Fix deprecated TrustedApplicationAccess on Macos Catalina

[n11c]

Updated keybase/go-keychain dependency to remove deprecation warnings about TrustedApplicationAccess on Macos Catalina

resolves #56

[kjmph]

I can confirm I can build again with this patch. Unfortunately, I don't know the implications of the changes though.

[mtibben]

Trying this out with aws-vault, I no longer get a password prompt when aws-vault accesses the keychain

[mtibben]

Before:

After:

[n11c]

I believe the fact that aws-vault appears in the "always allow access" section is due to clicking on the 'always allow" button when entering the password.
At least I get the same behaviour by clicking on that button with the current aws-vault release.
That would indeed cause the password prompt not to be shown anymore.

I rebuilt aws-vault with this PR and I get the following behaviour:

• On first run I get a pass prompt to retrieve the password from the keychain
• If I only click "allow", it prompts me twice, don't know why
• If I click "always allow" it only prompts me once and aws-vault gets added to the list mentioned above as expected
• The keyring entry created to store the token automatically has aws-vault in the always allowed apps list, so that subsequent calls to aws-vault retrieve the token without prompting for the password (I didn't wait until it expired, but I guess it should then try to access the aws password and prompt for the keyring password if necessary)

Now, I'm far from being an OSX expert so this should be taken with a grain of salt.
I don't really know if these tests are enough to confirm that this PR does not create a security hole.
Hopefully someone more qualified can answer that.

[mtibben]

The point is to ensure that the user is prompted to "Allow" or "Always Allow". This PR changes the behaviour so that aws-vault is in the trusted list of apps by default which means the user is not prompted and is not the desired behaviour

[genevieve]

Hi @mtibben! We would really like to use a version of keyring that has the updated go-keychain dependency. Would you accept a PR that only updates the dependency?

[mtibben]

Hey @genevieve, absolutely yes if we can demonstrate that it behaves the same way. I have not been able to confirm this yet so have committed db030e0 temporarily

[mtibben]

See the comment at #66 (comment) on how to address this issue.