k "$SAME_PASSWORD" /tmp/my.keychain

If you're scripting headless signing for the first time, do all three up front. It'll save you the day I lost finding them one at a time.