Re: Modifying Emacs to use the Mac OS X Keychain Services

[Ben Key <bkey76@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2591 bytes --]

Michael Albinus <michael.albinus@gmx.de> wrote:

> I'm not using OS X, could you, please, send me a pointer to the Keychain
> Services API?
>
>
Some information on the Keychain Services API can be found at the Keychain
Services Tasks for Mac OS X page found at
http://developer.apple.com/library/mac/#documentation/Security/Conceptual/keychainServConcepts/03tasks/tasks.html.
More detailed information can be found at the Keychain Services Reference
page found at
http://developer.apple.com/library/mac/#documentation/Security/Reference/keychainservices/Reference/reference.html
.

While the Keychain Services API does not exactly mirror the
org.freedesktop.secrets interface it is possible to implement the same
concepts expressed in secrets.el via the Keychain Services API.  For
example, a ns-secrets-create-item function could be easily defined that has
the same parameters as secrets-create-item.  This function would use
SecKeychainOpen to open the keychain specified by the collection parameter,
and if the call to SecKeychainOpen failed, it could use SecKeychainCreate to
create the specified keychain.  It then could use
SecKeychainAddGenericPassword to add the item specified by the item
parameter with the password specified by the password parameter, to the
opened or newly created keychain.  The attributes parameter could be
processed by calling SecKeychainItemModifyAttributesAndData.

The ns-secrets-delete-item, ns-secrets-get-secret, and
ns-secrets-get-attributes functions could also be written similarly.  I am
not certain about the other functions, mainly because I have not yet
finished my research.

The point is, I can implement ns- equivalents in C for most, if not all of
the functions defined in secrets.el with the same parameters and nearly the
same behavior.  I may even be able to make them behave exactly the same as
their secrets.el counterparts.

Once the functions are defined in C, we can later decide how to call them
from Lisp.  We can decide to call them from secrets.el by having each of the
functions use the following psudeo code

(if (fboundp 'ns-{func})
  call ns-{func}
use dbus)

or we could add another auth source to auth-source.el.  Either way would
work for me.

Perhaps I should just focus on writing the ns- equivalents of each of the
secrets.el functions and we can decide later how to call them.  What do you
think?

Note: I am not exactly certain how to parse the attributes parameter of my
proposed ns-secrets-create-item function.  If someone can point me to an
example of how to process something like that in C it would be helpful.

[-- Attachment #2: Type: text/html, Size: 3272 bytes --]