0

On macOS 10.14.6 Xcode 11.3.1 has been busy creating keychains (and keys, and certificates) in an endless loop while trying to "Automatically Manage Signing". It creates keys in new keychains, and also in the login keychain simultaneously (for some reason).

I don't want hundreds of identically named keychains in the Keychain Access UI, but unlike the keys in the login keychain I can't select multiple keychains in the sidebar to mass-delete them. I don't find the prospect of deleting them one by one very appealing, particularly since Xcode can decide to continue the next time I select automatic signing.

I tried deleting the keychains from disk (located under /private/var/folders/p5/<some id>/T), but that didn't affect the Keychain Access database.

I don't know why:

  • Xcode is creating and revoking certs in a loop
  • Xcode is creating keys in new keychains as well as in the login keychain -- why not just the login keychain?
  • Whether creating keychains in /private/var/folders/p5/<some id>/T is sensible or indicative of a problem (seems like a temp directory to me -- something wrong with my personal keychain library directory?)
  • Whether cleaning up the Keychain Access DB would help Xcode at all
  • How to clean up the DB without deleting hundreds of keychains one by one (which won't even always delete)

Can I somehow select and delete multiple keychains from the DB?

Suggestions welcome as to whether I should concentrate on another aspect of the problem. I'm not quite sure what to expect with regards to Xcode's behavior and location of its keychains, but I suppose I can inspect directory permissions of ~/Library/Keychains in the meantime.

1 Answer 1

1

Something like this should do it:

for keychain in list-of-keychains-to-be-deleted
do security delete-keychain "$keychain"
done

See the security(1) man page for more information.

3
  • Interesting. Looks promising, but the manual simply repeatedly tells me to "specify keychain" over and over, but I could not read my way to how it expected me to actually specify a keychain in the commands... File name? Path? Most don't exist... Some ID? Even if I knew this I'd still not know how to generate the list nor how to integrate it into AppleScript. I ended up just editing ~/Library/Preferences/com.apple.security.plist manually (it wasn't a DB after all) which seems to have worked. It was mentioned in the man page. Thanks!
    – Andreas
    Commented Jul 5 at 22:47
  • security list-keychains shows the paths of the known keychain files, whether they actually exist or not.
    – Linc D.
    Commented Jul 5 at 23:00
  • That's true, thanks. Yeah, I did look at the output of that command but still managed to not think very far...
    – Andreas
    Commented Jul 5 at 23:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .