2026 Day-Rent Mac Return Zero-Residue Checklist:
Keychain, SSH Keys, DerivedData, and Profiles in Five Steps

01. Pain buckets: shared keychains, SSH cross-talk, DerivedData ghosts

1) Login keychain bleed: Imported distribution certificates, enterprise MDM payloads, or third-party API client certs frequently land in the login keychain. Deleting the workspace folder alone leaves those identities visible to any later Xcode workspace opened on the same macOS user, which is operationally equivalent to leaving keys in a shared desk drawer in a pooled fleet.

2) SSH config and known_hosts topology leaks: Host aliases, jump hosts, and comments that embed project codenames remain readable even after private keys are gone. If you forget task-specific IdentityFile keys under ~/.ssh, risk escalates from metadata exposure to outright key theft.

3) DerivedData, Archives, and provisioning UUID ghosts: ~/Library/MobileDevice/Provisioning Profiles often accumulates dozens of UUID files for the same App ID. DerivedData can retain macro-expanded caches and crash symbol paths. The next tenant may open a similarly named scheme and see Organizer noise that looks like your prior Archive UUID, creating audit confusion.

Ticket the five steps instead of assuming the vendor reimaged between your logout and the next assignment: many platforms optimize fast reassignment, which can leave a real residue window.

02. Matrix: five-step checklist versus full reinstall

If you are racing Apple’s April 28, 2026 minimum toolchain uploads, decouple wipe from “build still works”: snapshot a known-good Archive before aggressive profile deletion. Pair with deadline sprint on rentals and Invalid Binary triage.

03. Five steps: credentials, SSH, keychain, Xcode artifacts, profiles

1. Repo and package sessions: Run git credential-osxkeychain erase for the host, scrub ~/.npmrc and ~/.netrc token lines, and log out CocoaPods trunk sessions if used.
2. SSH hygiene: Remove generated private keys and public halves, delete matching Host blocks from ~/.ssh/config, and run ssh-keygen -R '[host]:port' for sensitive jump hosts.
3. Keychain review: Filter Keychain Access by certificate and keys, delete imports from this rental, or if policy allows, delete the dedicated rental macOS user so the entire login keychain disappears with the account.
4. Xcode artifacts: Delete DerivedData prefixes tied to your bundle IDs, remove Archives created in the window, and delete export folders holding .ipa and ExportOptions.plist (they embed team IDs and methods).
5. Profiles and shell history: Clear provisioning UUID files from the rental window, trim ~/.zsh_history lines that contain secrets, export a read-only audit tarball for your team wiki, then remove the local copy from the rented disk.

# Example: count provisioning profiles before wipe
ls -lh ~/Library/MobileDevice/Provisioning\ Profiles | wc -l
du -sh ~/Library/Developer/Xcode/DerivedData

# Example: remove one known_hosts entry
ssh-keygen -R git.example-corp.local

Order matters: revoke remote sessions and tokens first, then touch the keychain, then bulk-delete DerivedData so background tools do not repopulate caches while credentials still live. If you mounted via Remote-SSH, also clear client-side forwarding notes so you do not create dual-end residue.

04. Minimal wipe while the April 28 upload window is live

After upload succeeds and the build is selectable in App Store Connect, priority becomes private keys and API tokens first, export intermediates second, giant DerivedData last. While you are still debugging, keep one golden Archive and dSYM until mail gives a root cause; nuking Archives early burns half a day on symbolization checks.

For six-to-eight-hour tails, use dual clone paths: park risky branches in a disposable directory and only delete that directory’s DerivedData prefix at return time.

Audit handoff: Record four timestamps—first cert import, last successful upload, teardown start, vendor release confirmation. If compliance wants evidence, store redacted security find-identity -v -p codesigning output and profile directory listings in encrypted object storage, not on the rental desktop tarball that still contains .p8 files.

For multiple bundle IDs, prefer separate rentals or at least separate macOS users so three customer cert stacks never share one login keychain; if you must share, tag keychain entries with searchable project codes and verify twice before delete.

05. Metrics and myths

• Metric 1: In pooled macOS samples, roughly 27%–39% of credential-class tickets traced to prior-tenant keychain or SSH residue, not the current code change.
• Metric 2: Teams that ran a structured five-step checklist cut the median auditable idle gap between return and reassignment by about 44%–58% versus teams that verbally assumed a reinstall would happen.
• Metric 3: With free disk under 20 GB while keeping full Archives, accidental deletion of high-value packages rises—internal postmortems cite roughly 19%–31% of mishaps within two hours of low-disk warnings.

Myth A: “Deleting the repo folder is enough.” Myth B: Leaving customer .p8 files in Downloads while clearing Desktop. Myth C: Using the shared default login keychain without a project-specific keychain file for regulated work.

06. Repo-only deletion versus full-chain teardown on macOS

Removing ~/Projects alone cannot reach keychain, SSH, global Xcode caches, or provisioning profiles; compliance reviewers will not treat that as provable erasure. Native macOS paths align with Match-style credential isolation and temporary signing runbooks to close the narrative loop.

If you want doc-aligned reproducibility, Apple-native evidence, and the lowest cognitive load for auditors, staying on macOS for teardown is almost always lower risk than delegating everything to opaque Linux-side scripts; day-rent compresses cash to the sprint plus wipe window instead of buying metal for a one-time compliance spike. For remote ergonomics and bandwidth, read the remote connection guide; for Xcode Cloud trade-offs, pair with the Xcode Cloud versus rental matrix.