Repository navigation
Switch to native bindings for macOS Keychain #7123
Description
Prerequisites:
- our darwin builds should be code-signed and notarized
- we should enable cgo in our darwin builds
Any reason why you are not using https://github.com/99designs/keyring besides the cgo problem? The zalando one forks a security command on MacOS, which is not a secure practice really.
I have to grant access to the security cli for the github auth token access, and security can then be invoked with any other shell script after that, losing control of who I grant access to those creds.
The 99designs lib does not have this problem, as it uses native API-s, so MacOS would prompt me to grant access to gh only.
Using the security cli tool directly opens up people's hosts to malicious shell scripts also being able to use the security cli tool and gaining access to the credentials, partially defeating the purpose of storing those secrets in the keychain.
Originally posted by @reegnz in #7023 (comment)
Activity
Use native keychain bindings if possible
YorikSar commentedon Jul 24, 2023
Am I correct in understanding that prerequisites have been covered by #7324? If so, please consider #7743.
samcoe commentedon Aug 7, 2023
@YorikSar You are correct in that the prerequisites for this work are now in place. The team is unsure if now is the right time to take on this work as it would be a breaking change and likely require all our users to re-authenticate.
YorikSar commentedon Aug 7, 2023
@samcoe Thank you for your reply. I will add code that will convert go-keyring format (prefixed base64-encoded string) to the "new" format (plain data). That would allow to reuse existing token. After that all that user will have to do is authorise
ghto access this value, no reauthentication required.Use native keychain bindings if possible
Use native keychain bindings if possible
Use native keychain bindings if possible
YorikSar commentedon Aug 7, 2023
Done. Please see the PR for the additional compatibility code.
vilmibm commentedon Aug 15, 2023
Thanks for the new commits! Without having to force people to re-authenticate we are far more interested in merging this work. Unfortunately our team is stretched so thin right now we can't give this work the QA attention it deserves.
I'm going to mark this as blocked for now for us to revisit once we have more bandwidth towards the end of the year.
Use native keychain bindings if possible
Swap from keyring to using `security` directly for debug builds.
Use native keychain bindings if possible
Use native keychain bindings if possible
Use native keychain bindings if possible
BagToad commentedon Feb 1, 2025
Re: using
99designs/keyring- the maintenance status of this project is currently unknown and assumed to be unmaintained.Looking for more discussion on this issue to seek alternative solutions.
hectorpal commentedon Mar 17, 2026
@mbevc1 mentioned on Jan 19, 2026