altool broken/changed in xcode 9.0 (9A235)

We had a script in our teamcity configuration that used altool to upload the binary to the appstore. This has stopped working since we recently upgraded to xcode 9.0 on our build agent.


the script element boils down to this (pseudo data in {}'s):

{path}/altool --upload-app -f {path to ipa} -t ios -u {user name} -p @keychain:{password item}


the problem seems to be around the way we get the password, this produces the following error

altool[90033:2599317] *** Error: The specified item could not be found in the keychain. The specified item could not be found in the keychain.


the keychain does indeed have a password entry with the matching name. Nothing about this password setup has changed recently, this is the setup we've always used.


Does anyone know:

1. which keychain is searched by aitool? is it Login, local items, System or all of the above.

2. has the specification of the keychain item changed in macOS or altool?
3. is it necessary to set some sort of priveledge on altool for this to work?


thanks for your time,

CR.