Hi Matt, thank you for your advise. I would like to note that I am setting the user in the job properties. <key>UserName</key> <string>dev</string> Apparently, this is not enough to setup up the proper context. Could you elaborate please how I can achieve this? I prefer a solution that automatically starts up after reboot to minimize the maintenance effort. As an alternative, is there a way to pass the certificate / signing identity differently to the codesign executable? Or would it have to reside in a keychain? Best regards Maik

Thank You Matt, I might just stick with the agent for now. For completeness, I've been toying with ways to avoid the agent. When I unlock the default keychain prior to codesigning, it seems to work, i.e. security unlock-keychain -p <PASSWORD> I would like to note the security implications, potentially giving access to all information inside the keychain to all kinds of tasks. Best regards Maik