Existing password item in OSX keychain not found

[laghee]

I followed all the steps in the doc on creating a osx keychain password item, but when I run the following command: github-backup $ORG --keychain-name ghbackup --keychain-account laghee -o ./data --issues --issue-events --milestones --labels -R $REPO

I keep getting this error:

No password item matching the provided name and account could be found in the osx keychain.

This is my password item:

I'm on MacOS HighSierra (10.13.5).

Is there some other field that needs to be modified that isn't mentioned in the docs?

Since I only need to run one backup at the moment, I directly entered my credentials with the --username and --token flags, and that worked fine. But if I ever had to run several or set a script to back up automatically ... this would be a problem.

[martintoreilly]

@laghee Please could you run the following command from an OSX terminal window? This is the underlying command used to retrieve Keychain passwords. Thanks.
security find-generic-password -s 'ghbackup' -a 'laghee' -w

[laghee]

@martintoreilly OK, yep, that command successfully retrieves the token.

[martintoreilly]

Thanks. I'm not sure what's going on yet. I've done some digging around and I think the -s option ("service") actually maps to the Where field rather than the Name field in an OSX Keychain password (see help output below for option list). I found a Keychain item where using the Name field for the -s option failed but using the Where field succeeded.

> security find-generic-password --help
find-generic-password: illegal option -- -
Usage: find-generic-password [-a account] [-s service] [options...] [-g] [keychain...]
    -a  Match "account" string
    -c  Match "creator" (four-character code)
    -C  Match "type" (four-character code)
    -D  Match "kind" string
    -G  Match "value" string (generic attribute)
    -j  Match "comment" string
    -l  Match "label" string
    -s  Match "service" string
    -g  Display the password for the item found
    -w  Display only the password on stdout
If no keychains are specified to search, the default search list is used.
        Find a generic password item.

[laghee]

Oh, interesting. Yes, if I change the value of the where field to tacos, the command no longer works with ghbackup, but it does work with the new value. (I see the svce attribute is changed to tacos if I run the command without the -w flag.)

[einsteinx2]

It looks like the error is not the command, that's correct as has been confirmed by running it from the command line.

Turns out it's an exception being thrown on the next line: auth = token + ':' + 'x-oauth-basic'

Here's the exception (I just added a call to raise in the exception handler):

Traceback (most recent call last):
  File "/Users/bbaron/workspacep/python-github-backup/bin/github-backup", line 1127, in <module>
    main()
  File "/Users/bbaron/workspacep/python-github-backup/bin/github-backup", line 1119, in main
    authenticated_user = get_authenticated_user(args)
  File "/Users/bbaron/workspacep/python-github-backup/bin/github-backup", line 591, in get_authenticated_user
    data = retrieve_data(args, template, single_request=True)
  File "/Users/bbaron/workspacep/python-github-backup/bin/github-backup", line 456, in retrieve_data
    return list(retrieve_data_gen(args, template, query_args, single_request))
  File "/Users/bbaron/workspacep/python-github-backup/bin/github-backup", line 412, in retrieve_data_gen
    auth = get_auth(args)
  File "/Users/bbaron/workspacep/python-github-backup/bin/github-backup", line 341, in get_auth
    auth = token + ':' + 'x-oauth-basic'
TypeError: can't concat str to bytes

When I log the token variable, it is in fact bytes not a string, however this is a Python 3 issue only. When run using Python 2, it works as expected.

Adding the following before concatenating the token fixes the issue:

if not PY2:
    token = token.decode('utf-8')

Submitting a PR now :)

[einsteinx2]

@josegonzalez Looks like my "closes" line in the PR comment didn't automatically close this issue, but it can be closed now that this is merged.