Importing/Exporting Preview Signatures on OS X 10.10 (Yosemite)

Question

One of the things I always backup when re-formatting a Mac are the digital signatures I have saved in Preview. For this, my go-to reference used to be here: Can I export my signature from Preview on one Mac and import it on another?. But OS X 10.10 (Yosemite) seems to be doing things a little different.

Since Preview seems to be storing the signatures in a new, non-obvious location now, I've been using the opensnoop utility (http://osxdaily.com/2011/04/22/monitor-mac-os-x-filesystem-usage-access-with-opensnoop/) to see what files are being touched when I am working with Preview's signature creation feature. Below is a sample capture:

501    791 Preview       26 /System/Library/Security 
501    791 Preview       -1 /Users/user1/Library/Containers/com.apple.Preview/Data/Library/Security 
501    791 Preview       25 /var/folders/l_/47ypnnb951qdym78xvjgsn8r0000gn/C/com.apple.Preview//mds/mdsDirectory.db 
501    791 Preview       25 /Users/user1/Library/Keychains/login.keychain 
501    791 Preview       25 /Users/user1/Library/Keychains/login.keychain 
501    791 Preview       26 /var/folders/l_/47ypnnb951qdym78xvjgsn8r0000gn/C/com.apple.Preview//mds/mdsDirectory.db_ 
501    791 Preview       27 /private/var/db/mds/system/mdsDirectory.db 
501    791 Preview       26 /var/folders/l_/47ypnnb951qdym78xvjgsn8r0000gn/C/com.apple.Preview//mds/mdsObject.db 
501    791 Preview       25 /System/Library/PrivateFrameworks/AnnotationKit.framework/Resources/Base.lproj/AKSignaturesView.nib 
501    791 Preview       25 /System/Library/PrivateFrameworks/AnnotationKit.framework/Resources/Base.lproj/AKSignatureCaptureView.nib 
501    791 Preview       25 /System/Library/PrivateFrameworks/AnnotationKit.framework/Resources/Base.lproj/AKSignatureGestureCaptureView.nib 
501    791 Preview       25 /System/Library/PrivateFrameworks/AnnotationKit.framework/Resources/en.lproj/AKSignatureModelController.strings 
501    791 Preview       -1 /System/Library/PrivateFrameworks/AnnotationKit.framework/Resources/en.lproj/AKSignatureModelController.stringsdict 
501    791 Preview       26 /System/Library/Security 
501    791 Preview       -1 /Users/user1/Library/Containers/com.apple.Preview/Data/Library/Security 
501    791 Preview       25 /Users/user1/Library/Keychains/login.keychain 
501    791 Preview       25 /var/folders/l_/47ypnnb951qdym78xvjgsn8r0000gn/C/com.apple.Preview//mds/mds.lock 
501    791 Preview       26 /var/folders/l_/47ypnnb951qdym78xvjgsn8r0000gn/C/com.apple.Preview//mds/mdsObject.db_ 
501    791 Preview       27 /private/var/db/mds/system/mdsObject.db 
501    791 Preview       26 /var/folders/l_/47ypnnb951qdym78xvjgsn8r0000gn/C/com.apple.Preview//mds/mdsDirectory.db_ 
501    791 Preview       27 /private/var/db/mds/system/mdsDirectory.db 
501    791 Preview       26 /var/folders/l_/47ypnnb951qdym78xvjgsn8r0000gn/C/com.apple.Preview//mds/mdsObject.db 
501    791 Preview       25 /Users/user1/Desktop/sample.pdf 

Looks to me that there is something to be found in the file path:

/Users/user1/Library/Containers/com.apple.Preview/Data/Library/Security

but when I try to traverse to the directory, the system tells me that path doesn't exist. I have also noticed that within the KeyChain Access utility, if you look at the contents of Local Items --> Passwords you will see that OS X now creates individual entries for different signatures now labeled Signature Annotation Privacy.

Welcome assistance on my quest to figure out how to locate, export and import Preview's digital signatures from one Yosemite machine to another.

Answer 1

It's a little too obvious now. The image data is recorded as the password entry in KeyChain. So, to copy a signature, create a signature on your new Mac by camera or touchpad. Then:

1. Find the desired "Signature Annotation Privacy" entry in KeyChain on your old Mac.
2. Right-Click and "Copy Password to Clipboard"
3. Paste the text (base64 is all printable) into a text file
4. Copy the text file to your new Mac
5. Find the new "Signature Annotation Privacy" entry on your new Mac
6. Highlight and delete the Password field from that entry
7. Copy the contents of the text file to your clipboard
8. Paste the contents into the password field
9. Save Changes

Answer 2

If you enable Keychain in iCloud (System Preferences -> iCloud -> Keychain), signatures sync automatically.

Answer 3

This is one of the very few times I actually utilize those 5 free GBs of iCloud space. If you allow Preview to sync with iCloud all your signatures will also sync over.

I just followed all these steps and realized once I was done that I then had two of the same signature on both computers; when I deleted one, one was also deleted off my other computer.

Answer 4

I haven't had a chance to try this out yet, but the KeyChain entries actually contain a Base64 encoded plist file that appears to contain the data for the signature itself. I tried to decode the NSMutableData object saved in the plist file, but couldn't get past that point. My assumption at this point is that one might be able to "share" the keychain entry itself and copy it between computers, but again cannot confirm that this works.

Answer 5

The short answer is, it's probably complicated and/or not worth the hassle. You can more easily retrieve the signature by simply applying it to a document and saving the doc. Earlier versions would let you copy and paste, but this one appears not to.

Long version, with speculation:

From opensnoop documentation:

The returned file descriptor is printed, a value of -1 indicates an error. This can be useful for troubleshooting to determine if applications are attempting to open files that do not exist.

The file you mention has a -1 next to it, so the open was attempted, but failed as it did not exist.

So where is the signature now? It's part of AnnotationKit which has little documentation online, but it seems to still use the Keychain key "Signature Annotation Privacy" ... I suspect it puts it in a Module Directory Services (MDS) database.

From MDSSession in libsecurity_mds we can see the following:

 * The layout of the various MDS DB files on disk is as follows:
 *
 * /var/db/mds              -- owner = root, mode = 01777, world writable, sticky
 *    system/               -- owner = root, mode = 0755
 *       mdsObject.db       -- owner = root, mode = 0644, object DB
 *       mdsDirectory.db    -- owner = root, mode = 0644, MDS directory DB
 *       mds.lock           -- temporary, owner = root, protects creation of and 
 *                             updates to previous two files
 *       mds.install.lock   -- owner = root, protects MDS_Install operation
 *    <uid>/                -- owner = <uid>, mode = 0700
 *       mdsObject.db       -- owner = <uid>, mode = 000, object DB
 *       mdsDirectory.db    -- owner = <uid>, mode = 000, MDS directory DB
 *       mds.lock           -- owner = <uid>, protects updates of previous two files

The mdsObject.db file appears to be a "Common Security Services Manager" or CSSM DB as documented in libsecurity_cssm.

From this I expect it's using some kind of encrypted data store, since that's one of the options listed in CDSA documentation: https://developer.apple.com/library/mac/documentation/Security/Conceptual/cryptoservices/CDSA/CDSA.html

The main evidence I have to support this assertion is that there's a separate mdsObject/mdsDirectory/mds.lock structure within a folder called "com.application.Preview" so it's not just the system-level one, I would think. Not 100% on that, the main use of this kind of DB appears to be for system keys and certificates: http://pubs.opengroup.org/onlinepubs/9629299/2_chap06.htm

Answer 6

I used the answer by user142836 and it works: unfortunately the step 1 is not obvious if you have a machine with a fresh install, even if with all the backups of the old OS... What I've done before step 1 is

1. create a VM with the old OS (10.8 in my case)

2. "restore" from a old OS backup the file

   ~/Library/Containers/com.apple.Preview/Data/Library/Preferences/com.apple.Preview.signatures.plist
   

3. copy in the VM keychain from the old OS backup keychain the entry "Preview Signature Privacy" (copying the keychain file in the VM lets to open both the VM keychain and the backup keychain together, so it's possible to move/copy entries from one to the other; each keychain is locked with usually the user password and depending on the configuration the password of the VM keychain can be different from the backup keychain)
4. upgrade the VM to Yosemite: now the keychain on the VM has all I need!