Failed to find default keychain on MacOS images

[xiazhvera]

When I tried to access default keychain through Apple API SecKeychainCopyDefault, I got error OSStatus -25307, which means "A default keychain could not be found.". However, my application works locally, and the issue only happened with Github Actions. Would anyone have any insight in this issue?

I've tried the following steps, but no luck

1. When I tried to list the keychains, I can find the user keychain is available. If I manually open the "login.keychain" keychain, it succeed. However, I could not retrieve it from the "default keychain".

> security list-keychains
     "/Users/runner/Library/Keychains/login.keychain-db"
     "/Library/Keychains/System.keychain"

2. I also tried to create and set default keychain using the following command. Similarly, I can manually access "build.keychain", but I could not retrieve it by SecKeychainCopyDefault

security create-keychain -p test build.keychain
security default-keychain -s build.keychain
security unlock-keychain -p test build.keychain

3. Tried to run with sudo, however, as the keychain is in user space, sudo does not seem to be helpful.

Runner Image
MacOS 12 - xcode 14
macos-13-xlarge - xcode 14
macos-14-xlarge - xcode 15

[sergei-pyshnoi]

Hello @xiazhvera . Looks like SecKeychainCopyDefault method deprecated since macOS 10.2–10.10 .

[xiazhvera]

Regardless of the specific API, the keychain operation failed while running xcode. I setup a unit test with command security default-keychain, it also failed with SecKeychainCopyDefault: A default keychain could not be found..
However, if I run the same command in the CI terminal, it can correctly retrieve the default keychain.

Here is my unit test:

static func run_shell(_ command: String) -> String {
        let task = Process()
        let pipe = Pipe()
        
        task.standardOutput = pipe
        task.standardError = pipe
        task.arguments = ["-c", command]
        task.launchPath = "/bin/zsh"
        task.standardInput = nil
        task.launch()
        
        let data = pipe.fileHandleForReading.readDataToEndOfFile()
        let output = String(data: data, encoding: .utf8)!
        
        return output
    }
    
    func testSecurityDefaultKeychain() throws
    {
        print(TLSContextTests.run_shell("security default-keychain"));
    }

[xiazhvera]

I also turned to the apple community for help, while it is more likely CI environment related.
Here is my post on Apple Developer Forums: https://developer.apple.com/forums/thread/747794