title: After set-key-partition-list codesign still prompts for key access
body: <p>I'm importing a <code>PEM</code> file containing public and private keys for my code signing identity with the following command:</p>
  
  <pre><code>security import "${PEM_FILE}" -k ~/Library/Keychains/login.keychain -T /usr/bin/codesign -T /usr/bin/security
  </code></pre>
  
  <p>On <code>OS X 10.11 El Capitan</code> I could then <code>codesign</code> without a prompt:</p>
  
  <pre><code>codesign --force --sign "${IDENTITY_HASH}" --timestamp=none `mktemp`
  </code></pre>
  
  <p>However, as <a href="https://stackoverflow.com/q/39868578/9636">others</a> have <a href="https://stackoverflow.com/q/39868578/9636">mentioned</a>, <code>OS X 10.12 Sierra</code> now requires that you <code>set-key-partition-list</code> after <code>import</code>:</p>
  
  <pre><code>security set-key-partition-list -S apple-tool:,apple: -s -k "${PASSWORD}" ~/Library/Keychains/login.keychain
  </code></pre>
  
  <p>However, even after <code>set-key-partition-list</code>, I still get a UI dialog asking for permission to access my private key for code signing:</p>
  
  <p><a href="https://i.stack.imgur.com/LrL1J.png" rel="noreferrer"><img src="https://i.stack.imgur.com/LrL1J.png" alt="&quot;codesign wants to access key&quot; dialog"></a></p>
  
  <p>If I click <code>Always Allow</code>, then future <code>codesign</code> calls don't prompt, but I don't ever want that UI dialog to prompt. I want this all to be scriptable.</p>
  
  <p>Why does <code>set-key-partition-list</code> work for other folks, and not for me?</p>