Error executing: /usr/bin/security dump-trust-settings #1002

flipphillips · 2015-09-23T16:55:02Z

One-line Description

PC throws an error w/ dialog on startup re: the keychain on Mac OS X 10.11

Broader Description

On occasion, Package Control starts up at the beginning of a ST3 startup and displays an error of the form:

Package Control

Error executing: /usr/bin/security dump-trust-settings -d

SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
...
...

Replication / regression

It happens at startup but not every startup. Difficult to replicate but I'm presuming you know where this work is being done. Furthermore- I just noticed a PC upgrade. So I have upgraded to see if this fixes this problem.

Happens across 2x machines at least, both running El Cap/10.11 and shared preferences / configuration via Dropbox

Relevant configuration notes

Mac Book Pro Retina + Mac Pro
Mac OS X 10.11 GM
ST3 3095
PC 3.1.0

The text was updated successfully, but these errors were encountered:

wbond · 2015-09-23T18:21:37Z

Package Control only dumps the trust settings about once a week since it can take a few seconds to do so. This is most likely why you only see it occasionally.

I've been working on a bunch of other, mostly unrelated crypto code that deals with dumping these trust settings also, albeit without launching a subprocess, but instead using the OS X APIs. It may make more sense to switch over to that code since it is more well tested and would not suffer from the perils of scraping command line tool output.

Just incase anyone is reading and wants to know the direction am considering, please see https://github.com/wbond/oscrypto/blob/master/oscrypto/_osx/trust_list.py#L21-L140.

wbond · 2015-09-23T18:22:51Z

I should also note, it appears that this output is likely caused because "custom" trust settings exist for one or more certs in your system keychain.

flipphillips · 2015-09-23T19:25:14Z

Indeed there is something 'up' with my keychain there. Curious.

musashinm · 2015-10-01T13:01:53Z

Same here.

fabienbellanger · 2015-10-08T07:22:58Z

I have the same problem

ashokfernandez · 2015-10-08T14:37:40Z

+1

zhanghan177 · 2015-10-09T16:16:23Z

+1 Appears after upgrading to os x 10.11

alana314 · 2015-10-09T17:13:48Z

I'm seeing it too in El Capitan. Could it be the SIP settings limiting /usr/bin?

dadaclonefly · 2015-10-09T18:24:28Z

+1 after upgrading OS X 10.11

tylerhellner · 2015-10-10T03:09:03Z

+1 after upgrading to OS X 10.11

Full message:

Package Control

Error executing: /usr/bin/security dump-trust-settings -d

SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
Number of trusted certs = 3
Cert 0: VeriSign Class 3 Secure Server CA - G3
   Number of trust settings : 1
   Trust Setting 0:
      Result Type           : kSecTrustSettingsResultTrustAsRoot
Cert 1: GTE CyberTrust Global Root
Cert 2: Class 3 Public Primary Certification Authority

VCS-based packages can be ignored with the "ignore_vcs_packages" setting.`

mrexodia · 2015-10-10T10:13:08Z

What worked for me was to remove all certificates shown when you execute /usr/bin/security dump-trust-settings -d (mine was expired is why I tried).

When re-adding the HTTPS certificate using Safari everything worked again.

My console output:

Number of trusted certs = 3
Cert 0: secretbox.tk
   Number of trust settings : 1
   Trust Setting 0:
      Policy OID            : Apple X509 Basic
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
Cert 1: GTE CyberTrust Global Root
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
Cert 2: Class 3 Public Primary Certification Authority
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.

It might have to do with the updated root certificates in El Capitan. GTE CyberTrust Global Root is no longer a certificate authority (see here). However, I don't know much about certificate authorities and stuff so I don't know if this is the real reason.

tzm41 · 2015-10-15T18:05:41Z

harshal-gajare · 2015-10-15T23:26:46Z

I am getting this error as well

Mac OS X 10.11

Package Control

Error executing: /usr/bin/security dump-trust-settings -d

SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
Number of trusted certs = 3
Cert 0: SAP Passport CA
Number of trust settings : 2
Trust Setting 0:
Policy OID : Apple X509 Basic
Allowed Error : CSSMERR_TP_CERT_EXPIRED
Result Type : kSecTrustSettingsResultTrustRoot
Trust Setting 1:
Allowed Error : CSSMERR_TP_CERT_EXPIRED
Result Type : kSecTrustSettingsResultTrustRoot
Cert 1: GTE CyberTrust Global Root
Cert 2: Class 3 Public Primary Certification Authority

VCS-based packages can be ignored with the "ignore_vcs_packages" setting.

davidsouza · 2015-10-15T23:42:32Z

+1

lincetto · 2015-10-16T00:56:17Z

+1

nemofang · 2015-10-16T01:29:26Z

Same issue here after upgrading to OSX 10.11.

ajaydwarkani · 2015-10-16T04:50:28Z

+1

davidhq · 2015-10-17T14:37:27Z

+1

johntdyer · 2015-10-17T15:39:50Z

same issue here

sashkab · 2015-10-18T01:07:12Z

👍

urda · 2015-10-18T03:56:09Z

👎 Having the same issue...

Package Control

Error executing: /usr/bin/security dump-trust-settings -d

SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
Number of trusted certs = 4
Cert 0: Urda Certificate Authority
   Number of trust settings : 2
   Trust Setting 0:
      Policy OID            : Apple X509 Basic
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 1:
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
Cert 1: http://openvpn.net/localca.html #1437602575
   Number of trust settings : 0
Cert 2: GTE CyberTrust Global Root
Cert 3: Class 3 Public Primary Certification Authority

VCS-based packages can be ignored with the "ignore_vcs_packages" setting.

yangj1e · 2015-10-18T13:12:22Z

+1

envomer · 2015-10-18T14:05:53Z

same issue here. any fix yet?

frabonomi · 2015-10-19T11:30:17Z

+1

SucculentGoose · 2015-10-19T17:29:27Z

+1 as well

pstinnett · 2015-10-20T12:59:10Z

+1

jtlindsey · 2015-10-20T22:26:55Z

Same problem here.

margaritis · 2015-10-23T09:09:54Z

+1

yaway · 2015-10-23T09:19:24Z

+1

shankie-codes · 2015-10-23T11:22:53Z

I'm going to follow everyone else and give this a +1

SteveLTN · 2015-10-23T15:53:51Z

+1

wbond · 2015-10-23T15:54:48Z

Sorry this has taken so long. I've just needed to focus on some paying work recently. I'm hoping to get this resolved soon.

jonathanmorgan · 2015-10-23T15:57:01Z

Does this actually cause anything to fail? If not, it would be nice to have it fixed, but you should put food on the table first.

zhanghan177 · 2015-10-23T16:07:05Z

When I first encountered this issue, my sublime froze and I have to force quit. I haven't been using sublime since then. But I just checked my sublime again, and it seems working well. I don't know if my issue still exist though...

qbein · 2015-10-24T10:20:13Z

+1

davidhq · 2015-10-24T10:26:01Z

Maybe there has been enough of +1s on this thread :) The message has gotten accross :D

imcom · 2015-10-25T01:39:43Z

+1 Appears after upgrading to os x 10.11

inopinatus · 2015-10-25T21:49:13Z

+1 and mostly I want to know if this breaks anything.

urda · 2015-10-25T22:33:13Z

I'm going to echo what @davidhq said, we've got enough +1's for now, and @wbond has recognized this issue.

tatygrassini · 2015-10-26T23:02:36Z

+1

badabam · 2015-10-27T08:56:12Z

+1

goiwai · 2015-10-28T02:04:04Z

+1

cfc4n · 2015-10-28T02:33:18Z

+1

Package Control

Error executing: /usr/bin/security dump-trust-settings -d

SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
SecTrustSettingsCopyTrustSettings: The specified item could not be found in the keychain.
Number of trusted certs = 6
Cert 0: GDB
   Number of trust settings : 12
   Trust Setting 0:
      Policy OID            : SSL
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 1:
      Policy OID            : SSL
      Allowed Error         : Host name mismatch
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 2:
      Policy OID            : SMIME
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 3:
      Policy OID            : SMIME
      Allowed Error         : S/MIME Email address mismatch
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 4:
      Policy OID            : EAP
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 5:
      Policy OID            : IPSec
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 6:
      Policy OID            : iChat
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 7:
      Policy OID            : PKINIT Client
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 8:
      Policy OID            : PKINIT Server
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 9:
      Policy OID            : Code Signing
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 10:
      Policy OID            : Unknown OID length 9, value { 2A 86 48 86 F7 63 64 01 14  }
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
   Trust Setting 11:
      Policy OID            : Apple X509 Basic
      Allowed Error         : CSSMERR_TP_CERT_EXPIRED
      Result Type           : kSecTrustSettingsResultTrustRoot
Cert 1: Equifax Secure Certificate Authority
Cert 2: GTE CyberTrust Global Root
Cert 3: Thawte Premium Server CA
Cert 4: Thawte Server CA
Cert 5: Class 3 Public Primary Certification Authority

VCS-based packages can be ignored with the "ignore_vcs_packages" setting.

marcjohlic · 2015-10-29T15:06:45Z

+1 ST3, El Capitan etc

manuelmeurer · 2015-10-29T15:40:01Z

Seriously, guys, please stop it with the +1s! It gets really annoying for people like me who subscribed to updates from this ticket... @wbond already responded that he is working on this! 😄

wbond · 2016-06-14T21:11:50Z

Here is the current work to be done: wbond/oscrypto#15

wbond · 2016-07-29T21:06:43Z

be747b9 replaces the old trust list export code with new code from oscrypto. There will be a new release in the near future that includes this.

wbond added the bug label Sep 24, 2015

moonfruit mentioned this issue Oct 22, 2015

Error executing: /usr/bin/security dump-trust-settings -d #1017

Closed

shankie-codes mentioned this issue Oct 28, 2015

Gulp stops running after some time (El Capitan upgrade) nicosantangelo/sublime-gulp#52

Open

Repository owner locked and limited conversation to collaborators Oct 29, 2015

wbond closed this as completed Jul 29, 2016

Error executing: /usr/bin/security dump-trust-settings #1002

Error executing: /usr/bin/security dump-trust-settings #1002

Comments

flipphillips commented Sep 23, 2015

One-line Description

Broader Description

Replication / regression

Relevant configuration notes

wbond commented Sep 23, 2015

wbond commented Sep 23, 2015

flipphillips commented Sep 23, 2015

musashinm commented Oct 1, 2015

fabienbellanger commented Oct 8, 2015

ashokfernandez commented Oct 8, 2015

zhanghan177 commented Oct 9, 2015

alana314 commented Oct 9, 2015

dadaclonefly commented Oct 9, 2015

tylerhellner commented Oct 10, 2015

mrexodia commented Oct 10, 2015

tzm41 commented Oct 15, 2015

harshal-gajare commented Oct 15, 2015

davidsouza commented Oct 15, 2015

lincetto commented Oct 16, 2015

nemofang commented Oct 16, 2015

ajaydwarkani commented Oct 16, 2015

davidhq commented Oct 17, 2015

johntdyer commented Oct 17, 2015

sashkab commented Oct 18, 2015

urda commented Oct 18, 2015

yangj1e commented Oct 18, 2015

envomer commented Oct 18, 2015

frabonomi commented Oct 19, 2015

SucculentGoose commented Oct 19, 2015

pstinnett commented Oct 20, 2015

jtlindsey commented Oct 20, 2015

margaritis commented Oct 23, 2015

yaway commented Oct 23, 2015

shankie-codes commented Oct 23, 2015

SteveLTN commented Oct 23, 2015

wbond commented Oct 23, 2015

jonathanmorgan commented Oct 23, 2015

zhanghan177 commented Oct 23, 2015

qbein commented Oct 24, 2015

davidhq commented Oct 24, 2015

imcom commented Oct 25, 2015

inopinatus commented Oct 25, 2015

urda commented Oct 25, 2015

tatygrassini commented Oct 26, 2015

badabam commented Oct 27, 2015

goiwai commented Oct 28, 2015

cfc4n commented Oct 28, 2015

marcjohlic commented Oct 29, 2015

manuelmeurer commented Oct 29, 2015

wbond commented Jun 14, 2016

wbond commented Jul 29, 2016