ERROR: Carries no Signing KeyFailed to export AirTag Data using CLI route -

[paula-coder-646]

Hey there,
first of all, thank you for providing the CLI tool for exporting the Airtag Data. I could not get the Virtual-MacOS Route to work sadly so I am glad there is another way now.

Unfortunately it still fails for me, as after Signing in, entering the OTP code and providing a screen-password for one of my devices,
i get the following error, and no my-tags.zip file is generated.

Error Message:

WARNING findmy.keychain.peers: Peer SHA256:b+JfaSsd0OwGfMt/YzJlgTlKYY4p0qJW37a3MuFvjek= carries no signing key
WARNING findmy.keychain.peers: Peer SHA256:2xg01vc1zN6apifnU3N8oEYh2A3S4EkziK7VqdGjKl4= carries no signing key

Apple returned something unexpected: Truncated DER: element claims 109 bytes, 61 remain

Potential Diagnosis & Contrib. Factors:

I am running EndevorOS on the 7.1.7-arch1-1 Kernel, and my Apple Account has two areas, which might be the reason:

• I use Lockdown Mode on all of my devices, but as the Data should be in ICloud, I am not sure how much of an issue this is. However, when logging into ICloud manually over the Browser, I can also only see my IPad (for uni) in the FindMy section, but no Airtag. Is this to be expected ?
• Secondly: I use Advanced Data Protection in ICloud which I think is the issue:

As I read it, due to ADP, the Signing Keys for the Airtag are only exchanged between my IOS Devices right ? Is there a way this can be handled in the exporter, or is the only way turning off ADP ?

Thank you for your help <3
Best
Paula

[parawanderer]

Hi Paula, thanks for the detailed report.

ADP isn't the cause. Look at your own screenshots again — that table has four value columns (Standard: encryption, key custody / ADP: encryption, key custody). Both your rows read the same on both sides, so keychain data is end-to-end encrypted and held only by your trusted devices whether ADP is on or off. Turning it off would change nothing. That's also why the exporter asks for a device passcode at all. (And "W1 and H1 Bluetooth keys" is AirPods, not AirTags.)

The two carries no signing key warnings are harmless — those peers are skipped, the run continues.

The real error is a bug on our side, and the message was useless. Truncated DER is produced identically by about forty places in the code, so I couldn't tell which one you hit. It now prints a stack trace saying exactly where. That's in exporter 1.2.0, out now.

Could you re-run and paste the traceback?

git pull
cd python && uv sync
uv run python -m exporter.cli -vv --no-password --output my-tags.zip

⚠️ -vv prints your device names, models and serial numbers. Replace anything you don't want public with XXXX — it won't stop me reading the stack. (1.2.0 warns about this in red now.)

One other thing, possibly the actual problem: you mentioned iCloud.com shows only your iPad and no AirTag. Two questions:

1. Do the AirTags appear under Items in the Find My app on your iPad?
2. Were they originally set up on the same Apple account you're signing the exporter in with? Only the owning account can export a tag — shared ones don't work (Allow MacOS Users who had an airtag shared with them to export those AirTags #6).

If either is no, that's the real issue and the DER error is a separate bug I should fix anyway.

[paula-coder-646]

Hey Shane,
First of all, I must say thank you for being so understanding, and also for getting back to me so quickly. People like you are what make me enjoy engaging with FOSS so much, so truly: Thank you :)

I have attached the traceback for you, where I only blurred my Apple ID & serial.
To address both your questions:

1. Yes, they all appear under the Items tab on my IPad (5 official AirTags).
2. Yep, they are all registered on my account.

If you need more Informations, just ask
Best
Paula

OpenTag-Debug.txt

[parawanderer]

Fixed and merged. Thanks, your traceback pinned it to the exact line.

It was a bug in how we skip unreadable keychain items: two of them on your account were skipped correctly and a third took the whole export down instead. Nothing to do with ADP, and nothing wrong with your account.

To get it:

cd OpenTagViewer
git pull
cd python && uv sync
uv run python -m exporter.cli --no-password --output my-tags.zip

If it still doesn't work, re-run with -vv and paste the last ~30 lines. (Note that -vv` prints your device names, models and serial numbers. So replace anything you don't want public.)