macOS release builds broken

[richardlau]

As of 22 Jan 2025, macOS nightly/release builds have started to fail to codesign.

e.g.
https://ci-release.nodejs.org/job/iojs+release/10761/nodes=osx13-release-pkg/console

08:59:22 + codesign --sign 'Developer ID Application: Node.js Foundation' --entitlements tools/osx-entitlements.plist --options runtime --timestamp out/macos/dist/x64/node/usr/local/bin/node
08:59:22 error: The specified item could not be found in the keychain.
08:59:22 make: *** [node-v24.0.0-nightly20250122bf59539b98.pkg] Error 1

[richardlau]

I'll open an issue on OpenJS Infrastructure Project Board (view) as well in case this is related to the Orka modernization.

[richardlau]

Opened openjs-foundation/infrastructure#39.

This blocks any new releases of Node.js on macOS, e.g. Node.js 20.18.3 planned for tomorrow (28 Jan 2025) cc @marco-ippolito / @nodejs/releasers

[ryanaslett]

I saw this this when looking at other issues. It appears to be something to do with the way that the keychain is being unlocked in those images. It was a struggle to get them to actually unlock, and my assumption at this point is that they were unlocked for 90 days.

I'll keep updating as I investigate.

[ryanaslett]

The apple certificates expired on Jan 22. I'll issue new ones and update the release images.

[ryanaslett]

I've generated new certs, updated the images, except the x64 image failed in its update and now seems stalled.

I re-ran one of the osx daily builds to verify that the codesign update does work (https://ci-release.nodejs.org/job/iojs+release/nodes=osx13-arm64-release-tar/10769/), and is running now.

Im waiting to hear back from macstadium as to what our options are with the failed image.

[ryanaslett]

The cert update appears to have worked, so only need to wait on the intel images to have service fully restored. MacStadium has responded and is forwarding this to the orka team.

[ryanaslett]

The firewall to our orka cluster was having issues, it has been fixed, and now the intel images are back up.

I re-ran a nightly build to verify that the intel images work, and it succeeded: https://ci-release.nodejs.org/job/iojs+release/nodes=osx13-x64-release-tar/10773/

The release machines should be able to release OSX now, and the certs are good for another two years.

[richardlau]

Thanks, @ryanaslett!