ci: accept a Developer ID intermediate that the signing .p12 already added
Summary
Since a2380e75 / #21043 the signing .p12 import succeeds and adds the Developer ID G2 intermediate that the certificate carries. scripts/import-apple-developer-id-intermediates.sh then runs security add-certificates for the same certificate, which exits 1 with already in build.keychain. Every "Import signing cert" step fails: main nightly run 38857402565 on d16b03c6 failed on all 3 arches this way.
add_intermediate now treats only the already in result as success. Any other add-certificates error still fails, and the existing count check still requires both Developer ID intermediates in the keychain.
Verification
bash -npasses.- The real proof is the next signing run (nightly-next on this commit).
tests/test_signing_keychain_real_import.shuses a self-signed identity without the Apple intermediate, so it does not reproduce this case.
Changelog
none
![View with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v3.svg)
![Autofix with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg)
Need help on this PR? Tag @codesmith-bot with what you need.
Summary by cubic
Fixes the Apple Developer ID intermediate import step so CI signing no longer fails when the signing .p12 already carries the intermediate.
security add-certificatesnow treats only thealready inmessage as success, and only when the keychain holds the exact certificate (matching a valid SHA-1 fingerprint); any other error still exits 1.- The script still verifies both intermediates end up in the keychain.
Same change as #21143 (feat-cmux-next). Do not merge: Lawrence approval required for main merges. Main nightly and stable releases cannot sign until this lands.
Summary by CodeRabbit
- Bug Fixes
- Improved handling of certificate imports: verified existing certificates are recognized as duplicates, while invalid fingerprints and other import errors are reported and stop processing.