ios build items

cert_key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDXSY0NV/huB138
+Gm+K5Wf1qGcGPcNxDzMspPyocljXbv0r+gnirNQL1DoEo/AgPHqHcHvB//HE8eEv
+EFYtznjcmI4UvMeXNeUAa0yxl02kb4YrnvhfNU86c+AYpvWGnRpkNNlSZa06Nlmz
+rFElFouRGgd58M9dgcsQqgwnfCSZmg5dhI2kwE8PKGvcfAzxmsvrpoiqRVx31mrd
+3mVXI0PkzpbHT3cnIMF2H/dZ9UNeAS7Ri2AfYj3KR3HG7pQB6mlLp0jEc6Kdvrlf
+X/KhbV+ESqZlRCPWp4AJbDvcPdbMt8M6Gq39eGAB3h3qmj3lE8f5TFc9qR8lV0Ui
+J+FhpjL7AgMBAAECggEAGTGw0ZZxasLu80FOu2T0YRHHmLnipNkABqH6NWZIUlHZ
+S+uze3T5TbcU4RUkVUlul2oI+Z+PthoOXbkeNLcceshZnECpZN84QO/NplzMB8nL
+XFB6xX2SG4eS+p+TTSEWhRKQOi3O82iH39hzGJGGXME8jb8qLUmyr20PBhHnoJfp
+Rp3XRS6VUuZCFHHONsqjlmc1sKtCM8xfIS+u/hWtyB1bOeXyKaHkC+YyZZvMWd2C
+fo682Nb26T4YCh+V3RW4M5W/rNuuKi89gARgkAU1ePcfsmzdmoRBJtjfh7G1zZIH
+dKY51nwS902PODchzP5DVrWgaA2VY14B7qrxNio8+QKBgQD0zVtfdZEgnYobBe/3
+3gfRbN6WF9fxX3KWfjtzZnOFHJrWTU7KMOv0oySY6F03jqaYodNu13o16Kxjn7/x
+i82l8VYfE6MGwEw06bdMzQyjSqCvgpuDdqYMtjritqVMK1aoBRpE4T7C2aHDrZjG
+YHokjMKmJr8iCmAkXtfgR5RxQwKBgQDhIpLlN5WBJAr/lj8WpFw9s89wIYqcz7Rs
+7iM26Kt6KWnuZcTs3PhPug5vY9oavdnqWWavQTQX1FqkIlrP5rJkNmtsZR2/M4Bh
+VhpiSmndWRqL1l+GiytebSTiofDyIRN/0m1tPgHsOCgbfkzJNXTcQKmQls5NhFRc
+tKnQf5wf6QKBgQDs1qUZNNhEssYDoPnqV9A+iFLM6aKNLqfg+52u5ybKWMNgpAif
+SzdtRk1I9j4BWyzIrH+vVB8zerkV5V9BZN2AN333sPrftDnGU3t4fUVF0hSl2Pl1
+9dtunvtXjhdcGu3Kvq0MiNM8lmuPsisFeh+RrvE+6GuwllMvvOakYPw3mwKBgQCU
+HRbfTk5Bg+DofYRL9R3qSh2y+54hxFRDRfhM643E9PIIMVP5MPb8HL/acKrQ5Q40
+q1RvAEqxUre/PAratD+wxkyuJ2gGnm9bmjYJbENxqGlajlKSRYTmvo+BumC2KySU
+92+eaykAq4FXdSQ3S7/yF2h3A3/+Z4zI4OLHlOy14QKBgGDhf7bGCWFGuldQFD09
+I0Li3u6slsEFgnCHEDeugaeRgk+OHtm66Jmcbi2Y/y8TXp5IgM+HnvFUZU7A5y9R
+qJAwaFx3J4P9uAn2z8a/oRifCRBJo2nOvaEPAYzUFmahusQZhjhf3E1BbOlR7KMB
+FLVULWzBXQpgxs8HBnW6V3Gt
+-----END PRIVATE KEY-----

codemagic.yaml

@@ -92,13 +92,19 @@ workflows:
     environment:
       flutter: 3.44.8
       java: 17
-      # NOTE: intentionally NO `ios_signing` block. That block triggers
-      # Codemagic's *automatic* signing during build initialization, which only
-      # FETCHES existing certs/profiles and fails the build up front ("No
-      # matching profiles found") on a fresh account that has none yet. Instead
-      # we sign fully manually in the scripts below, where we can create the
-      # cert + profile on first run. The `integrations.app_store_connect` above
-      # still injects the ASC API-key env vars the app-store-connect CLI uses.
+      # Reference the signing files you created in Codemagic (Teams → Code
+      # signing identities). Codemagic fetches them by reference name at build
+      # init and sets up the keychain automatically — no keychain/fetch scripts
+      # and no App-ID auto-fetch (which fails when nothing exists yet).
+      #   certificates:         the distribution cert you generated ("troglodyte-timbre")
+      #   provisioning_profiles: an App Store profile for com.troglodyte.timbre —
+      #     generate it in the same UI (Code signing identities → Profiles) and
+      #     put its reference name below.
+      ios_signing:
+        certificates:
+          - troglodyte-timbre
+        provisioning_profiles:
+          - troglodyte-profile
       vars:
         # The app's numeric Apple ID (App Store Connect → your app → App
         # Information → General → Apple ID). Used to auto-bump the build number
@@ -115,26 +121,11 @@ workflows:
       - *get_deps
       - *analyze
       - *unit_tests
-      - name: Initialize keychain
-        # Manual signing: create the build keychain ourselves (the removed
-        # ios_signing block used to do this automatically).
-        script: keychain initialize
-      - name: Fetch signing files
-        # fetch-signing-files --create mints the Apple Distribution cert + the
-        # App Store provisioning profile via the ASC API key and downloads them.
-        # --create also registers the Bundle ID if it isn't already. On the
-        # first build this creates everything; later builds reuse it.
-        script: |
-          app-store-connect fetch-signing-files "com.troglodyte.timbre" \
-            --type IOS_APP_STORE \
-            --create
-      - name: Add certificates to keychain
-        # Load the freshly fetched distribution cert into the build keychain.
-        script: keychain add-certificates
       - name: Set up code signing
-        # Applies the profile to the Xcode project and writes
-        # ~/export_options.plist (= /Users/builder/export_options.plist) that
-        # the build step reads.
+        # The cert + profile referenced in ios_signing above are already fetched
+        # and in the keychain by now. This just applies the profile to the Xcode
+        # project and writes ~/export_options.plist (= /Users/builder/
+        # export_options.plist) that the build step reads.
         script: xcode-project use-profiles
       - name: Build signed IPA
         script: |