19

So the background is this: I have an Xcode project that depends on a swift package that's in a private repository on github. Of course, this requires a key to access. So far, I've managed to configure CI such that I can ssh into the instance and git clone the required repository for the swift package. Unfortunately when running it with xcbuild as CI does, it doesn't work and I get this message:

static:ios distiller$ xcodebuild -showBuildSettings -workspace ./Project.xcworkspace \
    -scheme App\ Prod
Resolve Package Graph
Fetching git@github.com:company-uk/ProjectDependency.git
xcodebuild: error: Could not resolve package dependencies:
  Authentication failed because the credentials were rejected

In contrast, git clone will happily fetch this repo as seen here:

static:ios distiller$ git clone git@github.com:company-uk/ProjectDependency.git
Cloning into 'ProjectDependency'...
Warning: Permanently added the RSA host key for IP address '11.22.33.44' to the list of known hosts.
remote: Enumerating objects: 263, done.
remote: Counting objects: 100% (263/263), done.
remote: Compressing objects: 100% (171/171), done.
remote: Total 1335 (delta 165), reused 174 (delta 86), pack-reused 1072
Receiving objects: 100% (1335/1335), 1.11 MiB | 5.67 MiB/s, done.
Resolving deltas: 100% (681/681), done.

For a bit more context, this is running on CircleCI, set up with a Deploy key on GitHub, which has been added to the Job on CI.

Any suggestions about what might be different between the way Xcode tries to fetch dependencies and the way vanilla git does it would be great. Thanks.

2
  • 1
    I am currently having the same issue with GitHub Actions as my CI
    – bscothern
    Dec 2, 2019 at 22:04
  • 1
    Not an answer, but sometimes in the past (especially Xcode 10), the git authentication details had a tendency to disappear for no reasons (ok at start up, then pooof). Xcode 11 solves that.
    – Alex
    Dec 4, 2019 at 10:43

6 Answers 6

12

For CI pipelines where you cannot sign into GitHub or other repository hosts this is the solution I found that bypasses the restrictions/bugs of Xcode around private Swift packages.

Use https urls for the private dependencies because the ssh config is currently ignored by xcodebuild even though the documentation says otherwise.

Once you can build locally with https go to your repository host and create a personal access token (PAT). For GitHub instructions are found here.

With your CI system add this PAT as a secret environment variable. In the script below it is referred to as GITHUB_PAT.

Then in your CI pipeline before you run xcodebuild make sure you run an appropriately modified version of this bash script:

for FILE in $(grep -Ril "https://github.com/[org_name]" .); do
    sed -i '' "s/https:\/\/github.com\/[org_name]/https:\/\/${GITHUB_PAT}@github.com\/[org_name]/g" ${FILE}
done

This script will find all https references and inject the PAT into it so it can be used without a password.

Don't forget:

  • Replace [org_name] with your organization name.
  • Replace ${GITHUB_PAT} with the name of your CI Secret if you named it differently.
  • Configure the grep command to ignore any paths you don't want modified by the script.
3
  • 3
    yes yes yes! This works for me when nothing did! 2 days fighting this issue! Maybe it'll be a matter of time until Xcode works with SSH but for now this workaround has to be done. May 9, 2020 at 13:52
  • 2
    Sir, I couldn't thank you enough. This is Absolutely splendid !
    – sachadso
    Oct 7, 2020 at 19:59
  • 2
    I had an issue with the bash script, where sed would report the error "No such file or directory" and my CI tool (VS AppCenter) would fail to build. So I added a check for FILE if it does not exists do not execute the sed command. Dec 10, 2020 at 18:21
7
+50

This seems to be a bug in Xcode 11 with SSH. Switching to HTTPS for resolving Swift Packages fixes the issue:

So from this:

E29801192303068A00018344 /* XCRemoteSwiftPackageReference "ProjectDependency" */ = {
        isa = XCRemoteSwiftPackageReference;
        repositoryURL = "git@github.com:company-uk/ProjectDependency.git";
        requirement = {
                branch = "debug";
                kind = branch;
        };
};

to:

E29801192303068A00018344 /* XCRemoteSwiftPackageReference "ProjectDependency" */ = {
        isa = XCRemoteSwiftPackageReference;
        repositoryURL = "https://github.com/company-uk/ProjectDependency.git";
        requirement = {
                branch = "debug";
                kind = branch;
        };
};

Also, now that Xcode 12 is out, you can use that, where it's fixed.

3
  • 4
    This works for local builds but not CI machines where you can't sign Xcode into anything. This always results in this error from Xcode: xcodebuild: error: Could not resolve package dependencies: Authentication failed because no credentials were provided. My experience has been that the SSH version works if your ssh key is configured correctly in ~/.ssh and GitHub. As long as you are also signed into GitHub in Xcode.
    – bscothern
    Dec 4, 2019 at 17:08
  • 1
    This is working for me on CI; I'm not in the office until Monday so can't investigate how, but it is definitely doing the job.
    – ratbum
    Dec 4, 2019 at 21:16
  • 1
    @ratbum how did you configure your CI so that xcodebuild can checkout this dependency? You would have to somehow tell xcodebuild which credentials to use
    – JonEasy
    Mar 13, 2021 at 13:26
2

In order to get private swift packages working with GitHub actions I had to add the following:

  1. I had to add an SSH key to my secrets
  2. On the xcodebuild step, I had to add the flag: -usePackageSupportBuiltinSCM
  3. right before executing the xcodebuild step, I had to add the following run script:
 - name: Add CI SSH Key
   run: ssh-add - <<< "${{ secrets.YOUR_SECRET_SSH_KEY }}"
4
  • 1
    Hi there! Do you perhaps know how to use -usePackageSupportBuiltinSCM with fastlane? Seems that, when triggered, there's a SPM dependency resolvency phase that uses xcodebuild, but it disregards any xcargs set in the Fastfile. xcodebuild -resolvePackageDependencies -workspace ./App.xcworkspace -scheme App
    – D6mi
    Mar 18, 2021 at 14:02
  • 1
    @D6mi Same point here with fastlane and usePackageSupportBuiltinSCM, did you solved it? Apr 15, 2021 at 11:05
  • 1
    @kikeenrique, I did solve this issue, but I really don't recall how. I checked my fastlane configuration files, it's a straightforward build_app call :/
    – D6mi
    Apr 16, 2021 at 12:07
  • 1
    @D6mi Thanks! I see in the doc "use_system_scm", different name but looks like it. Apr 16, 2021 at 18:38
2

You can resolve this issue in a CI environment with Xcode 12 by adding your GitHub account to Accounts within Xcode.

Sign in with your GitHub account name and a personal access token you created on Github.

We are using Jenkins with Fastlane tools and when xcodebuild is invoked, it will use the access token to authenticate into the repos using HTTPS.

enter image description here

1

I had the same issue, the root cause for me is: the default github ssh key type is ed25519 ssh-keygen -t ed25519 -C "your_email@example.com".

But XCode doesn't support ed25519. Changed to RSA key works: ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent

You can see the error under XCode Preference > Accounts > Github

enter image description here

1

I was able to build with a package from a private repo in GitHub actions with HTTPS URLs by creating a .netrc file using the extractions/netrc@v1 action.

  Build:
    runs-on: macos-12
    steps:
      - uses: actions/checkout@v3
      - uses: extractions/netrc@v1
        with:
          machine: github.com
          username: user
          password: ${{ secrets.SWIFT_PACKAGE_MANAGER_PAT }}
      - uses: extractions/netrc@v1
        with:
          machine: api.github.com
          username: user
          password: ${{ secrets.SWIFT_PACKAGE_MANAGER_PAT }}

After this, xcodebuild will use the PAT when accessing the private repo.

I tried to use GITHUB_TOKEN, but it seems that it is restricted to the current repo only. So I created a PAT for my GitHub account and added that to the repo secrets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.