microsoft/keyper

A Python wrapper around the macOS keychain. A keyper of the keys, if you will.

keyper

A Python 3 library for dealing with the macOS Keychain.

Please note that this library requires openssl 3.0 or above to function.

Installation

pip install keyper

Examples:

import keyper

# Get a password from the keychain
password = keyper.get_password(label="my_keychain_password")

# Create a temporary keychain and install the certificate:

with keyper.TemporaryKeychain() as keychain:
    certificate = keyper.Certificate("/path/to/cert", password="password")
    keychain.install_cert(certificate)
    # Use codesign or similar here

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.

When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

keyper's Issues

test_certificates failed

test_creating_cert(self) failed for self.assertEqual(certificate.common_name, "TestCert_CodeSign/C=GB")
The common_name of the test certificate is None by method _get_common_name(self)

The subject get from the cert is "subject=CN = TestCert_CodeSign, C = GB, emailAddress = [email protected]", it doesn't match the regex
match = re.search(r"subject=./CN=(.)./.", subject).

And the match result shouldn't be "TestCert_CodeSign/C=GB"?

tempfile.mkstemp() ?

https://github.com/Microsoft/keyper/blob/364093bfe3e9b54c14782271b577651c34a9e9c0/keyper/__init__.py#L349-L350

I'm curious about whether the above code could be replaced with something like this?

>>> import tempfile
>>> _, keychain_path = tempfile.mkstemp(suffix='.keychain')
>>> keychain_path
'/tmp/tmpf2esejjx.keychain'

# or if uuid.uuid4() is somehow important?
>>> import uuid
>>> _, keychain_path = tempfile.mkstemp(suffix='.keychain', prefix=str(uuid.uuid4()))
>>> keychain_path
'/tmp/a937c7db-88a8-4074-b9fe-98bd73e5e50ejw_04vhl.keychain'

It seems like going this route would allow you to also remove this check afterwards too.

https://github.com/Microsoft/keyper/blob/364093bfe3e9b54c14782271b577651c34a9e9c0/keyper/__init__.py#L353-L354

• https://docs.python.org/3/library/tempfile.html#tempfile.mkstemp