def unlock_keychain(username):
    """ If the user is running via SSH, their Keychain must be unlocked first. """

    if 'SSH_TTY' not in os.environ:
        return

    # Don't unlock if we've already seen this user.
    if username in _unlocked:
        return

    _unlocked.add(username)

    if sys.platform == 'darwin':
        sys.stderr.write("You are running under SSH. Please unlock your local OS X KeyChain:\n")
        subprocess.call(['security', 'unlock-keychain'], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
If the user is running via SSH, their Keychain must be unlocked first.