Keychain Access from SSH Session

Question

Created Oct ’22

Replies 2

Boosts 0

Views 1.2k

Participants 3

I'm trying to set up (really update) a Jenkins build server and running into a problem during code signing. Specifically, the same script behaves differently on an x86 Mac running 12.4 and an Apple Silicon Mac also running 12.4. The primary symptom seems to be that the x86 Mac is creating a separate security session, while the Apple Silicon Mac is apparently using the default root session, this results in attempts to update the keychain list on failing on the Apple Silicon while succeeding on the x86.

From ssh to the x86:

dberry@amacosjenks02 mobile-sdk % zsh -x scripts/ios_keychain.sh
+scripts/ios_keychain.sh:7> KEYCHAIN=/Users/jenkins/JenkinsBuild.keychain 
+scripts/ios_keychain.sh:10> echo '========== before =========='
========== before ==========
+scripts/ios_keychain.sh:11> security list-keychains
    "/Users/dberry/Library/Keychains/login.keychain-db"
    "/Library/Keychains/System.keychain"
+scripts/ios_keychain.sh:12> security list-keychains -s /Users/jenkins/JenkinsBuild.keychain login.keychain-db
/Users/jenkins/JenkinsBuild.keychain
+scripts/ios_keychain.sh:14> echo '========== after ==========='
========== after ===========
+scripts/ios_keychain.sh:15> security list-keychains
    "/Users/jenkins/JenkinsBuild.keychain"
    "/Users/dberry/Library/Keychains/login.keychain-db"
    "/Library/Keychains/System.keychain"
+scripts/ios_keychain.sh:28> trap cleanup EXIT
+scripts/ios_keychain.sh:29> cleanup
+cleanup:1> security list-keychains -s login.keychain-db
+cleanup:3> echo '========== cleanup ==========='
========== cleanup ===========
+cleanup:4> security list-keychains
    "/Users/dberry/Library/Keychains/login.keychain-db"
    "/Library/Keychains/System.keychain"
dberry@amacosjenks02 mobile-sdk % sw_vers
ProductName:	macOS
ProductVersion:	12.4
BuildVersion:	21F79
dberry@amacosjenks02 mobile-sdk %

From ssh to the Apple Silicon:

dberry@amacosjenks03 mobile-sdk % zsh -x scripts/ios_keychain.sh
+scripts/ios_keychain.sh:7> KEYCHAIN=/Users/dberry/JenkinsBuild.keychain 
+scripts/ios_keychain.sh:10> echo '========== before =========='
========== before ==========
+scripts/ios_keychain.sh:11> security list-keychains
    "/Library/Keychains/System.keychain"
    "/Library/Keychains/System.keychain"
+scripts/ios_keychain.sh:12> security list-keychains -s /Users/dberry/JenkinsBuild.keychain login.keychain-db
+scripts/ios_keychain.sh:14> echo '========== after ==========='
========== after ===========
+scripts/ios_keychain.sh:15> security list-keychains
    "/Library/Keychains/System.keychain"
    "/Library/Keychains/System.keychain"
+scripts/ios_keychain.sh:28> trap cleanup EXIT
+scripts/ios_keychain.sh:29> cleanup
+cleanup:1> security list-keychains -s login.keychain-db
+cleanup:3> echo '========== cleanup ==========='
========== cleanup ===========
+cleanup:4> security list-keychains
    "/Library/Keychains/System.keychain"
    "/Library/Keychains/System.keychain"
dberry@amacosjenks03 mobile-sdk % sw_vers
ProductName:	macOS
ProductVersion:	12.4
BuildVersion:	21F79
dberry@amacosjenks03 mobile-sdk %

Apparently something in the configuration of the two machines is different, but I'm not finding it. sshd_config and ssh_config are functionally identical, as are .ssh/config

How can I cleanly get access to the keychain from an ssh session? Specifically I need to be able to add a keychain to the search list, unlock it, and use it for code signing. I understand the process for each of those steps (the unlock step is just removed from the above for sanity). The only problem seems to be the security context as reflected in the fact that none of the list-keychains -s have any effect on the arm, although they do on the x86 and the last of the login keychain on the arm.

Boost

Answer 1

Brantone OP

Oct ’22

Running into the same ... and it's infuriating. At first thought might've had something to do with not having GUI session, but even with that and actively logged in to RDP, getting different results. Theorizing similar : something happening with GUI that's initiating some security aspect to "allow" keychains differently. Hoping someone from Apple can speak to this.

0

Answer 2

gisboy OP

Aug ’24

Probably stumbled into the same issue, meanwhile on macOS 14.6.1. Code signing from CI works on Intel Mac, but not on ARM/Apple Silicon Mac.

Basically, the user keychain(s) are not included in the default search list, only the system keychain.

On Intel:

$ security list-keychains
    "/Users/runner/Library/Keychains/login.keychain-db"
    "/Library/Keychains/System.keychain"
$ security list-keychains -d user
    "/Users/runner/Library/Keychains/login.keychain-db"

On ARM:

$ security list-keychains
    "/Library/Keychains/System.keychain"
    "/Library/Keychains/System.keychain"
$ security list-keychains -d user
    "/Users/runner/Library/Keychains/login.keychain-db"

For now, I can only reproduce in a headless CI session. Or does it depend if there is an active user session? On the Intel machine, the user running the script has a gui session.

0