I attempted to build the MacPorts textmate2 port, originally for 2.0-alpha.9537, and got an "unknown signee" error during configure when it attempted to download the bundles.
I reported it on MacPorts Trac: https://trac.macports.org/ticket/43466. That ticket contains the steps I took and also now contains what I did to get the build to work.
My problem seems very similar to http://lists.macromates.com/textmate/2013-February/035922.html http://textmate.1073791.n5.nabble.com/Unknown-signee-errors-td25943.html and http://permalink.gmane.org/gmane.os.apple.macports.tickets/68860
I think that there might be a couple of issues in key_chain.cc.
In file key_chain.cc, the line
if(err = SecItemImport(data, NULL, &type, &format, 0, ¶ms, NULL, &items) == errSecSuccess)
causes variable err to be set to the result of the logical expression, whereas the intent is to set it to the return value of SecItemImport. Needs either parentheses or splitting into an assignment and an if(). I chose the latter as in the diff output below.
Also, the documentation for SecItemImport (at https://developer.apple.com/library/mac/documentation/security/Reference/key...) shows that the sequence of parameters &type and &format is wrong. I reversed them.
These changes didn't fix the problem but at least showed that SecItemImport was returning errSecAddinLoadFailed. On a hunch, I changed both &type and &format to pass the "unknown" enum and that fixed the problem.
I've included below the diff of the resulting changes, with a long comment added explaining that I didn't investigate whether both &type and &format needed to be changed or just one. If I had to guess, I'd say it was &format.
I have no idea why this was a problem for me and not for others.
The diff:
*** /tmp/key_chain.cc 2014-06-12 15:55:45.000000000 +1000 --- /tmp/key_chain.cc_orig 2014-06-12 15:55:45.000000000 +1000 *************** *** 31,56 **** bool res = false;
SecItemImportExportKeyParameters params = { .keyUsage = NULL, .keyAttributes = NULL }; ! /***************************************************** ! /* Specifying the expected Item Type and Format ! * caused SecItemImport to return ! * errSecAddinLoadFailed. ! * I didn't check whether it was due to both being ! * specified or just one. Setting to the Unknown enum ! * worked. ! * Original code on next two comment lines. ! /* SecExternalItemType type = kSecItemTypePublicKey; ! /* SecExternalFormat format = kSecFormatPEMSequence; ! * Updated code with both vars set to unknown on next ! * two lines. */ ! SecExternalFormat format = kSecFormatUnknown; ! SecExternalItemType type = kSecItemTypeUnknown;
CFDataRef data = CFDataCreateWithBytesNoCopy(NULL, (const UInt8*)_key_data.data(), _key_data.size(), kCFAllocatorNull); CFArrayRef items = NULL; OSStatus err; ! err = SecItemImport(data, NULL, &format, &type, 0, ¶ms, NULL, &items); ! if(err == errSecSuccess) { _sec_key = (SecKeyRef)CFArrayGetValueAtIndex(items, 0); if(_sec_key != NULL) --- 31,43 ---- bool res = false;
SecItemImportExportKeyParameters params = { .keyUsage = NULL, .keyAttributes = NULL }; ! SecExternalItemType type = kSecItemTypePublicKey; ! SecExternalFormat format = kSecFormatPEMSequence;
CFDataRef data = CFDataCreateWithBytesNoCopy(NULL, (const UInt8*)_key_data.data(), _key_data.size(), kCFAllocatorNull); CFArrayRef items = NULL; OSStatus err; ! if(err = SecItemImport(data, NULL, &type, &format, 0, ¶ms, NULL, &items) == errSecSuccess) { _sec_key = (SecKeyRef)CFArrayGetValueAtIndex(items, 0); if(_sec_key != NULL)
regards - David
On 12 Jun 2014, at 8:57, David Hislop wrote:
These changes didn't fix the problem but at least showed that SecItemImport was returning errSecAddinLoadFailed. On a hunch, I changed both &type and &format to pass the "unknown" enum and that fixed the problem.
[…] I have no idea why this was a problem for me and not for others.
What OS are you using?
And you’re correct about the errors you found, I’ll get that fixed, thanks!
On 12 Jun 2014, at 8:57, David Hislop wrote:
[…] These changes didn't fix the problem but at least showed that SecItemImport was returning errSecAddinLoadFailed
[…] I have no idea why this was a problem for me and not for others.
I have since fixed the issues you pointed out and wanted to add a test, but when I revisisted it today I realized that a test would be redundant because the s/w update tests already check the signature validation code (which also use the keychain).
One thing that might explain your issue could be if you have a “corrupt” external keychain, this would be ~/Library/Application Support/TextMate/Managed/KeyChain.plist — TextMate will prefer this file when checking bundle signatures (unlike for s/w update).
I removed support for this in HEAD since we newer introduced third party bundle sources (which was the point of having the signing keys on disk where user could add to them).