From 91ab8b4a07b58ecdbf7d57d7cc87c83cb527b872 Mon Sep 17 00:00:00 2001
From: Ayushya Amitabh <ayushya@Ayushyas-MacBook-Pro.local>
Date: Wed, 7 Oct 2026 19:36:29 -0400
Subject: [PATCH] CI: pin iOS signing certificate by SHA-1 and log CI keychain
 identities

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .gitea/scripts/ios_ci_signing.rb | 9 +++++++--
 .gitea/workflows/ios.yml         | 3 +++
 ios/ExportOptions.plist          | 2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.gitea/scripts/ios_ci_signing.rb b/.gitea/scripts/ios_ci_signing.rb
index f79606b..1a0ee18 100644
--- a/.gitea/scripts/ios_ci_signing.rb
+++ b/.gitea/scripts/ios_ci_signing.rb
@@ -6,6 +6,11 @@
 require "xcodeproj"
 
 TEAM = "Q3JLTAG9PV"
+# Pinned by SHA-1, not by the "Apple Distribution" name: a runner that also
+# holds other same-named distribution certs (e.g. a dev Mac's login keychain)
+# would otherwise let Xcode pick one the profiles don't include. Update this
+# (and ios/ExportOptions.plist) when the certificate is renewed.
+CERT_SHA1 = "2527806871D806E8E27221B15CA8A1938CF216F2"
 PROFILES = {
   "Runner" => "NooProfile",
   "ShareExtension" => "NooShareSheetProfile",
@@ -18,8 +23,8 @@ PROFILES.each do |target_name, profile|
     settings = config.build_settings
     settings["CODE_SIGN_STYLE"] = "Manual"
     settings["DEVELOPMENT_TEAM"] = TEAM
-    settings["CODE_SIGN_IDENTITY"] = "Apple Distribution"
-    settings["CODE_SIGN_IDENTITY[sdk=iphoneos*]"] = "Apple Distribution"
+    settings["CODE_SIGN_IDENTITY"] = CERT_SHA1
+    settings["CODE_SIGN_IDENTITY[sdk=iphoneos*]"] = CERT_SHA1
     settings["PROVISIONING_PROFILE_SPECIFIER"] = profile
   end
 end
diff --git a/.gitea/workflows/ios.yml b/.gitea/workflows/ios.yml
index d455de1..4f4a5a2 100644
--- a/.gitea/workflows/ios.yml
+++ b/.gitea/workflows/ios.yml
@@ -61,6 +61,9 @@ jobs:
           security set-key-partition-list -S apple-tool:,apple: -s -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
           security list-keychains -d user -s "$KEYCHAIN" $(security list-keychains -d user | tr -d '"')
           rm -f "${{ runner.temp }}/dist.p12"
+          # Must list 2527806871D8... (the cert the profiles embed); if it
+          # doesn't, IOS_DIST_CERT_P12_BASE64 holds the wrong certificate.
+          security find-identity -v -p codesigning "$KEYCHAIN"
 
           PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
           mkdir -p "$PROFILES_DIR"
diff --git a/ios/ExportOptions.plist b/ios/ExportOptions.plist
index c01f601..346c2f2 100644
--- a/ios/ExportOptions.plist
+++ b/ios/ExportOptions.plist
@@ -9,7 +9,7 @@
 	<key>signingStyle</key>
 	<string>manual</string>
 	<key>signingCertificate</key>
-	<string>Apple Distribution</string>
+	<string>2527806871D806E8E27221B15CA8A1938CF216F2</string>
 	<key>provisioningProfiles</key>
 	<dict>
 		<key>dev.ayushya.noo</key>