Why is security set-key-partition-list needed to use codesign?

Question

Created Nov ’20

Replies 1

Boosts 1

Views 6.2k

Participants 2

Hello,

I am trying to set up manual codesigning in an automated build script that runs in Github Actions. The process was hanging because the codesign command prompts for a password. I tried to get around this in several ways:

passing the password to codesign in the script (doesn't seem to work)
using the -T /usr/bin/codesign option when doing security import <certificate>
using the -A option when doing security import <certificate>
unlocking the keychain, and extending the timeout time

The UI prompt would still always appear. I finally found this question: https://stackoverflow.com/questions/39868578/security-codesign-in-sierra-keychain-ignores-access-control-settings-and-ui-p which seems to be the same issue.
The solution suggested there, security set-key-partition-list -S apple-tool:,apple: -s -k <keychain password> <keychain name> solves the problem. I couldn't find any answers on these forums explaining this command.

I have two questions:
1) Why did the first things I tried not work?
2) Could I get some confirmation that this is the correct and secure way to do this?
Thanks!

Boost

Answer 1

tschroeder OP

Jun ’21

To answer your second question: Yes, seems like that's the correct way. At least the GitHub Action for apple-actions/import-codesign-certs does the same (see these lines).

I have no idea what that does but it seems to be necessary. In general you should be able to just use the GitHub Action apple-actions/import-codesign-certs in your own automated script as described in their Readme.md.

0