Skip to content

Error executing: /usr/bin/security dump-trust-settings  #1002

New issue
New issue
Closed
Closed
Error executing: /usr/bin/security dump-trust-settings #1002
Labels
bug
@flipphillips

Description

@flipphillips
flipphillips
opened on Sep 23, 2015

One-line Description

PC throws an error w/ dialog on startup re: the keychain on Mac OS X 10.11

Broader Description

On occasion, Package Control starts up at the beginning of a ST3 startup and displays an error of the form:

Package Control

Error executing: /usr/bin/security dump-trust-settings -d

SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
...
...

Replication / regression

It happens at startup but not every startup. Difficult to replicate but I'm presuming you know where this work is being done. Furthermore- I just noticed a PC upgrade. So I have upgraded to see if this fixes this problem.

Happens across 2x machines at least, both running El Cap/10.11 and shared preferences / configuration via Dropbox

Relevant configuration notes

Mac Book Pro Retina + Mac Pro
Mac OS X 10.11 GM
ST3 3095
PC 3.1.0

macos_ _-bash_ _bash_ _80x24_and_bin_ _-bash_ _bash_ _80x24_and_twitter___mentions

Activity

wbond

wbond commented on Sep 23, 2015

@wbond
wbond
on Sep 23, 2015
Owner

Package Control only dumps the trust settings about once a week since it can take a few seconds to do so. This is most likely why you only see it occasionally.

I've been working on a bunch of other, mostly unrelated crypto code that deals with dumping these trust settings also, albeit without launching a subprocess, but instead using the OS X APIs. It may make more sense to switch over to that code since it is more well tested and would not suffer from the perils of scraping command line tool output.

Just incase anyone is reading and wants to know the direction am considering, please see https://github.com/wbond/oscrypto/blob/master/oscrypto/_osx/trust_list.py#L21-L140.

wbond

wbond commented on Sep 23, 2015

@wbond
wbond
on Sep 23, 2015
Owner

I should also note, it appears that this output is likely caused because "custom" trust settings exist for one or more certs in your system keychain.

flipphillips

flipphillips commented on Sep 23, 2015

@flipphillips
flipphillips
on Sep 23, 2015
Author

Indeed there is something 'up' with my keychain there. Curious.

wbond
added
bug
on Sep 24, 2015
musashinm

musashinm commented on Oct 1, 2015

@musashinm
musashinm
on Oct 1, 2015

Same here.

fabienbellanger

fabienbellanger commented on Oct 8, 2015

@fabienbellanger
fabienbellanger
on Oct 8, 2015

I have the same problem

ashokfernandez

ashokfernandez commented on Oct 8, 2015

@ashokfernandez
ashokfernandez
on Oct 8, 2015

+1

zhanghan177

zhanghan177 commented on Oct 9, 2015

@zhanghan177
zhanghan177
on Oct 9, 2015

+1 Appears after upgrading to os x 10.11

alana314

alana314 commented on Oct 9, 2015

@alana314
alana314
on Oct 9, 2015

I'm seeing it too in El Capitan. Could it be the SIP settings limiting /usr/bin?

dadaclonefly

dadaclonefly commented on Oct 9, 2015

@dadaclonefly
dadaclonefly
on Oct 9, 2015

+1 after upgrading OS X 10.11

tylerhellner

tylerhellner commented on Oct 10, 2015

@tylerhellner
tylerhellner
on Oct 10, 2015

+1 after upgrading to OS X 10.11

Full message:

Package Control

Error executing: /usr/bin/security dump-trust-settings -d

SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
Number of trusted certs = 3
Cert 0: VeriSign Class 3 Secure Server CA - G3
   Number of trust settings : 1
   Trust Setting 0:
      Result Type           : kSecTrustSettingsResultTrustAsRoot
Cert 1: GTE CyberTrust Global Root
Cert 2: Class 3 Public Primary Certification Authority

VCS-based packages can be ignored with the "ignore_vcs_packages" setting.`
mrexodia

mrexodia commented on Oct 10, 2015

@mrexodia
mrexodia
on Oct 10, 2015

What worked for me was to remove all certificates shown when you execute /usr/bin/security dump-trust-settings -d (mine was expired is why I tried).

When re-adding the HTTPS certificate using Safari everything worked again.

My console output:

Number of trusted certs = 3
Cert 0: secretbox.tk
   Number of trust settings : 1
   Trust Setting 0:
      Policy OID            : Apple X509 Basic
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
Cert 1: GTE CyberTrust Global Root
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
Cert 2: Class 3 Public Primary Certification Authority
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.

It might have to do with the updated root certificates in El Capitan. GTE CyberTrust Global Root is no longer a certificate authority (see here). However, I don't know much about certificate authorities and stuff so I don't know if this is the real reason.

tzm41

tzm41 commented on Oct 15, 2015

@tzm41
tzm41
on Oct 15, 2015

screen shot 2015-10-15 at 14 05 18

harshal-gajare

harshal-gajare commented on Oct 15, 2015

@harshal-gajare
harshal-gajare
on Oct 15, 2015

I am getting this error as well

Mac OS X 10.11

Package Control

Error executing: /usr/bin/security dump-trust-settings -d

SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
Number of trusted certs = 3
Cert 0: SAP Passport CA
Number of trust settings : 2
Trust Setting 0:
Policy OID : Apple X509 Basic
Allowed Error : CSSMERR_TP_CERT_EXPIRED
Result Type : kSecTrustSettingsResultTrustRoot
Trust Setting 1:
Allowed Error : CSSMERR_TP_CERT_EXPIRED
Result Type : kSecTrustSettingsResultTrustRoot
Cert 1: GTE CyberTrust Global Root
Cert 2: Class 3 Public Primary Certification Authority

VCS-based packages can be ignored with the "ignore_vcs_packages" setting.

davidsouza

davidsouza commented on Oct 15, 2015

@davidsouza
davidsouza
on Oct 15, 2015

+1

22 remaining items

davidhq

davidhq commented on Oct 24, 2015

@davidhq
davidhq
on Oct 24, 2015

Maybe there has been enough of +1s on this thread :) The message has gotten accross :D

imcom

imcom commented on Oct 25, 2015

@imcom
imcom
on Oct 25, 2015

+1 Appears after upgrading to os x 10.11

inopinatus

inopinatus commented on Oct 25, 2015

@inopinatus
inopinatus
on Oct 25, 2015

+1 and mostly I want to know if this breaks anything.

urda

urda commented on Oct 25, 2015

@urda
urda
on Oct 25, 2015

I'm going to echo what @davidhq said, we've got enough +1's for now, and @wbond has recognized this issue.

tatygrassini

tatygrassini commented on Oct 26, 2015

@tatygrassini
tatygrassini
on Oct 26, 2015

+1

badabam

badabam commented on Oct 27, 2015

@badabam
badabam
on Oct 27, 2015

+1

goiwai

goiwai commented on Oct 28, 2015

@goiwai
goiwai
on Oct 28, 2015

+1

cfc4n

cfc4n commented on Oct 28, 2015

@cfc4n
cfc4n
on Oct 28, 2015

+1

Package Control

Error executing: /usr/bin/security dump-trust-settings -d

SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
Number of trusted certs = 6
Cert 0: GDB
   Number of trust settings : 12
   Trust Setting 0:
      Policy OID            : SSL
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 1:
      Policy OID            : SSL
      Allowed Error         : Host name mismatch
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 2:
      Policy OID            : SMIME
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 3:
      Policy OID            : SMIME
      Allowed Error         : S/MIME Email address mismatch
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 4:
      Policy OID            : EAP
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 5:
      Policy OID            : IPSec
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 6:
      Policy OID            : iChat
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 7:
      Policy OID            : PKINIT Client
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 8:
      Policy OID            : PKINIT Server
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 9:
      Policy OID            : Code Signing
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 10:
      Policy OID            : Unknown OID length 9, value { 2A 86 48 86 F7 63 64 01 14  }
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 11:
      Policy OID            : Apple X509 Basic
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
Cert 1: Equifax Secure Certificate Authority
Cert 2: GTE CyberTrust Global Root
Cert 3: Thawte Premium Server CA
Cert 4: Thawte Server CA
Cert 5: Class 3 Public Primary Certification Authority

VCS-based packages can be ignored with the "ignore_vcs_packages" setting.
shankie-codes
mentioned this on Oct 28, 2015
marcjohlic

marcjohlic commented on Oct 29, 2015

@marcjohlic
marcjohlic
on Oct 29, 2015

+1 ST3, El Capitan etc

manuelmeurer

manuelmeurer commented on Oct 29, 2015

@manuelmeurer
manuelmeurer
on Oct 29, 2015

Seriously, guys, please stop it with the +1s! It gets really annoying for people like me who subscribed to updates from this ticket... @wbond already responded that he is working on this! 😄

Repository owner locked and limited conversation to collaborators on Oct 29, 2015
wbond

wbond commented on Jun 14, 2016

@wbond
wbond
on Jun 14, 2016
Owner

Here is the current work to be done: wbond/oscrypto#15

wbond

wbond commented on Jul 29, 2016

@wbond
wbond
on Jul 29, 2016
Owner

be747b9 replaces the old trust list export code with new code from oscrypto. There will be a new release in the near future that includes this.

wbond
closed this as completedon Jul 29, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bug

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Development

      No branches or pull requests

        Participants

        @davidhq@manuelmeurer@wbond@pstinnett@johntdyer

        Issue actions
          Error executing: /usr/bin/security dump-trust-settings · Issue #1002 · wbond/package_control