Re: Modifying Emacs to use the Mac OS X Keychain Services

[Harald Hanche-Olsen <hanche@math.ntnu.no>]

(This probably doesn't really belong on the emacs-devel mailing list,
but if we keep it short, maybe nobody will object. My apologies if
someone does object. I skip the copy to ding@gnus.org, since I am not
on that list myself, and don't even know what it's for.)

[Dave Abrahams <dave@boostpro.com> (2012-07-27 15:20:17 UTC)]

> I looked a bit at the "secrets" API but could understand it easily
> enough to code something up.

It's a bit messy, with output clearly meant for human consumption and
not for programs.

> I just want Emacs to run
> 
>    /usr/bin/security --find-internet-password -gs <hostname> <username>
> 
> to get the password for my mail server.

Since this scratches an itch of my own, I cooked up the following.
Feel free to adapt, bend and mutilate it to your heart's content.

(defun get-keychain-password (service)
  "Get a generic password from the OS X keychain.
The password is associated with the string SERVICE.
This corresponds to the Account field in the Keychain Access GUI.
BUG: If there is no matching password, or the output of /usr/bin/security
has an unexpected format, the function silently returns NIL."
  (with-temp-buffer
    ;; /usr/bin/security outputs all kinds of info on stdout
    ;; oddly, the password itself appears on stderr, in the form
    ;; password: "..." with a final newline
    ;; No escape mechanism appears to be used for quotes etc in the password
    (call-process "/bin/sh" nil (list (current-buffer) t) nil
		  "-c" "/usr/bin/security \"$@\" >/dev/null" "-"
		  "find-generic-password" "-gs" service)
    (let ((min (point-min))
	  (max (point-max)))
      (when (and (> (- max min) 13)
		 (string= (buffer-substring-no-properties min (+ min 11))
			  "password: \"")
		 (string= (buffer-substring-no-properties (- max 2) max)
			  "\"\n"))
	(buffer-substring-no-properties (+ min 11) (- max 2))))))

- Harald