macOS wants to make changes.Enter an administrator’s name and password to allow this

Question

I’m running a script to generate an ipa file from Xcode. While invoking the xcodebuild a prompt is displayed saying

macOS wants to make changes. Enter an administrator’s name and password to allow this.

If the credentials are entered the ipa file will be generated. If not the ipa will not be generated.

I figured out that the prompts are displayed because of the “Apple Worldwide Developer relations Intermediate Certificate which expires on Feb 7 2023”. Is there any way we can bypass this and the build and automatically generate the ipa without having to enter the keychain credentials?

Spirograph

Answer 1

Under the Keychain application, go to the private key associated with your developer certificate. Then do key > Get Info > Access Control. Down there, make sure your application (Xcode) is in the list Always allow access by these applications and make sure Confirm before allowing access is turned of, same for Ask for Keychain password.

Dita

Thank you very much for the response.Tried this change and this did not work for me. – Spirograph

I want to join codesign but I dont know where it is. – Bathyal

@VannesYang codesign should be located under /usr/bin/codesign. You can check it by running which codesign in your terminal. In the Access Control hit the + symbol, then do ⌘ + ⇧ + G and type the location of your codesign path there. This should add it to the Access Control list – Dita

Any way of doing this from terminal? – Belfast

@DrazenBjelovuk reason for your question? There is an option set-key-partition-list with the -S flag, but I'm not sure if that does the trick – Dita

Ran into privilege issues that I could only get around using sudo from terminal. Better workaround for me though was actually to just use the login keychain instead of system (see Jinyu's answer). – Belfast

Answer 2

You might have put your certificates in the wrong group. I'm guessing you have put it into the "System" group. Then it will always prompt you to input username and password. You can solve this by removing it from "System" and then adding it to the "Login" group. I had this problem 10 minutes ago, and I solved it by doing this.

Gan

This solution work for me, simple just copy certificate from "System" group then paste to "Login" group, after that delete it from "System" group will be OK. – Schelling

I ran into privilege issues with the copying approach (couldn't move the private key with it), but found a simpler way through File -> Import Items... -> Show Options -> Destination Keychain: login – Belfast

In my case I had a private key for a signing certificate which I had accidentally imported into the System keychain instead of the Login one. Had to export it, delete it, then import it into the Login group. – Decerebrate

Answer 3

To fix this, simply select the distribution certificate that you need for signing your app in the Keychain application. Select the cert > Get Info > Trust. Then select Always Trust in the drop down and enter password to make this change permanent.

Endermic

This always breaks everything when I try it. No idea why since it seems like it'd be fine. – Decerebrate