2026 Shared Remote Mac Matrix: Fastlane Match Concurrent Pulls, Keychain Partitions, and Codesign Queue Timeouts

Start on the homepage, pick access with the SSH versus VNC selection guide, and align accounts with the shared build permission FAQ before you touch Match on a pooled host.

Three pains on one shared remote Mac

1. Concurrent Match pulls. Two lanes run match development and corrupt the encrypted git repo mid-push.
2. Keychain bleed. Distribution certs import into the interactive login keychain while SSH jobs expect a lane file.
3. Silent queue hangs. Codesign waits forever because flock wait exceeds job timeout and nobody logs lock holders.

Decision matrix: lane layout vs blast radius

Match git concurrency and shallow clone strategy

Treat the certificates repo like production data. Reads can overlap; writes cannot.

• Shallow clone: git clone --depth 1 on CI workers; refresh with git fetch --depth 1 origin branch before Match.
• Read concurrency: allow parallel match readonly or development fetch when no write lock is held.
• Write serialization: wrap match development, match appstore, and nuke behind one repo lock file.

MATCH_GIT_URL=git@github.com:org/certificates.git
export GIT_SSH_COMMAND="ssh -o ControlMaster=auto -o ControlPath=/tmp/ssh-%r@%h:%p"
flock -w 180 /var/run/meshmac/match-repo.lock \
  fastlane match development --readonly false

Login keychain partitions for headless signing

SSH user isolation does not replace signing partitions. Cross-check the Xcode Codesign queue matrix when you add archive steps.

• Lane file: /srv/keychains/team-a-ci.keychain-db per app or tenant.
• Unlock window: security unlock-keychain -p "$KEYCHAIN_PASS" only inside the Codesign wrapper.
• Partition list: set MATCH_KEYCHAIN_NAME and MATCH_KEYCHAIN_PASSWORD in lane env, never in the shared login keychain.

security list-keychains -s "$LANE_KEYCHAIN" login.keychain-db
security set-keychain-settings -lut 21600 "$LANE_KEYCHAIN"
security find-identity -v -p codesigning "$LANE_KEYCHAIN"

Build locks, flock waits, and Codesign queue timeouts

Copy these defaults into your runbook, then tune from lock-wait percentiles on real builds.

Failure retries, audit fields, and operator signals

Retries without audit recreate the same cert corruption. Log who held the lock.

• Retry policy: at most two retries on transient git fetch errors; zero retries on keychain unlock failure.
• Audit JSON: emit lane, match_git_sha, keychain_path, lock_wait_ms per job.
• Alert threshold: page when lock wait p95 exceeds 120s for three consecutive archives.

Five-step rollout on MeshMac

1. Freeze writes. Drain archives; block match nuke on the shared host.
2. Clone shallow. Pin MATCH_GIT_BRANCH; install repo lock under /var/run/meshmac/.
3. Provision keychains. Create lane keychain files; import distribution identities once per lane.
4. Wire queues. Wrap archive in flock on codesign.queue; set job timeouts from the table above.
5. Enable audit. Ship JSON logs to your chat webhook; rehearse one failed unlock drill before reopening the pool.

Parameters you can quote in design reviews

• Concurrent Match reads with shallow fetch cut cold-start git time on shared M4 hosts without widening write races.
• Lane keychains keep distribution identities out of the GUI login session documented in the permission FAQ.
• flock -w 600 on Codesign queues is a sane default when archives run 45–90 minutes and two lanes share one builder.

FAQ

Can two developers run match development at once?

Only with shallow fetch, read concurrency, and serialized writes on the certificates repo. Never parallel nuke or password rotation.

Should CI unlock login.keychain?

No. Use a dedicated lane keychain file unlocked inside the Codesign wrapper; keep VNC GUI signing on a separate account per the SSH versus VNC guide.

When should we add a second MeshMac node?

When lock-wait p95 stays above two minutes after tuning, or when more than one archive must run concurrently. Split Match lanes across nodes instead of raising flock waits without end.