iOS cloud builds failing on Tahoe builders: "Distribution certificate hasn't been imported successfully"

[Fikpeze123]

Build/Submit details page URL

https://expo.dev/accounts/fikpeze123/projects/pactlyst/builds/dc72e010-2c0a-45c5-baa2-b13b6151f6f5

Summary

iOS cloud builds are failing during the "Prepare credentials" phase with the error "Distribution certificate with fingerprint X hasn't been imported successfully", even though the certificate, private key, and provisioning profile are all valid.

This appears to be the same root cause as #3678 and #3645, but affecting cloud builds (not just --local). Those issues noted "Cloud builds (without --local) work fine" — that is no longer true.

Failing builds:

• https://expo.dev/accounts/fikpeze123/projects/pactlyst/builds/dc72e010-2c0a-45c5-baa2-b13b6151f6f5
• https://expo.dev/accounts/fikpeze123/projects/pactlyst/builds/6ee4af2e-f2d6-46e7-a92b-f786d09974b1
• https://expo.dev/accounts/fikpeze123/projects/pactlyst/builds/1f2a277b-721a-4c6a-a8ff-3c9381e37119
• https://expo.dev/accounts/fikpeze123/projects/pactlyst/builds/92c210ff-3805-457d-867a-027dc716c542

Builder: macos-tahoe-26.5-xcode-26.6 running macOS Tahoe 26.5.2, Xcode 26.6. All four builds fail at the same step with UNKNOWN_ERROR / "See logs of the Prepare credentials build phase".

Managed or bare?

Not project-dependent — the failure occurs in the cloud builder's "Prepare credentials" phase before any project code is touched.

Environment

This is a cloud-builder issue (not a local environment problem), so npx expo-env-info / npx expo-doctor output isn't applicable.

Builder image: macos-tahoe-26.5-xcode-26.6

• OS: macOS Tahoe 26.5.2
• Xcode: 26.6

Error output

Log excerpt (identical across all 4 builds):

[PREPARE_CREDENTIALS] Creating keychain
[PREPARE_CREDENTIALS] Preparing credentials for target 'Pactlyst'
[PREPARE_CREDENTIALS] Getting distribution certificate fingerprint and common name
[PREPARE_CREDENTIALS] Fingerprint = "3ACF427EEAF9392D5DFDFD996386C6A971EB3752", common name = iPhone Distribution: Frank Ikpeze (Q7J8HFTQ5B)
[PREPARE_CREDENTIALS] Writing distribution certificate to /var/.../....p12
[PREPARE_CREDENTIALS] Importing distribution certificate into the keychain
[PREPARE_CREDENTIALS] Initializing provisioning profile
[PREPARE_CREDENTIALS] Validating whether the distribution certificate has been imported successfully
[PREPARE_CREDENTIALS] Destroying keychain - /var/.../eas-build-....keychain

Note: it never reaches "Verifying whether the distribution certificate and provisioning profile match" (which successful builds log next).

What was verified:

• Distribution certificate is valid (Apple-issued, expires Sep 2027, fingerprint matches)
• Private key modulus matches the certificate
• Provisioning profile's embedded certificate matches
• The .p12 stored on Expo's servers is byte-identical to the valid local file and decrypts with the stored password
• Tried: re-uploading .p12 with fresh password, and re-uploading .p12 bundled with Apple WWDR G3 intermediate — same failure

Reproducible demo or steps to reproduce from a blank project

Steps to reproduce:

1. Configure a valid Apple distribution certificate (.p12) and provisioning profile for an iOS project
2. Run eas build --platform ios (cloud build, no --local)
3. The build fails in the "Prepare credentials" phase with UNKNOWN_ERROR / "See logs of the Prepare credentials build phase", and the logs end at "Validating whether the distribution certificate has been imported successfully"

Root cause hypothesis:
Per #3678: on macOS Tahoe, security find-identity -v (used by findIdentitiesByTeamId in @expo/build-tools) falsely fails against the ephemeral build keychain because it lacks the full Apple trust chain for the -v validity check. The cert+key import succeeds, but the validation incorrectly reports failure. Since EAS cloud builders are now on Tahoe 26.5.2, this previously local-only bug now breaks cloud builds.

Expected:
Either the builder image should include the WWDR intermediates with proper trust, or @expo/build-tools should not rely on find-identity -v for the import validation on Tahoe.