Xcode Build via Jenkins

[Fisher, Allen]

Hi All--

I've been struggling with some issues over the last few days and hope you can help me. I am trying to get an iOS application building via Jenkins. Our source code is being managed in Perforce. We're using the P4 plugin and the Xcode plugin to try and get it building. Our Jenkins server is installed on Mac via the installer on the Jenkins site, so it's running through launchd.

I can build just fine from Xcode itself and I can run all the commands from the command line that Jenkins generates. However, when I try and allow Jenkins to build it, I get several errors:

Allowing Jenkins to unlock the keychain:

Started by user ha:AAAAjx+LCAAAAAAAAABb85aBtbiIQSajNKU4P08vOT+vOD8nVc+jsiC1KCczL9svvyT1dMUiOWdZ/mImBiZPBrac1Lz0kgwfBubSopwSBiGfrMSyRP2cxLx0/eCSosy8dOuKIgYpNOOcITTIMAYIYGRiYKgoADI4Sxj49UuLU4v0E/Py8ypz80uLARtlXCuUAAAAanonymous
Using master perforce client: AF_MobileProject_CI

<perforce stuff snipped>

Working directory is /Users/allen/Projects/Jenkins/MobileProject/Cocoa_Dev/MyAppDev/MyApp/MACPROJ.
[MACPROJ] $ /usr/bin/xcodebuild -version
Xcode 4.2.1
Build version 4D502
<version stuff snipped>
Cleaning up test-reports : /Users/allen/Projects/Jenkins/MobileProject/Cocoa_Dev/MyAppDev/MyApp/MACPROJ/test-reports
[MACPROJ] $ /usr/bin/security list-keychains -s /Library/Keychains/System.keychain
[MACPROJ] $ /usr/bin/security login-keychain -d user -s /Library/Keychains/System.keychain
[MACPROJ] $ /usr/bin/security unlock-keychain -p ******** /Library/Keychains/System.keychain
security: SecKeychainUnlock /Library/Keychains/System.keychain: The user name or passphrase you entered is not correct.
FATAL: Unable to unlock the keychain.
ha:AAAAWB+LCAAAAAAAAABb85aBtbiIQSmjNKU4P08vOT+vOD8nVc8DzHWtSE4tKMnMz/PLL0ldFVf2c+b/lb5MDAwVRQxSaBqcITRIIQMEMIIUFgAAckCEiWAAAAA=Build step 'XCode' marked build as failure
Finished: FAILURE

In an attempt to get it building, I turned off unlocking the keychain to let it prompt me:

<beginning stuff snipped>

Cleaning up test-reports : /Users/allen/Projects/Jenkins/FinMo/Cocoa_Dev/MyAppDev/MyApp/MACPROJ/test-reports
Going to invoke xcodebuild:target: MyAppGo, sdk: DEFAULT, project: /Users/allen/Projects/Jenkins/FinMo/Cocoa_Dev/MyAppDev/MyApp/MACPROJ/MyApp.xcodeproj, configuration: , clean: NO, symRoot: DEFAULT, configurationBuildDir: /Users/allen/Desktop/
[MACPROJ] $ /usr/bin/xcodebuild -target MyAppGo -project /Users/allen/Projects/Jenkins/FinMo/Cocoa_Dev/MyAppDev/MyApp/MACPROJ/MyApp.xcodeproj -configuration  build CONFIGURATION_BUILD_DIR=/Users/allen/Desktop/
Build settings from command line:
    CONFIGURATION_BUILD_DIR = /Users/allen/Desktop/

2012-01-19 13:39:53.670 xcodebuild[72650:a0b] [MT] IDELogStore: Failed to open Build log store: Error Domain=NSCocoaErrorDomain Code=257 "The file “Cache.db” couldn’t be opened because you don’t have permission to view it." UserInfo=0x4024f3180 {NSFilePath=/var/root/Library/Developer/Xcode/DerivedData/MyApp-ankgjozmpmrcwuejjwykmeibjorp/Logs/Build/Cache.db, NSUnderlyingError=0x4024f3200 "The operation couldn’t be completed. Permission denied"}. User info: {
    NSFilePath = "/var/root/Library/Developer/Xcode/DerivedData/MyApp-ankgjozmpmrcwuejjwykmeibjorp/Logs/Build/Cache.db";
    NSUnderlyingError = "Error Domain=NSPOSIXErrorDomain Code=13 \"The operation couldn\U2019t be completed. Permission denied\"";
}.
--- xcodebuild: WARNING: Configuration  is not in the project. Building default configuration.

=== BUILD NATIVE TARGET MyAppGo OF PROJECT MyApp WITH THE DEFAULT CONFIGURATION (Debug) ===
Check dependencies
[BEROR]Code Sign error: a valid provisioning profile matching the application's Identifier 'com.mycompany.MyApp' could not be found


** BUILD FAILED **


The following build commands failed:
	Check dependencies
(1 failure)
Build step 'XCode' marked build as failure
Finished: FAILURE

The provisioning file and all the other items the project need are available. I looked around the Internet and most folks suggested moving all the code signing stuff into the System keychain but that does not seem to be helping.

It's a permissions/user space problem, but I can't quite put my finger on it. Any ideas on where to look would be helpful.

Thanks for any help!

Allen

 

Allen Fisher

CI Engineer

afi...@makemusic.com

www.makemusic.com

[Arnaud Héritier]

Hi Allen,

On Fri, Jan 20, 2012 at 4:55 AM, Fisher, Allen <afi...@makemusic.com> wrote:

Hi All--

I've been struggling with some issues over the last few days and hope you can help me. I am trying to get an iOS application building via Jenkins. Our source code is being managed in Perforce. We're using the P4 plugin and the Xcode plugin to try and get it building. Our Jenkins server is installed on Mac via the installer on the Jenkins site, so it's running through launchd.

I can build just fine from Xcode itself and I can run all the commands from the command line that Jenkins generates. However, when I try and allow Jenkins to build it, I get several errors:

Allowing Jenkins to unlock the keychain:

Started by user ha:AAAAjx+LCAAAAAAAAABb85aBtbiIQSajNKU4P08vOT+vOD8nVc+jsiC1KCczL9svvyT1dMUiOWdZ/mImBiZPBrac1Lz0kgwfBubSopwSBiGfrMSyRP2cxLx0/eCSosy8dOuKIgYpNOOcITTIMAYIYGRiYKgoADI4Sxj49UuLU4v0E/Py8ypz80uLARtlXCuUAAAAanonymous
Using master perforce client: AF_MobileProject_CI

<perforce stuff snipped>

Working directory is /Users/allen/Projects/Jenkins/MobileProject/Cocoa_Dev/MyAppDev/MyApp/MACPROJ.
[MACPROJ] $ /usr/bin/xcodebuild -version
Xcode 4.2.1
Build version 4D502
<version stuff snipped>
Cleaning up test-reports : /Users/allen/Projects/Jenkins/MobileProject/Cocoa_Dev/MyAppDev/MyApp/MACPROJ/test-reports
[MACPROJ] $ /usr/bin/security list-keychains -s /Library/Keychains/System.keychain
[MACPROJ] $ /usr/bin/security login-keychain -d user -s /Library/Keychains/System.keychain
[MACPROJ] $ /usr/bin/security unlock-keychain -p ******** /Library/Keychains/System.keychain
security: SecKeychainUnlock /Library/Keychains/System.keychain: The user name or passphrase you entered is not correct.
FATAL: Unable to unlock the keychain.
ha:AAAAWB+LCAAAAAAAAABb85aBtbiIQSmjNKU4P08vOT+vOD8nVc8DzHWtSE4tKMnMz/PLL0ldFVf2c+b/lb5MDAwVRQxSaBqcITRIIQMEMIIUFgAAckCEiWAAAAA=Build step 'XCode' marked build as failure
Finished: FAILURE

I never tried to used the System keychain myself, I'm using a Login keychain of a macos account used by an SSH slave.

It may be a new bug or it could be related to this one that will be fixed in 1.3 : http://issues.jenkins-ci.org/browse/JENKINS-12217

I will probably release 1.3 today or tomorrow as several people are waiting for it but if you are interested I can give you a SNAPSHOT to validate that the new version is better.

 

In an attempt to get it building, I turned off unlocking the keychain to let it prompt me:

<beginning stuff snipped>

Cleaning up test-reports : /Users/allen/Projects/Jenkins/FinMo/Cocoa_Dev/MyAppDev/MyApp/MACPROJ/test-reports
Going to invoke xcodebuild:target: MyAppGo, sdk: DEFAULT, project: /Users/allen/Projects/Jenkins/FinMo/Cocoa_Dev/MyAppDev/MyApp/MACPROJ/MyApp.xcodeproj, configuration: , clean: NO, symRoot: DEFAULT, configurationBuildDir: /Users/allen/Desktop/
[MACPROJ] $ /usr/bin/xcodebuild -target MyAppGo -project /Users/allen/Projects/Jenkins/FinMo/Cocoa_Dev/MyAppDev/MyApp/MACPROJ/MyApp.xcodeproj -configuration  build CONFIGURATION_BUILD_DIR=/Users/allen/Desktop/
Build settings from command line:
    CONFIGURATION_BUILD_DIR = /Users/allen/Desktop/

2012-01-19 13:39:53.670 xcodebuild[72650:a0b] [MT] IDELogStore: Failed to open Build log store: Error Domain=NSCocoaErrorDomain Code=257 "The file “Cache.db” couldn’t be opened because you don’t have permission to view it." UserInfo=0x4024f3180 {NSFilePath=/var/root/Library/Developer/Xcode/DerivedData/MyApp-ankgjozmpmrcwuejjwykmeibjorp/Logs/Build/Cache.db, NSUnderlyingError=0x4024f3200 "The operation couldn’t be completed. Permission denied"}. User info: {
    NSFilePath = "/var/root/Library/Developer/Xcode/DerivedData/MyApp-ankgjozmpmrcwuejjwykmeibjorp/Logs/Build/Cache.db";
    NSUnderlyingError = "Error Domain=NSPOSIXErrorDomain Code=13 \"The operation couldn\U2019t be completed. Permission denied\"";
}.
--- xcodebuild: WARNING: Configuration  is not in the project. Building default configuration.

=== BUILD NATIVE TARGET MyAppGo OF PROJECT MyApp WITH THE DEFAULT CONFIGURATION (Debug) ===
Check dependencies
[BEROR]Code Sign error: a valid provisioning profile matching the application's Identifier 'com.mycompany.MyApp' could not be found


** BUILD FAILED **


The following build commands failed:
	Check dependencies
(1 failure)
Build step 'XCode' marked build as failure
Finished: FAILURE

The provisioning file and all the other items the project need are available. I looked around the Internet and most folks suggested moving all the code signing stuff into the System keychain but that does not seem to be helping.

It's a permissions/user space problem, but I can't quite put my finger on it. Any ideas on where to look would be helpful.

It seems to be another problem but I don't understand it.

You should open a new issue for it.

Perhaps this is because jenkins is started using launchd, it is a configuration I didn't test.

Could you download the war in your user account, launch it with "java -jar jenkins.war" and test if you have the same issue ? It may help to see if the issue is due to the Mac Installer.

cheers,

Arnaud

[Fisher, Allen]

Hi Arnaud--

Thanks for the help!

Running Jenkins as myself and not through launchd eliminated both the errors. I'm now getting a link error, which is much easier to figure out ;)

Should I open a ticket on the plug-in? When running under launchd, the user that Jenkins runs under is the daemon user.

Allen

[Arnaud Héritier]

yes please open a ticket with all details you gave here.

I will have to study this problems more deeply but it won't be before ~10 days.

I will try to find some fixes for the next version.

Right now, I'm release the version 1.3

cheers

Arnaud

[Fisher, Allen]

Thanks Arnaud!

No rush, as long as I can work around it. I'll be happy to test a fix when you have one. I'm writing up this issue plus a feature request.

Allen

[Sami Tikka]

Some of the problems are probably due to launchd running Jenkins as
user "daemon".

In OS X, the user "daemon" comes with the system, so it is easy to
use. The problem is, the home directory of daemon is /var/root, which
is a root-owned directory where daemon has no write permission.

The upcoming 1.449 installer for Mac OS X will have an option for
creating a new user called "jenkins" and using /Users/Shared/Jenkins
as the home directory (the directory and the files will be chowned to
to jenkins). The home will be writable and this should help with some
problems Jenkins users on OS X have been having.

To take the above into use, you have to choose a custom installation,
uncheck the box titled "Start at boot as user daemon" and check the
box titled "Start at boot as user jenkins".

If you cannot wait until 1.449 comes out, you can create the package
yourself by cloning the Jenkins git repository, then:

cd osx && ./build.sh /Applications/Jenkins/jenkins.war && open jenkins*.pkg

-- Sami

2012/1/22 Fisher, Allen <afi...@makemusic.com>:

[Arnaud Héritier]

Really interesting feedback Sami,

  I agree with your analyze. Allen can you test the new installer which was just release with the option using a dedicated account and let us know if it fixes your problem (partially or totally)

  Thx

cheers,

[Fisher, Allen]

I just realized I had not responded to this. I did have a look at that installer when it came out. That actually works quite well for my private stuff. It doesn’t quite work in our Active Directory environment at work, we need to run as a specific network user that’s been set up and is used in our new hotness (Jenkins) and our old legacy stuff.

 

The way we’ve worked around it here is that we ended up taking the launchd plist file that the installer creates and modify it to use the user we want to use, so it’s win all around. J

 

-          A