Build: Mac: Keep the signing-related keychain unlocked

[hoffie]

Short description of changes
This fixes hanging Mac build runs in CI which got stuck as they required interactive unlocking of the keychain.
This issue only became appareant after the switch to universal builds as that made the build take longer than the re-lock interval.

CHANGELOG: Build: Mac: Keep the signing-related keychain unlocked

Context: Fixes an issue?
Fixes: #2925

Does this change need documentation? What needs to be documented and how?
No.

Status of this Pull Request
The fix has already been committed and tested successfully on @emlynmac's repo where I've manually modified the r3_9_1 tag to do so.

What is missing until this pull request can be merged?
Reviews.
(CI on this PR must not file, but it being successful does not prove anything either ;))

Please merge once reviews are completed.

Checklist

• I've verified that this Pull Request follows the general code principles
• I tested my code and it does what I want
• My code follows the style guide
• I waited some time after this Pull Request was opened and all GitHub checks completed without errors.
• I've filled all the content above

AUTOBUILD: Please build all targets

[emlynmac]

Nice; LGTM

[ann0see]

@daryu maybe you experienced something like this too? Could you please comment?

[pljones]

One other comment: why did the build hang rather than fail? Do we know? Is that something that could have been prevented and made to fail with a useful error?

[pljones]

If it works, it works. Subject to my other comment that's out of scope for this hot fix.

[hoffie]

One other comment: why did the build hang rather than fail? Do we know? Is that something that could have been prevented and made to fail with a useful error?

As far as I have found, it's likely not a real hang, but rather waiting for activity in a graphical dialog box, which we'll never see in the CI which is only CI-based.

[pljones]

One other comment: why did the build hang rather than fail? Do we know? Is that something that could have been prevented and made to fail with a useful error?

As far as I have found, it's likely not a real hang, but rather waiting for activity in a graphical dialog box, which we'll never see in the CI which is only CI-based.

That's what I was guessing, too. Is there any way to prevent it, or a tool that better understands automated CI?

[hoffie]

That's what I was guessing, too. Is there any way to prevent it, or a tool that better understands automated CI?

I don't think so. The most official way seems to be Xcode, which is purely graphical. codesign is the fall back and is implicitly used by macdeployqt. It's probably not codesign itself which generates the dialog box, but rather the system keychain integration. I don't know of any other tool.
https://stackoverflow.com/questions/20205162/user-interaction-is-not-allowed-trying-to-sign-an-osx-app-using-codesign

[ann0see]

I remember suspecting something like that some time ago too. That was the Apple script invocation in create-dmg (GitHub fixed it on their side a while ago.)

[pljones]

I think this actually didn't make the 3.9.1 cut. This is just looking at the merges since the r3_9_1 tag.