title: "User interaction is not allowed" trying to sign an OSX app using codesign
body: <p>Our automated build is running on Jenkins. The build itself is running on slaves, with the slaves being executed via SSH.</p>
  
  <p>I get an error:</p>
  
  <pre><code>00:03:25.113 [codesign-app] build/App.app: User interaction is not allowed.
  </code></pre>
  
  <p>I have tried every suggestion I have seen so far in other posts here:</p>
  
  <ul>
  <li>Using security unlock-keychain immediately before signing to unlock the keychain.</li>
  <li>Moving the signing key out into its own keychain.</li>
  <li>Moving the signing key into the login keychain.</li>
  <li>Moving the signing key into the system keychain.</li>
  <li>Manually setting list-keychains to only the keychain which contains the key.</li>
  </ul>
  
  <p>In all cases, I get the same error.</p>
  
  <p>In an attempt to diagnose the issue, I tried running the "security unlock-keychain" command on my local terminal and found that it doesn't actually unlock the keychain - if I look in Keychain Access, the lock symbol is still there. This is the case whether I pass the password on the command-line or whether I let it prompt me for it. Unlocking the same keychain using the GUI will prompt me for the password and then unlock it. Additionally, if I run "security lock-keychain", I <em>do</em> see the key lock immediately after running the command. This makes me think that unlock-keychain doesn't actually work. I experience the same behaviour on Lion (which we're using for the build slaves) and Mavericks (which I'm developing on.)</p>
  
  <p>Next, I tried adding -v to all the security commands:</p>
  
  <pre><code>list-keychains "-d" "system" "-s" "/Users/tester/.secret/App.keychain"
  Listing keychains to see if it was added: ((
          "/Library/Keychains/System.keychain"
  ))
  unlock-keychain "-p" "**PASSWORD**" "/Users/tester/.secret/App.keychain"
  build/App.app: User interaction is not allowed.
  </code></pre>
  
  <p>From this, it would seem that list-keychains is what isn't working. Maybe neither work. :/</p>
  
  <p>There is a <a href="https://stackoverflow.com/questions/577750/">similar question here</a>. The solution is interesting - set "SessionCreate" to true in launchctl. But I'm not building on the master - my build process is started from SSH on a slave build machine. Maybe there is a command-line way to do what launchctl is doing when you run "SessionCreate"?</p>