{"record":{"id":"4b4b1d579b597353","repo":"moonD4rk/HackBrowserData","slug":"security-command-w-s","errorCode":null,"errorMessage":"security command: %w (%s)","messagePattern":"security command: %w \\((.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/retriever_darwin.go","lineNumber":148,"sourceCode":"\tctx, cancel := context.WithTimeout(context.Background(), securityCmdTimeout)\n\tdefer cancel()\n\n\tvar stdout, stderr bytes.Buffer\n\tcmd := exec.CommandContext(ctx, \"security\", \"find-generic-password\", \"-wa\", strings.TrimSpace(storage)) //nolint:gosec\n\tcmd.Stdout = &stdout\n\tcmd.Stderr = &stderr\n\n\tif err := cmd.Run(); err != nil {\n\t\tif errors.Is(ctx.Err(), context.DeadlineExceeded) {\n\t\t\treturn nil, fmt.Errorf(\"security command timed out after %s\", securityCmdTimeout)\n\t\t}\n\t\t// `security` exits non-zero with empty stderr when the user denies the prompt or mistypes;\n\t\t// surface that instead of the cryptic \"exit status 128 ()\".\n\t\tstderrStr := strings.TrimSpace(stderr.String())\n\t\tif stderrStr == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"security command: %w (likely keychain access denied or wrong password)\", err)\n\t\t}\n\t\treturn nil, fmt.Errorf(\"security command: %w (%s)\", err, stderrStr)\n\t}\n\tif stderr.Len() > 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: %s\", strings.TrimSpace(stderr.String()))\n\t}\n\n\tsecret := bytes.TrimSpace(stdout.Bytes())\n\tif len(secret) == 0 {\n\t\treturn nil, fmt.Errorf(\"keychain: empty secret for %s\", storage)\n\t}\n\n\treturn darwinParams.deriveKey(secret), nil\n}\n\n// DefaultRetrievers wires the macOS V10 chain (the only tier Chromium uses here), first success wins:\n//  1. GcoredumpRetriever        — CVE-2025-24204 exploit (root only)\n//  2. KeychainPasswordRetriever — direct unlock, skipped when password is empty\n//  3. SecurityCmdRetriever      — `security` CLI fallback (may prompt)\nfunc DefaultRetrievers(keychainPassword string) Retrievers {","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/retriever_darwin.go#L130-L166","documentation":"The `security` command exited non-zero with non-empty stderr; the exec error and the captured stderr text are wrapped as \"security command: %w (%s)\" so the OS-level diagnostic (e.g. \"SecKeychainSearchCopyNext: The specified item could not be found in the keychain\") is preserved alongside the exit status.","triggerScenarios":"cmd.Run() fails, ctx deadline not exceeded, and stderr contains text — the retriever surfaces both the exit error and stderr contents from `security find-generic-password`.","commonSituations":"The requested generic-password item doesn't exist (item not found message), the service/account name was misspelled, or keychain-level errors printed by `security`.","solutions":["Read the stderr text in the parentheses — it contains the specific `security` diagnostic","If it says the item could not be found, verify the storage/service name with `security dump-keychain`","Check spelling of the account passed via -wa against actual keychain records","If the item truly is absent, handle via errors.Is(errStorageNotFound) fallback rather than retrying"],"exampleFix":"// before\nkey, err := r.RetrieveKey(hints)\nreturn key, err\n// after\nkey, err := r.RetrieveKey(hints)\nif err != nil && strings.Contains(err.Error(), \"could not be found\") {\n\tlog.Warnf(\"keychain item %q missing: %v\", hints.Storage, err)\n}\nreturn key, err","handlingStrategy":"try-catch","validationCode":"out, err := exec.Command(\"security\", \"find-generic-password\", \"-a\", storage).CombinedOutput()\nif err != nil {\n\treturn fmt.Errorf(\"pre-check failed: %s\", out)\n}","typeGuard":"func isItemMissing(err error) bool {\n\treturn err != nil && strings.Contains(err.Error(), \"could not be found\")\n}","tryCatchPattern":"key, err := r.RetrieveKey(hints)\nif err != nil {\n\tvar secErr *exec.ExitError\n\tif errors.As(err, &secErr) {\n\t\tlog.Printf(\"security stderr: %s\", secErr.Stderr)\n\t}\n}","preventionTips":["Parse the stderr embedded in the error for the exact `security` diagnostic","Verify the exact service/account name before retrieval","Treat item-not-found stderr as a permanent condition, not retryable"],"tags":["macos","keychain","subprocess","security-cli","error-wrapping"],"backgroundTag":"git-command-failed","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}