Open Radar

 
Summary:

Xcode's CODE_SIGN_IDENTITY build setting should match codesign's search options, supporting identity preference and hash-based lookups to resolve ambiguous matches. Currently it only searches the certificate common names and fails if multiple matches are found.

Steps to Reproduce:

1. Add a code signing certificate to the default keychain named "3rd Party Mac Developer Application: CompanyX".
2. Add a second code signing certificate named "CompanyX".
3. In an Xcode target set CODE_SIGN_IDENTITY to "CompanyX".
4. Attempt to build the target, receive an "ambiguous matches" error.
5. In Keychain Access create an identity preference for the CompanyX certificate named "CompanyX Direct Code Signing".
6. Set CODE_SIGN_IDENTITY to the name of the identity preference.
7. Attempt to build the target.
8. Set CODE_SIGN_IDENTITY to the SHA-1 hash of the "CompanyX" certificate.
9. Attempt to build the target.

Expected Results:

The last two build attempts result in a successfully signed binary.

Actual Results:

Both build attempts fail at the Check Dependencies phase with "Code Sign error: The identity 'x' doesn't match any valid certificate/private key pair in the default keychain".