{"record":{"id":"fdb57050b423736e","repo":"moonD4rk/HackBrowserData","slug":"unlock-keychain-w","errorCode":null,"errorMessage":"unlock keychain: %w","messagePattern":"unlock keychain: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/retriever_darwin.go","lineNumber":64,"sourceCode":"\t\tlog.Debugf(\"gcoredump: %v\", r.err)\n\t\treturn nil, nil //nolint:nilerr // intentional silent fallthrough\n\t}\n\n\tkey, err := findStorageKey(r.records, hints.KeychainLabel)\n\tif err != nil {\n\t\tlog.Debugf(\"gcoredump: %v\", err)\n\t\treturn nil, nil //nolint:nilerr // intentional silent fallthrough\n\t}\n\treturn key, nil\n}\n\nfunc loadKeychainRecords(password string) ([]keychainbreaker.GenericPassword, error) {\n\tkc, err := keychainbreaker.Open()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"open keychain: %w\", err)\n\t}\n\tif err := kc.Unlock(keychainbreaker.WithPassword(password)); err != nil {\n\t\treturn nil, fmt.Errorf(\"unlock keychain: %w\", err)\n\t}\n\treturn kc.GenericPasswords()\n}\n\nfunc findStorageKey(records []keychainbreaker.GenericPassword, storage string) ([]byte, error) {\n\tfor _, rec := range records {\n\t\tif rec.Account == storage {\n\t\t\treturn darwinParams.deriveKey(rec.Password), nil\n\t\t}\n\t}\n\treturn nil, fmt.Errorf(\"%q: %w\", storage, errStorageNotFound)\n}\n\n// KeychainPasswordRetriever unlocks login.keychain-db with the macOS login password (no root).\n// Records are cached once and reused across browsers.\ntype KeychainPasswordRetriever struct {\n\tPassword string\n","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/retriever_darwin.go#L46-L82","documentation":"The keychain opened successfully but kc.Unlock(keychainbreaker.WithPassword(password)) failed; the error is wrapped as \"unlock keychain: %w\". Unlocking the login keychain requires the correct user login password.","triggerScenarios":"KeychainPasswordRetriever.RetrieveKey with a Password that is empty-check-passed but wrong, or when the keychain is locked and cannot be unlocked with the supplied password.","commonSituations":"User supplied the login password of a different account, the password was changed recently and the keychain kept the old one, or automation runs headless where the UI unlock prompt can't be answered.","solutions":["Confirm the Password field matches the current macOS login password of the keychain owner","Test the password manually: unlock the keychain in Keychain Access or via `security unlock-keychain`","If the keychain password differs from the login password, supply the keychain-specific password","Ensure the keychain is not locked: `security show-keychain-info login.keychain-db`"],"exampleFix":"// before\nr := &masterkey.KeychainPasswordRetriever{Password: \"password123\"}\n// after\npw := os.Getenv(\"USER_LOGIN_PASSWORD\")\nif pw == \"\" {\n\treturn nil, errors.New(\"USER_LOGIN_PASSWORD not set\")\n}\nr := &masterkey.KeychainPasswordRetriever{Password: pw}","handlingStrategy":"validation","validationCode":"if r.Password == \"\" {\n\treturn errors.New(\"keychain password required\")\n}\n// optional pre-check\ncmd := exec.Command(\"security\", \"unlock-keychain\", \"-p\", r.Password)\nif err := cmd.Run(); err != nil {\n\treturn fmt.Errorf(\"password rejected: %w\", err)\n}","typeGuard":"func (r *masterkey.KeychainPasswordRetriever) Configured() bool {\n\treturn r.Password != \"\"\n}","tryCatchPattern":"key, err := r.RetrieveKey(hints)\nif err != nil && strings.HasPrefix(err.Error(), \"unlock keychain:\") {\n\treturn nil, errors.New(\"wrong login password for keychain\")\n}","preventionTips":["Source the login password from a validated secure input","Verify the password with `security unlock-keychain` before library use","Handle password changes after macOS account password rotation"],"tags":["macos","keychain","authentication","wrong-password"],"backgroundTag":"authentication-required","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}