Since my Apple Distribution signing certificate had expired I recently got a new one via https://developer.apple.com/account/resources/certificates/list and installed in on my login keychain.
Since I had some issues with signing I suspected that codesign might still be trying to use an old expired certificate (as they have the same name "Apple Distribution: <Name> (<ID>)"). So to fix this I figured I could just delete the old expired certificate from Keychain Access so there was only the valid new certificate there with the same name.
However, after doing this and trying to use it with codesign I get the following error
error: The specified item is no longer valid. It may have been deleted from the keychain.
In other words it seems it's not finding the new valid certificate and somehow still linking the name to the old certificate that it rightly guesses is removed.
Following the tips from https://developer.apple.com/forums/thread/701514 I used
security find-identity -p codesigning -v to check for installed codesigning certificates, and this listed the new certificate as expected.
Using another tip in the same post I saw that you can also use the certificate hash as an identifier beside the name, and using this I can use it with codesign to sign. However, it's still not finding it via the name (or rather, it's still finding the old now removed one).
What could be the reason for codesign not finding the correct new valid certificate based on the name and instead still finding the old one? Maybe there's some reference set somewhere to point the name towards specifically the old certificate?