git-ecosystem/git-credential-manager · error · InteropException

ErrorSecNoSuchAttr

ErrorSecNoSuchAttr

Error message

The attribute does not exist.

What it means

ThrowIfError maps macOS Security.framework (errSecNoSuchAttr) status codes to InteropException. This case fires when a keychain item attribute lookup asks for an attribute that the item does not carry. The Security framework returns the raw status and GCM converts it into a typed exception with a human-readable message.

Solutions

1. Request fewer attributes in the SecItem query, or tolerate a null value for optional attributes.
2. Inspect the keychain item (Keychain Access or `security find-generic-password`) to see which attributes it actually has.
3. Recreate the credential via GCM so all expected attributes are populated.
4. Catch InteropException and fall back to re-prompting for credentials.

Example fix

// before
var query = new SecRecord { Generic = service, Account = account, Label = "GCM" };
var attrs = item.Attributes;
// after
var attrs = item.Attributes;
string label = attrs.TryGetValue(SecAttribute.Label, out var l) ? l : null; // treat attribute as optional

if (expectedAttributes.Any(a => !item.Attributes.ContainsKey(a)))
    // skip or request fewer attributes before calling the keychain API

bool TryGetAttr(IDictionary<string,string> attrs, string key, out string value) { value = null; return attrs != null && attrs.TryGetValue(key, out value); }

try { cred = keychain.GetCredential(service, account); }
catch (InteropException ex) when (ex.Message.Contains("attribute does not exist"))
{ cred = new Credential(service, account, password: null); }

When it happens

Trigger: Calling a keychain attribute query (e.g. SecItemCopyMatching requesting specific attributes) against an item that lacks the requested attribute tag, so the OS returns ErrorSecNoSuchAttr.

Common situations: Reading credentials from keychain items created by other tools that store fewer/different attributes; querying attributes like account or label on items that only hold password data; macOS version differences in which attributes items carry.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• ErrorSecNoSuchKeychain
• ErrorSecInvalidKeychain
• ErrorSecAuthFailed
• ErrorSecDuplicateItem
• ErrorSecItemNotFound

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/58bfe4f5da88d7f8. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Interop/MacOS/Native/SecurityFramework.cs:156

            {
                case OK:
                    return;
                case ErrorSecNoSuchKeychain:
                    throw new InteropException("The keychain does not exist.", error);
                case ErrorSecInvalidKeychain:
                    throw new InteropException("The keychain is not valid.", error);
                case ErrorSecAuthFailed:
                    throw new InteropException("Authorization/Authentication failed.", error);
                case ErrorSecDuplicateItem:
                    throw new InteropException("The item already exists.", error);
                case ErrorSecItemNotFound:
                    throw new InteropException("The item cannot be found.", error);
                case ErrorSecInteractionNotAllowed:
                    throw new InteropException("Interaction with the Security Server is not allowed.", error);
                case ErrorSecInteractionRequired:
                    throw new InteropException("User interaction is required.", error);
                case ErrorSecNoSuchAttr:
                    throw new InteropException("The attribute does not exist.", error);
                default:
                    throw new InteropException(defaultErrorMessage, error);
            }
        }
    }

    [Flags]
    public enum SessionAttributeBits
    {
        SessionIsRoot = 0x0001,
        SessionHasGraphicAccess = 0x0010,
        SessionHasTty = 0x0020,
        SessionIsRemote = 0x1000,
    }

    [StructLayout(LayoutKind.Sequential)]
    public struct SecKeychainAttributeInfo
    {

View on GitHub (pinned to e8ce762cd0)