From 623d697e6634f6854b1fd004465df4bf6d788967 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20F=C3=B6rtsch?= <mail@felixfoertsch.de>
Date: Sun, 24 May 2026 20:04:35 +0200
Subject: [PATCH] avoid daemon default keychain write

---
 .gitea/workflows/custom-release.yml                 | 4 +---
 scripts/tests/test-custom-release-macos-runner.bats | 4 ++--
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/custom-release.yml b/.gitea/workflows/custom-release.yml
index 67f8fa59f..6c95263cb 100644
--- a/.gitea/workflows/custom-release.yml
+++ b/.gitea/workflows/custom-release.yml
@@ -60,7 +60,7 @@ jobs:
           keychain_path="$keychain_dir/syncthing-release-signing-${GITHUB_RUN_ID:-$$}.keychain-db"
           keychain_password="$(openssl rand -hex 24)"
           certificate_path="$RUNNER_TEMP/developer-id-application.p12"
-          previous_default_keychain="$(security default-keychain 2>/dev/null | sed 's/[ "]//g' || true)"
+          previous_default_keychain="$(security default-keychain -d user 2>/dev/null | sed 's/[ "]//g' || true)"
 
           echo "CUSTOM_RELEASE_KEYCHAIN_PATH=$keychain_path" >> "$GITHUB_ENV"
           echo "CUSTOM_RELEASE_KEYCHAIN_PASSWORD=$keychain_password" >> "$GITHUB_ENV"
@@ -86,7 +86,6 @@ jobs:
           done < <(security list-keychains)
           security list-keychains -s "$keychain_path" "${existing_keychains[@]}"
           security list-keychains -d user -s "$keychain_path" "${existing_keychains[@]}" || true
-          security default-keychain -s "$keychain_path"
           security default-keychain -d user -s "$keychain_path" || true
           security list-keychains
           security list-keychains -d user || true
@@ -128,7 +127,6 @@ jobs:
         if: always()
         run: |
           if [ -n "${CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN:-}" ] && [ -e "$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN" ]; then
-            security default-keychain -s "$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN" || true
             security default-keychain -d user -s "$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN" || true
           fi
           if [ -n "${CUSTOM_RELEASE_KEYCHAIN_PATH:-}" ]; then
diff --git a/scripts/tests/test-custom-release-macos-runner.bats b/scripts/tests/test-custom-release-macos-runner.bats
index 5498fa9a6..0d05cc816 100644
--- a/scripts/tests/test-custom-release-macos-runner.bats
+++ b/scripts/tests/test-custom-release-macos-runner.bats
@@ -47,7 +47,7 @@ setup() {
 	run rg -n 'security find-identity -v -p codesigning "\$keychain_path"' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
-	run rg -n 'security default-keychain -s "\$keychain_path"' "$WORKFLOW"
+	run rg -n 'security default-keychain -d user -s "\$keychain_path"' "$WORKFLOW"
 	[ "$status" -eq 0 ]
 
 	run rg -n 'previous_default_keychain=' "$WORKFLOW"
@@ -60,7 +60,7 @@ setup() {
 	[ "$status" -ne 0 ]
 
 	run rg -n 'security default-keychain -s "\$CUSTOM_RELEASE_PREVIOUS_DEFAULT_KEYCHAIN"' "$WORKFLOW"
-	[ "$status" -eq 0 ]
+	[ "$status" -ne 0 ]
 
 	run rg -n 'security default-keychain -d dynamic' "$WORKFLOW"
 	[ "$status" -ne 0 ]