"User interaction is not allowed" trying to sign an OSX app using codesign
code-signing, jenkins, macos, ssh
Solution
Well, I guess I get to answer my own question today, because after stabbing at it over two and a half days, one of the things I tried seems to have worked. I'm just going to back away from it now and hope it keeps working.
Essentially, it looks like it comes down to `-d system` not actually working. So a lot of answers to other questions around here should probably be updated to reflect that.
security -v list-keychains -s "$KEYCHAIN" "$HOME/Library/Keychains/login.keychain"
security list-keychains # so we can verify that it was added if it fails again
security -v unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
codesign --sign "$SIGNER_IDENTITY" --force --signature-size 9600 \
--resource-rules src/AppResourceRules.plist --timestamp --verbose \
"$APP"
Problem
Our automated build is running on Jenkins. The build itself is running on slaves, with the slaves being executed via SSH. I get an error: ``` 00:03:25.113 [codesign-app] build/App.app: User interaction is not allowed. ``` I have tried every suggestion I have seen so far in other posts here: - Using security unlock-keychain immediately before signing to unlock the keychain. - Moving the signing key out into its own keychain. - Moving the signing key into the login keychain. - Moving the signing key into the system keychain. - Manually setting list-keychains to only the keychain which contains the key. In all cases, I get the same error. In an attempt to diagnose the issue, I tried running the "security unlock-keychain" command on my local terminal and found that it doesn't actually unlock the keychain - if I look in Keychain Access, the lock symbol is still there. This is the case whether I pass the password on the command-line or whether I let it prompt me for it. Unlocking the same keychain using the GUI will prompt me for the password and then unlock it. Additionally, if I run "security lock-keychain", I do see the key lock immediately after running the command. This makes me think that unlock-keychain doesn't actually work. I experience the same behaviour on Lion (which we're using for the build slaves) and Mavericks (which I'm developing on.) Next, I tried adding -v to all the security commands: ``` list-keychains "-d" "system" "-s" "/Users/tester/.secret/App.keychain" Listing keychains to see if it was added: (( "/Library/Keychains/System.keychain" )) unlock-keychain "-p" "**PASSWORD**" "/Users/tester/.secret/App.keychain" build/App.app: User interaction is not allowed. ``` From this, it would seem that list-keychains is what isn't working. Maybe neither work. :/ There is a similar question here. The solution is interesting - set "SessionCreate" to true in launchctl. But I'm not building on the master - my build process is started from SSH on a slave build machine. Maybe there is a command-line way to do what launchctl is doing when you run "SessionCreate"?