Verifying APP_STORE_CONNECT_PRIVATE_KEY content... 0

[EdilsonBaggio]

If you are looking for help, please confirm the following...

• I confirm I have searched the Docs, Codemagic Sample Projects, and GitHub Discussions.
• I confirm the software versions on my local computer match the ones in CI environment (e.g. Xcode version, Gradle version). See here
• I confirm I am able to do a fresh clone of the repository and build the project on my local computer.

Which mobile framework are you using?

iOS (Swift, Objective-C)

Steps to reproduce

Dear Codemagic Support Team,

I am experiencing a persistent issue when trying to publish my iOS application to App Store Connect (TestFlight) using Codemagic. It appears that the APP_STORE_CONNECT_PRIVATE_KEY environment variable is either empty or not being loaded correctly in the build environment.

The Error I am receiving is:

app-store-connect publish: error: argument --private-key: Provided value in environment variable "APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY" is not valid. Provided value is not a valid PEM encoded private key

Failed to publish App.ipa to App Store Connect.

Build failed :|

Publishing failed :|
Failed to publish App.ipa to App Store Connect.

(Note: The error message above refers to the original variable name. I have since corrected the variable name in my configuration, but the underlying issue persists.)

Diagnosis and Troubleshooting Steps Taken:

To diagnose the root cause, I added a debugging script to my codemagic.yaml to verify the content of the APP_STORE_CONNECT_PRIVATE_KEY variable.

The output of echo -n "$APP_STORE_CONNECT_PRIVATE_KEY" | wc -c in the build log is consistently 0 (zero).

This indicates that, within the script execution environment, the $APP_STORE_CONNECT_PRIVATE_KEY variable is effectively empty, which explains the "invalid PEM private key" error during the publishing step.

Actions I have already taken to try and resolve the problem (in chronological order):

1. codemagic.yaml Verification and Adjustment:

   • Initially, there was an inconsistency in variable names within codemagic.yaml (APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY vs APP_STORE_CONNECT_PRIVATE_KEY). This has been corrected to consistently use APP_STORE_CONNECT_PRIVATE_KEY throughout the file, both in the environment: vars section and the publishing: app_store_connect section.
   • Crucially: Following your documentation/best practices, I removed the self-referencing line for the private key from the environment: vars section (APP_STORE_CONNECT_PRIVATE_KEY: $APP_STORE_CONNECT_PRIVATE_KEY) to ensure the variable is pulled directly from the Codemagic UI. The variable is no longer redefined in this section.

2. Environment Variable Configuration in Codemagic UI:

   • I navigated to the "Environment variables" section of my application in the Codemagic UI.
   • I created/edited the variable with the EXACT name APP_STORE_CONNECT_PRIVATE_KEY.
   • I set the Type to "Secure text".
   • I copied the complete and raw content of my .p8 file (including -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----) and pasted it into the "Value" field. I took extreme care to ensure no extra spaces, accidental line breaks (other than those inherent in the .p8 file), or any other invisible characters were present before or after the key content.

3. App Store Connect API Key Regeneration:

   • To rule out any key corruption, I revoked the previously used API key in App Store Connect.
   • I generated a new API key in App Store Connect and downloaded the new .p8 file.
   • I then updated the content of the APP_STORE_CONNECT_PRIVATE_KEY variable in the Codemagic UI with the content of this new .p8 file.
   • I also updated the APP_STORE_CONNECT_KEY_ID and APP_STORE_CONNECT_ISSUER_ID variables with the information from the new key.

Despite all these steps and thorough checks, the wc -c output for the APP_STORE_CONNECT_PRIVATE_KEY variable consistently returns 0, and the "invalid PEM private key" error during publishing persists.

Could you please investigate why this "Secure text" variable appears to be empty in the build environment? It seems to be an issue with how Codemagic is loading or providing this specific variable to the workflow.

Thank you for your attention to this matter. I look forward to your prompt response and possible solutions.

Sincerely,

Edilson Santos
[email protected]

Expected results

I want successfully uploaded to Apple, processed, and made available for testing on TestFlight**, without any private key or publishing errors.

Actual results

app-store-connect publish: error: argument --private-key: Provided value in environment variable "APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY" is not valid. Provided value is not a valid PEM encoded private key

Failed to publish App.ipa to App Store Connect.

Build failed :|

Publishing failed :|
Failed to publish App.ipa to App Store Connect.

Build id (optional)

685462c7ff047b06b21a1701

[dam-ease]

Hello @EdilsonBaggio,
Can you please confirm that you are defining the group in which the environment variable is stored in your codemagic.yaml file?
For instance if I add environment variables to a group named "secrets" as shown below,

Then I also need to define it in my YAML as below:

You can also find more details about setting this up in this section of the docs - https://docs.codemagic.io/yaml-publishing/app-store-connect/#setting-up-publishing-to-app-store-connect

[EdilsonBaggio]

I am defining it this way

environment:
ios_signing:
distribution_type: app_store
bundle_identifier: $BUNDLE_ID
vars:
APPLE_APP_ID: "br.com.exemplo.loja"
BUNDLE_ID: "br.com.exemplo.loja"
XCODE_WORKSPACE: "ios/App/App.xcworkspace"
XCODE_SCHEME: "App"
APP_VERSION: "1.7.0"
BUILD_NUMBER: "42"
APP_STORE_CONNECT_KEY_ID: $APP_STORE_CONNECT_KEY_ID
APP_STORE_CONNECT_ISSUER_ID: $APP_STORE_CONNECT_ISSUER_ID
RAW_PRIVATE_KEY: $APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY # Temporário

  xcode: latest
  cocoapods: default
  node: 18

[dam-ease]

Please add the group name as well as in my previous comment

[EdilsonBaggio]

I made the adjustment according to your comment, calling the groups.

But another problem returned.

== Gathering artifacts ==

== Publishing artifacts ==

Publishing artifact App.ipa
Publishing App.ipa to App Store Connect

app-store-connect publish --path /Users/builder/clone/build/IPA/App.ipa --key-id ******** --issuer-id ******** --private-key @env:APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY

Publish "/Users/builder/clone/build/IPA/App.ipa" to App Store Connect
App name: App
Bundle identifier: br.com.example.loja
Certificate expires: 2026-06-11T20:28:57.000+0000
Distribution type: App Store
Min OS version: 13.0
Provisioned devices: N/A
Provisions all devices: No
Supported platforms: iPhoneOS
Version code: 42
Version: 1.7.0

Upload "/Users/builder/clone/build/IPA/App.ipa" to App Store Connect
Running altool at path '/Applications/Xcode-16.3.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Frameworks/AppStoreService.framework/Support/altool'...
Running altool at path '/Applications/Xcode-16.3.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Frameworks/AppStoreService.framework/Support/altool'...
{"tool-version":"8.303.16303","tool-path":"/Applications/Xcode-16.3.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/Frameworks/AppStoreService.framework","os-version":"15.4.0","product-errors":[{"message":"Unable to upload archive.","userInfo":{"NSLocalizedDescription":"Unable to upload archive.","NSLocalizedFailureReason":"Failed to authenticate for session: (\n "Error Domain=ITunesConnectionAuthenticationErrorDomain Code=-26000 \"Failure to authenticate.\" UserInfo={NSLocalizedRecoverySuggestion=Failure to authenticate., NSLocalizedDescription=Failure to authenticate., NSLocalizedFailureReason=App Store operation failed.}"\n)"},"code":-1011}]}

Failed to upload archive at "/Users/builder/clone/build/IPA/App.ipa"
Failed to publish /Users/builder/clone/build/IPA/App.ipa

Failed to publish App.ipa to App Store Connect.

Build failed :|

Publishing failed :|
Failed to publish App.ipa to App Store Connect.

It looks like it's at the end of the yaml

app_store_connect:
api_key: $APP_STORE_CONNECT_PUBLISHER_PRIVATE_KEY
key_id: $APP_STORE_CONNECT_KEY_ID
issuer_id: $APP_STORE_CONNECT_ISSUER_ID
submit_to_testflight: true
beta_groups:
- Interno

This part makes the publication in testFlight do I need to define the "groups" in it too?
Please if you can help me with this.

[EdilsonBaggio]

I did it, thanks!