Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

osxkeychain: bring in line with other credential helpers #1667

Closed
wants to merge 4 commits into from
Closed

osxkeychain: bring in line with other credential helpers #1667

wants to merge 4 commits into from

Commits on Feb 17, 2024

  1. osxkeychain: replace deprecated SecKeychain API 

    The SecKeychain API was deprecated in macOS 10.10, nearly 10 years ago.
The replacement SecItem API however is available as far back as macOS
10.6.

While supporting older macOS was perhaps prevously a concern,
git-credential-osxkeychain already requires a minimum of macOS 10.7
since 5747c80 (contrib/credential: avoid fixed-size buffer in
osxkeychain, 2023-05-01) so using the newer API should not regress the
range of macOS versions supported.

Adapting to use the newer SecItem API also happens to fix two test
failures in osxkeychain:

    8 - helper (osxkeychain) overwrites on store
    9 - helper (osxkeychain) can forget host

The new API is compatible with credentials saved with the older API.

Signed-off-by: Bo Anderson <mail@boanderson.me>
    @Bo98
    Bo98 committed Feb 17, 2024
    Configuration menu
    Copy the full SHA
    f703131 View commit details
    Browse the repository at this point in the history

  2. osxkeychain: erase all matching credentials 

    Other credential managers erased all matching credentials, as indicated
by a test case that osxkeychain failed:

    15 - helper (osxkeychain) erases all matching credentials

Signed-off-by: Bo Anderson <mail@boanderson.me>
    @Bo98
    Bo98 committed Feb 17, 2024
    Configuration menu
    Copy the full SHA
    08284fa View commit details
    Browse the repository at this point in the history

  3. osxkeychain: erase matching passwords only 

    Other credential helpers support deleting credentials that match a
specified password. See 7144dee (credential/libsecret: erase matching
creds only, 2023-07-26) and cb626f8 (credential/wincred: erase
matching creds only, 2023-07-26).

Support this in osxkeychain too by extracting, decrypting and comparing
the stored password before deleting.

Fixes the following test failure with osxkeychain:

    11 - helper (osxkeychain) does not erase a password distinct from
    input

Signed-off-by: Bo Anderson <mail@boanderson.me>
    @Bo98
    Bo98 committed Feb 17, 2024
    Configuration menu
    Copy the full SHA
    f7ac228 View commit details
    Browse the repository at this point in the history

  4. osxkeychain: store new attributes 

    d208bfd (credential: new attribute password_expiry_utc, 2023-02-18)
and a5c7656 (credential: new attribute oauth_refresh_token,
2023-04-21) introduced new credential attributes but support was missing
from git-credential-osxkeychain.

Support these attributes by appending the data to the password in the
keychain, separated by line breaks. Line breaks cannot appear in a git
credential password so it is an appropriate separator.

Fixes the remaining test failures with osxkeychain:

    18 - helper (osxkeychain) gets password_expiry_utc
    19 - helper (osxkeychain) overwrites when password_expiry_utc
    changes
    21 - helper (osxkeychain) gets oauth_refresh_token

Signed-off-by: Bo Anderson <mail@boanderson.me>
    @Bo98
    Bo98 committed Feb 17, 2024
    Configuration menu
    Copy the full SHA
    f18435b View commit details
    Browse the repository at this point in the history