keychain bug since latest update?

[Flashman]

Since the latest update about a week ago I am seeing a frequent pop up asking for permission to access the keychain when connecting to my server. I'll click always allow and the popup goes away for a day or so but then comes back again. This was never repeated before the latest update, so I think something is slightly wrong.

[JD]

Did you upgrade to macOS Sierra ? It's more likely an issue/bug there because my keychain handling code didn't change. You can check against the previous release here:

http://www.yummysoftware.com/archive/YummyFTP/1.11.9/YummyFTP.zip

[Flashman]

Yes I am on Sierra but I'm not seeing repeated requests like this from other apps to access the keychain. I've just tried the old version from your link and not had any keychain requests.

[Flashman]

Another point worth adding is that I had been on Sierra for a while before it was officially released and never had any keychain requests like this.

[JD]

Can you test for another couple of days with the previous version and report back? I want to be sure it's the new version before proceeding further.

[Flashman]

Sure no problem.

[Flashman]

OK I've tried this for a couple days now and it's happening with both versions. It's strange because I never saw this with the GM version of Sierra but only since the final release and never before installing the latest version of Yummy. No other app is throwing up these repeat keychain requests, so it's needle in a haystack stuff. 

[Flashman]

I don't know whether this helps or muddies the water further but I just had a different pop up using Yummy that I've never seen before. Generally I use the mouse when doing web work but I was just doing some quick edits in Photoshop, so I was using the Wacom Pen Tablet. For some weird reason when connecting to the server I was asked for my user password just to use Yummy with the Wacom. Is this right?

[JD]

WTF 

That's confusing, but I can assure you it's nothing to do with me!

I'm guessing the Wacom tablet uses an API called Accessibility in macOS in order for it to work, and this is some new security measure because it means you're granting access for the whole UI to be controlled by another process - Wacom tablet driver in this case.

As far as the original keychain problem is concerned, I'm not sure what to say but for sure there definitely appears to be a problem with Sierra for you rather than with the app itself, although I don't have any similar reports and I can't repeat it myself either. That said, Sierra even had several GM versions before it went to release so it wouldn't surprise me if there were still lingering bugs although why it would only my app is a mystery right now.

I will make enquiries in developer circles. In the mean time, let me know if you find any magic cure

[Flashman]

Thanks JD. About an hour ago I actually sent in a system feedback report to Apple with a full diagnostic. I attached the screenshots and explained this is only happening with Yummy since the final release of Sierra. They are very unlikely to offer me any feedback but it may point them in the right direction for future OS upgrades.

I also took a look in the keychain to see if there was anything related to Yummy but all I could find was two entries called Yummy.sparsebundle going back to 2011 and 2012. 

Thinking outside the box a moment, I checked in 1Password and it looks like I purchased a previous version of Yummy back in 2010 via eSellerate. The current version I am running was purchased through the App Store in 2016. Is it possible there are conflicting files on this computer that are causing problems with Sierra for the keychain?

[JD]

It could be that you hit the nail on the head, as the App Store and direct-buy versions are code-signed differently, so assuming the Keychain uses that signature and somehow got mixed up and has the wrong one....

So I guess, clean everything out (Yummy apps and keychain entries) then re-install from the App Store (or direct-buy download) and see how you go?

[Flashman]

OK I deleted the whole lot using App Cleaner that collects related files from all over the place and then deleted everything, but first made a copy of the Yummy FTP preferences including bookmarks that were stored in the user library preferences folder.

At the moment if I open Yummy there are no bookmarks. Is it safe for me to just drag that "Yummy FTP" folder back in there or will it add a whole lot of stuff we want to eliminate? I can see references to servers and domains that haven't existed for years.

[Flashman]

By some fluke I had actually backed up the bookmarks to iCloud not long ago before deciding I didn't need it because I only have the one computer. I decided to copy/paste that to the user library preferences, rather than use the old one that looked like a mixed bag and so far there has been no request to access the keychain.

I'll have to give it some time but so far it's looking good.

[JD]

Woah that was close... the backup you made was the really really old location of Yummy Bookmarks, so no wonder there were really old domains there! The current folder is in Application Support but I guess that was deleted by App Cleaner. Good job you had an iCloud backup!

Fingers crossed the keychain issue is fixed

[Flashman]

OK that was curious to know. I located the folder in my user library Applications Support and there were no bookmarks, so I moved the items in the user library preferences to the desktop and restarted Yummy. All the bookmarks were gone, so evidently the newly installed app store version of Yummy was still accessing them from the old location.

I then copied the bookmarks with nothing else and pasted it to Applications Support folder. After restarting Yummy all the bookmarks are back in place. I'll go through the general preferences but it's all looking a lot less muddled now with no sign of all the old domains and servers inside the Item Information Database along with more than 60 Server Favorites. There were also a huge number of items in the Remote Edits folder.

No keychain requests so far either...

PS I've set up iCloud backup permanently now