Package: keyrings.osx-keychain-keys
This library is a backend addon forkeyring, it provides a backend that manages
OSX keychain key-class items.Supported features:Auto-generating keys viaSecKeyCreateRandomKeyImporting existing keys of various formats viaSecItemAddStoring keys in keychain, or generating transient keysStoring keys in the secure enclave (T2 chip - ‘TPM’); for code-signed interpretersLimiting key management to specific access groups; for code-signed interpretersMaking keys non-extractable, so that the key content could not be retrieved, but only used for signing or encryptionInstallationRun the following (on a darwin machine):$ pip install keyrings.osx_keychain_keysUsing This BackendOne can utilize this backend both programatically, or from the CLI.importkeyringfromkeyrings.osx_keychain_keys.backendimportOSXKeychainKeysBackend,OSXKeychainKeyType,OSXKeyChainKeyClassTypebackend=OSXKeychainKeysBackend(key_type=OSXKeychainKeyType.RSA,# Key type, e.g. RSA, RC, DSA, ...key_class_type=OSXKeyChainKeyClassType.Private,# Private key, Public key, Symmetric-keykey_size_in_bits=4096,is_permanent=True,# If set, saves the key in keychain; else, returns a transient keyuse_secure_enclave=False,# Saves the key in the T2 (TPM) chip, requires a code-signed interpreteraccess_group=None,# Limits key management and retrieval to set group, requires a code-signed interpreteris_extractable=True# If set, private key is extractable; else, it can't be retrieved, but only operated against)keyring.set_keyring(backend)# If password is not set - a key is generatedkeyring.set_password('some-label','some-tag',password=None)# If password is set - it could be a file path to a key to import to keychainkeyring.set_password('some-label','some-tag','/tmp/my-private.key')# It could also be the key-data itselfkeyring.set_password('some-label','some-tag','-----BEGIN RSA PRIVATE KEY----\n....')# Returns a python-wrapped (using hazmat cryptography lib) private / public keykeyring.get_password('some-label','some-tag')# Deletes a key from keychainkeyring.delete_password('some-label','some-tag')See more examples inkeyrings/osx_keychain_keys/examplesandkeyrings/osx_keychain_keys/tests.Command-line UtilityOne can also use the keyring CLI to operate against this backend:$ keyring -b keyrings.osx_keychain_keys.backend.OSXKeychainKeysBackend set "some-label" "some-tag"Security ConsiderationsUsing mac’s keychain has some caveats that should be noted, namely:Some keychain APIs require the invoking application (the python interpreter, in this case) to be code-signed with
specific Apple entitlements, namely:Saving the key to the secure enclave (T2 / TPM chip)Limiting access via access controls (i.e. requiring touch-id / password before key retrieval)Limiting key management to specific access groupsBy default, all inserted keys are accessible to the runnable executable, meaning
the interpreter you use can manage the generated or imported keys.If you use a virtualenv, you may create one with$> venv--copiesto limit accessibility to the specific venv
python binary.Making ReleasesA CI/CD pipeline is setup on github - once a PR is merged to master, a pre-release
will be automatically deployed to github;
When a release is tagged, it will be automatically deployed to pypi.Running TestsTo run the tests locally (a darwin machine is required), install and invoketox.