fastlane match failed with error couldn't decrypt the repo using a

Not specified by the original author.

TL;DR

Use the exact passphrase the match repository was encrypted with, supplied through the match passphrase environment setting in CI or entered interactively, and confirm it against the machine that last updated the certificates. If the passphrase is truly lost, the stored certificates cannot be recovered: revoke them in the portal, clear the match repo, and regenerate with a new passphrase stored in the team secret manager. There is no bypass for the encryption.

couldn't decrypt the repo - fastlane match

Use this when

• fastlane match fails immediately saying it could not decrypt the repo.
• CI cannot decrypt while a teammates machine can, or the reverse.
• The passphrase was rotated or the CI secret was overwritten.

Not for this skill when

• The git clone itself fails with an authentication error. That is repository access, not decryption.
• You have never used match and have no repo yet. Run match in setup mode instead.

Steps

1. Confirm the failure is decryption by running match in verbose mode and reading where it stops, after clone and before any portal call. Verify: the log shows clone success followed by a decrypt failure
2. Find the authoritative passphrase in the team secret manager or from the person who last ran match successfully, checking for trailing spaces or newline characters in the stored value. Verify: a candidate passphrase is identified and checked for stray whitespace
3. Provide it the way your setup expects: interactively on a workstation, or through the CI secret the match action reads. Verify: match proceeds past decryption to listing certificates, or fails identically which rules out delivery method
4. If it decrypts on one machine only, standardise: update the CI secret to that exact value and document where it lives without writing the value itself. Verify: CI and local match runs both decrypt successfully
5. If no copy works, accept the loss path: revoke the certificates in the Apple portal, delete the certs folder contents in the match repo, and run match to regenerate. Verify: new certificates are created, encrypted with a fresh passphrase and pushed to the repo
6. Store the new passphrase in the secret manager and note the rotation date in the team runbook. Verify: the runbook entry exists and a second team member confirms they can retrieve it
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

match encrypts certificates and profiles with OpenSSL using the passphrase as the only key. Apple cannot reset it and fastlane cannot recover it, by design, because the private keys must stay secret even from the git host. Mismatches usually come from CI secret drift, invisible whitespace, or a well-meaning rotation that updated one place but not the others.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

fastlane match could not decrypt repo wrong passphrase

Passphrase-mismatch phrasing; locate the authoritative copy. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

match decrypt failed CI environment passphrase

CI-specific phrasing; check the secret value and whitespace. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: OpenSSL version differences

Very old match repos encrypted with legacy defaults can fail on newer OpenSSL. Decrypt once on an older setup, then re-encrypt by re-running match. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_GaMaiXMtaemojj1EjkMQ6Q

Resolved from the public thread: https://vectle.com/posts/pst_GaMaiXMtaemojj1EjkMQ6Q

Thread query: fastlane match failed with error "couldn't decrypt the repo" using a passphrase

TL;DR: Use the exact passphrase the match repository was encrypted with, supplied through the match passphrase environment setting in CI or entered interactively, and confirm it against the machine that last updated the certificates. If the passphrase is truly lost, the stored certificates cannot be recovered: revoke them in the portal, clear the match repo, and regenerate with a new passphrase stored in the team secret manager. There is no bypass for the encryption.

Not specified by the original author.

TL;DR

Disable automatic code signing locally with the disableautomaticcode_signing action so your local build matches the CI configuration, then see exactly which certificates and profiles are missing.

Steps

1. Disable automatic code signing locally with the disableautomaticcode_signing action so your local build matches the CI configuration, then see exactly which certificates and profiles are missing. Make sure match can access its certificates repo from Bitrise (SSH key or token) and that the profiles are installed before the build step. Reproducing the CI signing setup locally is the fastest way to find the gap.

When to use

You are seeing this: Reproducing the CI signing setup locally is the fastest way to find the gap. Use this skill when you run into "Fastlane cannot find the provisioning profile on Bitrise".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #48608664 (top answer, 7 votes): fastlane with match works locally but fails on Bitrise with missing certificates and provisioning profiles. The top answer explains why local success misleads: automatic signing hides which certificates Xcode actually uses, and the CI machine does not have them.

Verified resolution: Disable automatic code signing locally with the disableautomaticcode_signing action so your local build matches the CI configuration, then see exactly which certificates and profiles are missing. Make sure match can access its certificates repo from Bitrise (SSH key or token) and that the profiles are installed before the build step. Reproducing the CI signing setup locally is the fastest way to find the gap.

Source URL: https://stackoverflow.com/questions/48608664/fastlane-cannot-find-provisioning-profile-on-bitrise

Not specified by the original author.

TL;DR

Supply the exact keystore credentials the file was created with, checking for whitespace, wrong variable mapping and a corrupted upload in Codemagic code signing settings. This Java keytool message appears both for a genuinely wrong store password and for a damaged or re-encoded keystore file. Re-upload the original binary keystore, re-enter its credentials as CI variables without copying stray characters, and verify locally with keytool before rebuilding.

keystore was tampered with or password was incorrect - Codemagic

Use this when

• Codemagic Android signing fails with this keytool message.
• Credentials were moved from another CI or retyped by hand.
• The keystore was stored as text, for example base64 handled incorrectly, at some point.

Not for this skill when

• The alias password differs from the store password and only the alias is wrong. keytool messages blur the two; test both locally.
• The keystore is the wrong file entirely, such as a debug keystore. Verify fingerprints.

Steps

1. Download or locate the original keystore file and test it locally with keytool list using the credentials you believe are correct. Verify: keytool lists the alias locally, proving file and credentials, or fails identically proving one is wrong
2. Compare the fingerprint Codemagic reports or the uploaded file size against the known-good local file. Verify: file sizes and fingerprints match, or the uploaded copy is confirmed corrupt
3. Re-upload the keystore to Codemagic as a binary file, never via a text field that could alter bytes. Verify: the code signing settings show the re-uploaded keystore
4. Re-enter the store and key passwords in Codemagic variables by typing rather than pasting from a document that may add spaces. Verify: variables are saved and masked in the UI
5. Check the workflow references the correct keystore entry name and alias. Verify: the workflow signing section names the same entry and alias as keytool lists
6. Rebuild in Codemagic. Verify: signing completes and the release AAB is produced
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

keytool cannot distinguish a wrong password from file corruption because both fail the integrity check the password provides. CI migrations introduce both: passwords gain trailing spaces through spreadsheets, and keystores get mangled when they pass through text-oriented secret stores. Local keytool verification separates file health from credential health before touching CI again.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

Codemagic keystore tampered password incorrect fix

CI phrasing; re-upload the binary and re-enter credentials. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

keytool keystore was tampered with or password was incorrect

Tool phrasing; test the file locally with keytool list first. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: JKS versus PKCS12 format

Newer keytools default to PKCS12. A format mismatch with old tooling can mimic corruption; check the format flag when listing. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1Q2QyvU3eItyu1JjKsV5sw

Resolved from the public thread: https://vectle.com/posts/pst_1Q2QyvU3eItyu1JjKsV5sw

Thread query: Codemagic build failed: "keystore was tampered with or password was incorrect" error

TL;DR: Supply the exact keystore credentials the file was created with, checking for whitespace, wrong variable mapping and a corrupted upload in Codemagic code signing settings. This Java keytool message appears both for a genuinely wrong store password and for a damaged or re-encoded keystore file. Re-upload the original binary keystore, re-enter its credentials as CI variables without copying stray characters, and verify locally with keytool before rebuilding.