From 5a43cc1114e8dd49fe2569a6fc138dc6567d91fa Mon Sep 17 00:00:00 2001
From: jwinterm <johnwmurphy@gmail.com>
Date: Mon, 1 Jun 2026 19:17:04 -0400
Subject: [PATCH] iOS TestFlight: re-export .p12 as legacy PKCS12 before
 security import
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

macOS Keychain Access on Sonoma+ exports .p12 with modern crypto
(AES-256-GCM + PBKDF2 + SHA-256). The `security import` binary on
some macOS releases — including ours apparently — rejects it with:
  SecKeychainItemImport: Unknown format in import.

The openssl decode itself was fine (now using openssl base64 -d -A),
but security can't import the resulting PKCS12 envelope.

Pipe the .p12 through openssl: unpack with the user's password, then
re-export using legacy PBE-SHA1-3DES for both certs and keys, plus
SHA1 MAC. The resulting .p12 uses 90s-era crypto for the OUTER
envelope, which is what security import wants — the actual signing
keys + cert inside are unchanged. No security implication; the legacy
format encryption only matters for the few seconds the .p12 lives in
$RUNNER_TEMP before being imported and deleted.

Also added diagnostic output (file size, magic bytes, file(1)) so the
next failure mode (if any) is easier to characterize.
---
 .github/workflows/build-ios-testflight.yml | 29 +++++++++++++++++++---
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-ios-testflight.yml b/.github/workflows/build-ios-testflight.yml
index 8f63cda4c..d03f20e80 100644
--- a/.github/workflows/build-ios-testflight.yml
+++ b/.github/workflows/build-ios-testflight.yml
@@ -256,15 +256,36 @@ jobs:
           security unlock-keychain -p "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
           # Add to user search list so codesign can find it
           security list-keychains -d user -s "$KEYCHAIN_PATH" $(security list-keychains -d user | sed 's/"//g')
-          # Import the .p12
-          P12="$RUNNER_TEMP/dist.p12"
-          echo "$APPLE_DIST_CERT_P12_BASE64" | openssl base64 -d -A > "$P12"
+          # Decode the user-uploaded .p12 to disk.
+          P12_MODERN="$RUNNER_TEMP/dist-modern.p12"
+          echo "$APPLE_DIST_CERT_P12_BASE64" | openssl base64 -d -A > "$P12_MODERN"
+          echo "=== uploaded .p12 file ==="
+          ls -la "$P12_MODERN"
+          xxd "$P12_MODERN" | head -1
+          file "$P12_MODERN" || true
+
+          # macOS Keychain Access in Sonoma+ exports .p12 with modern crypto
+          # (AES-256-GCM + PBKDF2 + SHA-256) that the `security import`
+          # binary on some macOS releases rejects with
+          # "SecKeychainItemImport: Unknown format in import." Re-export
+          # the PKCS12 through openssl using legacy PBE-SHA1-3DES so the
+          # macOS security command can definitely parse it.
+          P12="$RUNNER_TEMP/dist-legacy.p12"
+          echo "=== converting to legacy PKCS12 format ==="
+          openssl pkcs12 -in "$P12_MODERN" -nodes \
+              -password pass:"$APPLE_DIST_CERT_P12_PASSWORD" \
+            | openssl pkcs12 -export \
+              -macalg sha1 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES \
+              -password pass:"$APPLE_DIST_CERT_P12_PASSWORD" \
+              -out "$P12"
+          ls -la "$P12"
+
           security import "$P12" -k "$KEYCHAIN_PATH" -P "$APPLE_DIST_CERT_P12_PASSWORD" \
             -T /usr/bin/codesign -T /usr/bin/security
           security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "$APPLE_KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
           # Sanity-check: list identities the keychain offers
           security find-identity -v -p codesigning "$KEYCHAIN_PATH"
-          rm -f "$P12"
+          rm -f "$P12_MODERN" "$P12"
 
       - name: Install provisioning profile + parse name/UUID for ExportOptions
         env: