From 4f38322c922a3f1691bf0d0b5f1dfd26cd5eb5a9 Mon Sep 17 00:00:00 2001 From: jwinterm Date: Mon, 1 Jun 2026 18:59:37 -0400 Subject: [PATCH] iOS TestFlight: macOS base64 wants --decode, not -d MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit macOS uses BSD base64 where -d historically means *debug*, not *decode* like GNU base64. On the Mac runner that bit us — the first base64 -d invocation ran in debug mode, consumed no stdin, and produced an empty .p12 file, then the keychain import bombed with the now-classic "(null): error decoding base64 input stream" once a downstream tool tried to read the empty file. Switch all three secret decodes (.p12 cert, .mobileprovision, .p8 API key) to base64 --decode. Long form is identical between GNU coreutils and BSD base64. The Apple secrets themselves were fine — sanity-check step confirmed all non-zero lengths (TEAM_ID/KEY_ID showed as ***0 in the log, which is the actual literal 10 with the 1 redacted because some other secret value contains the substring "1"). --- .github/workflows/build-ios-testflight.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-ios-testflight.yml b/.github/workflows/build-ios-testflight.yml index 9b59738c5..f9e514a2a 100644 --- a/.github/workflows/build-ios-testflight.yml +++ b/.github/workflows/build-ios-testflight.yml @@ -258,7 +258,7 @@ jobs: security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | sed 's/"//g') # Import the .p12 P12="$RUNNER_TEMP/dist.p12" - echo "$APPLE_DIST_CERT_P12_BASE64" | base64 -d > "$P12" + echo "$APPLE_DIST_CERT_P12_BASE64" | base64 --decode > "$P12" security import "$P12" -k "$KEYCHAIN_PATH" -P "$APPLE_DIST_CERT_P12_PASSWORD" \ -T /usr/bin/codesign -T /usr/bin/security security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH" @@ -274,7 +274,7 @@ jobs: PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles" mkdir -p "$PROFILES_DIR" PROFILE="$RUNNER_TEMP/Hash_Wallet.mobileprovision" - echo "$APPLE_PROVISIONING_PROFILE_BASE64" | base64 -d > "$PROFILE" + echo "$APPLE_PROVISIONING_PROFILE_BASE64" | base64 --decode > "$PROFILE" # Parse the .mobileprovision to get its UUID + Name (CMS-decoded plist). PROFILE_UUID=$(security cms -D -i "$PROFILE" | plutil -extract UUID raw -o - -) @@ -295,7 +295,7 @@ jobs: run: | set -e mkdir -p "$HOME/.appstoreconnect/private_keys" - echo "$APPLE_API_KEY_P8_BASE64" | base64 -d > "$HOME/.appstoreconnect/private_keys/AuthKey_${APPLE_KEY_ID}.p8" + echo "$APPLE_API_KEY_P8_BASE64" | base64 --decode > "$HOME/.appstoreconnect/private_keys/AuthKey_${APPLE_KEY_ID}.p8" ls -la "$HOME/.appstoreconnect/private_keys/" # ---- Flutter init + codegen + pod install ---------------------------