adrianbonpin/gridline
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

feat: pin keychain item ACLs to the app's code signature (macOS)

Browse Source 
After every keychain write, replace the item's ACL with an explicit
SecAccess whose trusted-application list is this app's code-signature
requirement (SecTrustedApplicationCreateFromPath(NULL)):

- New installs: items are ACL-pinned from the first save, so future
  upgrades never prompt (Developer ID requirement is stable).
- Upgraders from ad-hoc builds: the first access shows the standard
  one-time prompt; 'Always Allow' now permanently rewrites the ACL
  instead of just appending, so stale ad-hoc entries are cleaned up.
- Ref-only item lookup (kSecReturnRef) never prompts, and failures are
  swallowed so keychain writes never fail because of ACL work.
This commit is contained in:
adrianbonpin
2026-09-04 11:41:42 +08:00
parent a86f5f7199
commit a1fba89e07
6 changed files with 223 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+1 -1
View File
@@ -244,7 +244,7 @@ Planned work is prioritized in the [Project Roadmap](./ROADMAP.md) (source of tr
| DB Viewer: SQLite browse + query | ✅ | Full support via rusqlite |
| DB Viewer: MySQL browse + query + edit | ✅ | Full viewer: connect (SSL + SSH tunnel), databases/tables/columns/FKs, query + pagination, inline cell editing + changes queue, DDL copy (`SHOW CREATE TABLE`), CSV/JSON import — added in v0.7.0. PK-only editing (no ctid equivalent); VARBINARY `information_schema` columns decoded correctly |
| DB Viewer: Redis browse | ❌ | Connection + test only; browsing gated off with a clean "not supported" state (v0.7.0) |
| Password storage in OS keychain | ✅ | macOS Keychain, Linux Secret Service, Windows Credential Manager |
| Password storage in OS keychain | ✅ | macOS Keychain, Linux Secret Service, Windows Credential Manager; macOS items get an explicit `SecAccess` ACL pinning them to the app's code-signature requirement on every save (`keychain_acl.rs`) — items survive re-signs/upgrades without keychain permission prompts |
| Enable keychain toggle | ✅ | Default ON (opt-out); OFF = don't persist the DB password (session-only, re-prompt on connect) + purge existing keychain entry; SSH secrets stay keychain-only (v0.7.6) |
| SSH tunnel config UI | ✅ | Host, port, user, auth method, key path, passphrase fields |
| SSH tunnel runtime | ✅ | Real ssh2 tunnel (password + key auth), binds 127.0.0.1 only, secrets in OS keychain (`ssh_password:<id>` / `ssh_passphrase:<id>`), closed on pool eviction / app exit; TLS downgraded to `require` through the tunnel |