Hive Hive
Sign in
Overview
Projects
Domains
Forage
Flights
Specs
Postmortems
Drops

SwifterPM opens a “use your confidential information in your keychain” popup when installing dependencies

GitHub issue · Open

Metadata
Source
tuist/tuist #13681
Updated
Oct 21, 2026
Details

What happened?

After updating to Tuist 4.210.0, when running tuist install, I have a macOS popup that says “tuist wants to use your confidential information stored in github?com in your keychain. To allow this, enter the “login” keychain password.”.

It’s because I have private repos in my dependencies that are under HTTPS authentication. There is one popup for each dependency, which is annoying since I need to enter my password for each one. I am HTTPS authenticated using the gh CLI.

Building with TUIST_USE_SWIFTERPM=0 makes the popup go away.

How do we reproduce it?

  1. Add a private, HTTPS based repo to the package dependencies (not SSH)
  2. run tuist install

Error log

There are no error messages.

macOS version

26.7

Tuist version

4.210.0

Xcode version

27.0

Flights

Investigate, reproduce, or fix this item in an isolated repository. Each Flight preserves its outcome and agent session.

New Flights are paused Configure model inference, GitHub, and a sandbox provider to start another Flight. Existing results remain available below.
No Flights yet

Start a Flight and preserve its objective, outcome, and session here.

Comments
S
sphanley Sep 29, 2026

I reported the same issue here, and was suggested a decent workaround by Dosu: #12267

NS
nathansalaun-sofia Sep 29, 2026

@sphanley I already have a workaround, it’s using TUIST_USE_SWIFTERPM.

However I am not satisfied with a workaround. If Tuist decides to replace a first party, well-established piece of software (SwiftPM) by its own reimplementation (SwifterPM), it should be an impeccable replacement and work perfectly identical to the original.

S
sphanley Sep 29, 2026

Sure, understood and totally agreed! I’m just offering that providing credentials via SWIFTPM_REGISTRY_TOKEN rather than from the keychain does allow SwifterPM to function in an authenticated scenario rather than disabling it via TUIST_USE_SWIFTERPM. I’m in full agreement that ideally, SwifterPM should be fixed to correctly support credentials from the keychain consistent with how SwiftPM operates.