SwifterPM does not use Keychain internet password credentials

Metadata

Source

tuist/tuist #12235

Updated

Aug 6, 2026

Domains

Generated projects

Details

What happened?

SwifterPM does not use the internet passwords stored in the keychain. Therefore it tries to download assets without an authentication header. This fails tuist install when the project depends on private GitHub assets (e.g. 'https://api.github.com/repos/<org>/<repo>/releases/assets/<id>.zip)

How do we reproduce it?

Have an internet password for https://api.github.com stored in the Keychain:

Have a binary target in a Package.swift file of the Tuist project tree. For example:

.binaryTarget(name: "Foo", url: "https://api.github.com/repos/myorg/myrepo/releases/assets/assetid.zip", checksum: "assetchecksum"),

Run tuist install with SwifterPM enabled (TUIST_USE_SWIFTERPM=1 or tuist >= 2.203.0)

Error log

tuist install

Resolving and fetching plugins.
Resolving and fetching dependencies.
swifterpm 0.9.0
Downloading binary artifact https://api.github.com/repos/myorg/myrepo/releases/assets/assetid.zip
error: failed downloading 'https://api.github.com/repos/myorg/myrepo/releases/assets/assetid.zip' which is required by binary target 'Foo': badResponseStatusCode(401)
error: fatalError
✖ Error
  exited(1)

  Sorry this didn’t work. Here’s what to try next:
   ▸ If the error is actionable, address it
   ▸ If the error is not actionable, let's discuss it in the [Troubleshooting & how to](https://community.tuist.dev/c/troubleshooting-how-to/6)
   ▸ If you are very certain it's a bug, [file an issue](https://github.com/tuist/tuist)
   ▸ Check out the logs at /Users/steffen/.local/state/tuist/sessions/C6CFB9A3-774F-4612-874C-2C610C379040/logs.txt

macOS version

26.5.2

Tuist version

4.203.1

Xcode version

26.6.0

Flights

Investigate, reproduce, or fix this item in an isolated repository. Each Flight preserves its outcome and agent session.

New Flights are paused Configure model inference, GitHub, and a sandbox provider to start another Flight. Existing results remain available below.

No Flights yet

Start a Flight and preserve its objective, outcome, and session here.

Comments

D

dosubot[bot] Aug 6, 2026

@HeEAaD Thanks for the detailed report. This is a legitimate gap in SwifterPM’s authentication handling.

SwifterPM has two separate auth code paths: one for registry packages (RegistryAuthorization) which does read macOS Keychain internet passwords, and one for binary artifact downloads (HTTPAuthorization) which does not [1] [2]. So your Keychain credentials are simply never consulted when downloading binary targets.

Workaround: You can authenticate private binary artifact downloads using either:

A .netrc file (~/.netrc) with your GitHub credentials:

machine api.github.com
login <your-username>
password <your-personal-access-token>

The GITHUB_TOKEN or GH_TOKEN environment variable (automatically picked up for github.com / api.github.com hosts) [3].
Having the GitHub CLI (gh) authenticated — SwifterPM will call gh auth token as a fallback.

Any of these should unblock you while this issue is addressed.

To reply, just mention @dosu.

Share context across your team and agents. Try Dosu.

J

Jon889 Aug 20, 2026

We are facing this issue at Tesco as well

P

pepicrft Aug 20, 2026

Taking a look