[build-tools] Fix iOS local build on macOS Tahoe — drop -v from find-identity in findIdentitiesByTeamId

CHANGELOG.md

@@ -10,6 +10,8 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🐛 Bug fixes
 
+- [build-tools] Fix `eas build --local` for iOS on macOS 26 (Tahoe) where `Keychain.findIdentitiesByTeamId` falsely reported the dist certificate as not imported. The `-v` flag on `security find-identity` requires the full trust chain to resolve from the build keychain alone, but the build keychain only holds the cert + private key — Apple Root CA lives in `/Library/Keychains/System.keychain` and `find-identity` does not aggregate trust resolution across keychains. Dropped `-v`; presence check now works across macOS versions and codesign continues to resolve trust downstream via `Security.framework`. ([#3679](https://github.com/expo/eas-cli/pull/3679) by [@kearnsm293-afk](https://github.com/kearnsm293-afk))
+
 ### 🧹 Chores
 
 ## [18.11.0](https://github.com/expo/eas-cli/releases/tag/v18.11.0) - 2026-05-05

packages/build-tools/src/ios/credentials/keychain.ts

@@ -97,9 +97,23 @@ export default class Keychain<TJob extends Ios.Job> {
   }
 
   private async findIdentitiesByTeamId(teamId: string): Promise<string> {
+    // Note: no `-v` flag. `-v` ("valid identities only") requires the full
+    // trust chain (dist cert -> Apple WWDR Intermediate -> Apple Root CA) to
+    // resolve from the keychain(s) in the search list. The build keychain
+    // created above only holds the dist cert + private key; Apple Root CA
+    // lives in /Library/Keychains/System.keychain. `security find-identity`
+    // does not aggregate trust resolution across keychains passed as
+    // positional args (only `security list-keychains -s` does, and that's
+    // session-wide and undesirable). On macOS 26 (Tahoe), this caused
+    // `find-identity -v -s "(<teamId>)" <buildKeychainPath>` to return 0
+    // identities even when the cert+key were correctly imported, falsely
+    // tripping `ensureCertificateImported`. Without `-v`, the presence
+    // check works correctly across macOS versions; codesign performs its
+    // own trust resolution downstream via Security.framework (which does
+    // aggregate across keychains), so signing still succeeds.
     const { output } = await spawn(
       'security',
-      ['find-identity', '-v', '-s', `(${teamId})`, this.keychainPath],
+      ['find-identity', '-s', `(${teamId})`, this.keychainPath],
       {
         stdio: 'pipe',
       }