Will the mac prompt the user again to allow access to the keychain after updating the app?

Question

I've noticed something somewhat strange when I ran the Xcode build of my app and then launch the app store build. If I run the xcode build (using development certificates), then run my app through the app store (using production certificates) I get prompted with the following dialog box

MyApp want to use your confidential information stored in "com.myApp in the keychain.

I also get this dialog when I run the app store build first, then the Xcode development build. I believe this dialog appears because both builds have different certificates (could be wrong).

My biggest concern is the user updates the app, will the user see this dialog?

Not sure if this is important, but this is how I save data to the keychain.

[[A0SimpleKeychain keychain] setString:string forKey:@"key"];

942

Posted by

AppleCurt

Reply

Add a Comment

Answer 1

Access to keychain items is determined by the item’s access control list (ACL). When you create the item the ACL starts off including just your application. That application is identified by the app’s code signature, and specifically the designated requirement (DR). If the app’s DR changes, it doesn’t match the item’s ACL entry and you get an authorisation dialog.

This isn’t a problem for apps distributed by the Mac App Store because the DR is maintained from release to release. I believe the problem you’re seeing is that your development build has a different DR. You can confirm this by dumping the DR with the following command:

$ codesign -d -r - /Applications/PCalc.app
Executable=/Applications/PCalc.app/Contents/MacOS/PCalc
designated => (anchor apple generic and certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "9A6GM5K6XE") and identifier "uk.co.tla-systems.pcalc"

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

Posted by

eskimo

Add a Comment

Will the mac prompt the user again to allow access to the keychain after updating the app?

Replies