adrianbonpin/gridline
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

feat: pin keychain item ACLs to the app's code signature (macOS) (#21)

Browse Source
This commit was merged in pull request #21.
This commit is contained in:
adrianbonpin
2026-09-04 03:41:54 +00:00
parent a86f5f7199
commit fd451d219d
6 changed files with 223 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
desktop/src-tauri/src/commands/keychain.rs
+11 -3
View File
@@ -1,3 +1,4 @@
use crate::keychain_acl;
use tauri_plugin_keyring_store::KeyringExt;
/// Store a connection password in the OS keychain.
@@ -11,7 +12,10 @@ pub fn save_connection_password(
app.keyring()
.store
.set_password(&connection_id, &password)
.map_err(|e| e.to_string())
.map_err(|e| e.to_string())?;
// Best-effort: pin the item's ACL to this app so re-signed builds never prompt.
keychain_acl::after_store(&app, &connection_id);
Ok(())
}
/// Retrieve a connection password from the OS keychain.
@@ -55,7 +59,9 @@ pub fn save_connection_ssh_password(
app.keyring()
.store
.set_password(&ssh_account("password", &connection_id), &password)
.map_err(|e| e.to_string())
.map_err(|e| e.to_string())?;
keychain_acl::after_store(&app, &ssh_account("password", &connection_id));
Ok(())
}
/// Retrieve an SSH tunnel password from the OS keychain.
@@ -93,7 +99,9 @@ pub fn save_connection_ssh_passphrase(
app.keyring()
.store
.set_password(&ssh_account("passphrase", &connection_id), &passphrase)
.map_err(|e| e.to_string())
.map_err(|e| e.to_string())?;
keychain_acl::after_store(&app, &ssh_account("passphrase", &connection_id));
Ok(())
}
/// Retrieve an SSH private-key passphrase from the OS keychain.