Repository: Versent/saml2aws
Pull request #220 (2018-09-11 23:03:39)

Revert "feat(secretservice) Add linux secret service support."
This reverts commit fcf89c4b4ffc974e03f2c63678035ce157c4c2fd.


Patch:
diff --git a/.travis.yml b/.travis.yml
index 9dc2f2f..30af358 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,7 +1,4 @@
-sudo: required
 language: go
-os:
-    - osx
 go:
     - "1.10"
 
@@ -13,17 +10,6 @@ install:
 env:
     - "PATH=/home/travis/gopath/bin:$PATH"
 
-before_script:
-    - "export DISPLAY=:99.0"
-    - if [[ "$TRAVIS_OS_NAME" == "linux"  ]]; then sh ci/before_script_linux.sh; fi
-            
 script:
     - make ci
 
-addons:
-    apt:
-        packages:
-        - build-essential
-        - fakeroot
-        - git
-        - libsecret-1-dev
diff --git a/ci/before_script_linux.sh b/ci/before_script_linux.sh
deleted file mode 100644
index eb3ac19..0000000
--- a/ci/before_script_linux.sh
+++ /dev/null
@@ -1,4 +0,0 @@
-set -ex
-
-sh -e /etc/init.d/xvfb start
-sleep 3 # give xvfb some time to start
diff --git a/cmd/saml2aws/commands/login_linux.go b/cmd/saml2aws/commands/login_linux.go
deleted file mode 100644
index a971815..0000000
--- a/cmd/saml2aws/commands/login_linux.go
+++ /dev/null
@@ -1,10 +0,0 @@
-package commands
-
-import (
-	"github.com/versent/saml2aws/helper/credentials"
-	"github.com/versent/saml2aws/helper/secretservice"
-)
-
-func init() {
-	credentials.CurrentHelper = &secretservice.Secretservice{}
-}
diff --git a/helper/secretservice/secretservice_linux.c b/helper/secretservice/secretservice_linux.c
deleted file mode 100644
index 45e9d54..0000000
--- a/helper/secretservice/secretservice_linux.c
+++ /dev/null
@@ -1,184 +0,0 @@
-// Copyright (c) 2016 David Calavera
-
-// Permission is hereby granted, free of charge, to any person obtaining
-// a copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to
-// permit persons to whom the Software is furnished to do so, subject to
-// the following conditions:
-
-// The above copyright notice and this permission notice shall be
-// included in all copies or substantial portions of the Software.
-
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// https://github.com/docker/docker-credential-helpers
-#include <string.h>
-#include <stdlib.h>
-#include "secretservice_linux.h"
-
-const SecretSchema *docker_get_schema(void)
-{
-	static const SecretSchema docker_schema = {
-		"io.docker.Credentials", SECRET_SCHEMA_NONE,
-		{
-		    { "label", SECRET_SCHEMA_ATTRIBUTE_STRING },
-			{ "server", SECRET_SCHEMA_ATTRIBUTE_STRING },
-			{ "username", SECRET_SCHEMA_ATTRIBUTE_STRING },
-			{ "docker_cli", SECRET_SCHEMA_ATTRIBUTE_STRING },
-			{ "NULL", 0 },
-		}
-	};
-	return &docker_schema;
-}
-
-GError *add(char *label, char *server, char *username, char *secret) {
-	GError *err = NULL;
-
-	secret_password_store_sync (DOCKER_SCHEMA, SECRET_COLLECTION_DEFAULT,
-			server, secret, NULL, &err,
-			"label", label,
-			"server", server,
-			"username", username,
-			"docker_cli", "1",
-			NULL);
-	return err;
-}
-
-GError *delete(char *server) {
-	GError *err = NULL;
-
-	secret_password_clear_sync(DOCKER_SCHEMA, NULL, &err,
-			"server", server,
-			"docker_cli", "1",
-			NULL);
-	if (err != NULL)
-		return err;
-	return NULL;
-}
-
-char *get_attribute(const char *attribute, SecretItem *item) {
-	GHashTable *attributes;
-	GHashTableIter iter;
-	gchar *value, *key;
-
-	attributes = secret_item_get_attributes(item);
-	g_hash_table_iter_init(&iter, attributes);
-	while (g_hash_table_iter_next(&iter, (void **)&key, (void **)&value)) {
-		if (strncmp(key, attribute, strlen(key)) == 0)
-			return (char *)value;
-	}
-	g_hash_table_unref(attributes);
-	return NULL;
-}
-
-GError *get(char *server, char **username, char **secret) {
-	GError *err = NULL;
-	GHashTable *attributes;
-	SecretService *service;
-	GList *items, *l;
-	SecretSearchFlags flags = SECRET_SEARCH_LOAD_SECRETS | SECRET_SEARCH_ALL | SECRET_SEARCH_UNLOCK;
-	SecretValue *secretValue;
-	gsize length;
-	gchar *value;
-
-	attributes = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, g_free);
-	g_hash_table_insert(attributes, g_strdup("server"), g_strdup(server));
-	g_hash_table_insert(attributes, g_strdup("docker_cli"), g_strdup("1"));
-
-	service = secret_service_get_sync(SECRET_SERVICE_NONE, NULL, &err);
-	if (err == NULL) {
-		items = secret_service_search_sync(service, DOCKER_SCHEMA, attributes, flags, NULL, &err);
-		if (err == NULL) {
-			for (l = items; l != NULL; l = g_list_next(l)) {
-				value = secret_item_get_schema_name(l->data);
-				if (strncmp(value, "io.docker.Credentials", strlen(value)) != 0) {
-					g_free(value);
-					continue;
-				}
-				g_free(value);
-				secretValue = secret_item_get_secret(l->data);
-				if (secret != NULL) {
-					*secret = strdup(secret_value_get(secretValue, &length));
-					secret_value_unref(secretValue);
-				}
-				*username = get_attribute("username", l->data);
-			}
-			g_list_free_full(items, g_object_unref);
-		}
-		g_object_unref(service);
-	}
-	g_hash_table_unref(attributes);
-	if (err != NULL) {
-		return err;
-	}
-	return NULL;
-}
-
-GError *list(char *ref_label, char *** paths, char *** accts, unsigned int *list_l) {
-	GList *items;
-	GError *err = NULL;
-	SecretService *service;
-	SecretSearchFlags flags = SECRET_SEARCH_LOAD_SECRETS | SECRET_SEARCH_ALL | SECRET_SEARCH_UNLOCK;
-	GHashTable *attributes = g_hash_table_new_full(g_str_hash, g_str_equal, g_free, g_free);
-
-	// List credentials with the right label only
-	g_hash_table_insert(attributes, g_strdup("label"), g_strdup(ref_label));
-
-	service = secret_service_get_sync(SECRET_SERVICE_NONE, NULL, &err);
-	if (err != NULL) {
-		return err;
-	}
-
-	items = secret_service_search_sync(service, NULL, attributes, flags, NULL, &err);
-	int numKeys = g_list_length(items);
-	if (err != NULL) {
-		return err;
-	}
-
-	char **tmp_paths = (char **) calloc(1,(int)sizeof(char *)*numKeys);
-	char **tmp_accts = (char **) calloc(1,(int)sizeof(char *)*numKeys);
-
-	// items now contains our keys from the gnome keyring
-	// we will now put it in our two lists to return it to go
-	GList *current;
-	int listNumber = 0;
-	for(current = items; current!=NULL; current = current->next) {
-		char *pathTmp = secret_item_get_label(current->data);
-		// you cannot have a key without a label in the gnome keyring
-		char *acctTmp = get_attribute("username",current->data);
-		if (acctTmp==NULL) {
-			acctTmp = "account not defined";
-		}
-
-		tmp_paths[listNumber] = (char *) calloc(1, sizeof(char)*(strlen(pathTmp)+1));
-		tmp_accts[listNumber] = (char *) calloc(1, sizeof(char)*(strlen(acctTmp)+1));
-
-		memcpy(tmp_paths[listNumber], pathTmp, sizeof(char)*(strlen(pathTmp)+1));
-		memcpy(tmp_accts[listNumber], acctTmp, sizeof(char)*(strlen(acctTmp)+1));
-
-		listNumber = listNumber + 1;
-	}
-
-	*paths = (char **) realloc(tmp_paths, (int)sizeof(char *)*listNumber);
-	*accts = (char **) realloc(tmp_accts, (int)sizeof(char *)*listNumber);
-
-	*list_l = listNumber;
-
-	return NULL;
-}
-
-void freeListData(char *** data, unsigned int length) {
-	int i;
-	for(i=0; i<length; i++) {
-		free((*data)[i]);
-	}
-	free(*data);
-}
\ No newline at end of file
diff --git a/helper/secretservice/secretservice_linux.go b/helper/secretservice/secretservice_linux.go
deleted file mode 100644
index 50886b6..0000000
--- a/helper/secretservice/secretservice_linux.go
+++ /dev/null
@@ -1,144 +0,0 @@
-// Copyright (c) 2016 David Calavera
-
-// Permission is hereby granted, free of charge, to any person obtaining
-// a copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to
-// permit persons to whom the Software is furnished to do so, subject to
-// the following conditions:
-
-// The above copyright notice and this permission notice shall be
-// included in all copies or substantial portions of the Software.
-
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// https://github.com/docker/docker-credential-helpers
-package secretservice
-
-/*
-#cgo pkg-config: libsecret-1
-#include "secretservice_linux.h"
-#include <stdlib.h>
-*/
-import "C"
-import (
-	"errors"
-	"unsafe"
-
-	"github.com/versent/saml2aws/helper/credentials"
-)
-
-// Secretservice handles secrets using Linux secret-service as a store.
-type Secretservice struct{}
-
-// Add adds new credentials to the keychain.
-func (h Secretservice) Add(creds *credentials.Credentials) error {
-	if creds == nil {
-		return errors.New("missing credentials")
-	}
-	credsLabel := C.CString(credentials.CredsLabel)
-	defer C.free(unsafe.Pointer(credsLabel))
-	server := C.CString(creds.ServerURL)
-	defer C.free(unsafe.Pointer(server))
-	username := C.CString(creds.Username)
-	defer C.free(unsafe.Pointer(username))
-	secret := C.CString(creds.Secret)
-	defer C.free(unsafe.Pointer(secret))
-
-	if err := C.add(credsLabel, server, username, secret); err != nil {
-		defer C.g_error_free(err)
-		errMsg := (*C.char)(unsafe.Pointer(err.message))
-		return errors.New(C.GoString(errMsg))
-	}
-	return nil
-}
-
-// Delete removes credentials from the store.
-func (h Secretservice) Delete(serverURL string) error {
-	if serverURL == "" {
-		return errors.New("missing server url")
-	}
-	server := C.CString(serverURL)
-	defer C.free(unsafe.Pointer(server))
-
-	if err := C.delete(server); err != nil {
-		defer C.g_error_free(err)
-		errMsg := (*C.char)(unsafe.Pointer(err.message))
-		return errors.New(C.GoString(errMsg))
-	}
-	return nil
-}
-
-// Get returns the username and secret to use for a given registry server URL.
-func (h Secretservice) Get(serverURL string) (string, string, error) {
-	if serverURL == "" {
-		return "", "", errors.New("missing server url")
-	}
-	var username *C.char
-	defer C.free(unsafe.Pointer(username))
-	var secret *C.char
-	defer C.free(unsafe.Pointer(secret))
-	server := C.CString(serverURL)
-	defer C.free(unsafe.Pointer(server))
-
-	err := C.get(server, &username, &secret)
-	if err != nil {
-		defer C.g_error_free(err)
-		errMsg := (*C.char)(unsafe.Pointer(err.message))
-		return "", "", errors.New(C.GoString(errMsg))
-	}
-	user := C.GoString(username)
-	pass := C.GoString(secret)
-	if pass == "" {
-		return "", "", credentials.ErrCredentialsNotFound
-	}
-	return user, pass, nil
-}
-
-// List returns the stored URLs and corresponding usernames for a given credentials label
-func (h Secretservice) List() (map[string]string, error) {
-	credsLabelC := C.CString(credentials.CredsLabel)
-	defer C.free(unsafe.Pointer(credsLabelC))
-
-	var pathsC **C.char
-	defer C.free(unsafe.Pointer(pathsC))
-	var acctsC **C.char
-	defer C.free(unsafe.Pointer(acctsC))
-	var listLenC C.uint
-	err := C.list(credsLabelC, &pathsC, &acctsC, &listLenC)
-	if err != nil {
-		defer C.g_error_free(err)
-		return nil, errors.New("Error from list function in secretservice_linux.c likely due to error in secretservice library")
-	}
-	defer C.freeListData(&pathsC, listLenC)
-	defer C.freeListData(&acctsC, listLenC)
-
-	resp := make(map[string]string)
-
-	listLen := int(listLenC)
-	if listLen == 0 {
-		return resp, nil
-	}
-	// The maximum capacity of the following two slices is limited to (2^29)-1 to remain compatible
-	// with 32-bit platforms. The size of a `*C.char` (a pointer) is 4 Byte on a 32-bit system
-	// and (2^29)*4 == math.MaxInt32 + 1. -- See issue golang/go#13656
-	pathTmp := (*[(1 << 29) - 1]*C.char)(unsafe.Pointer(pathsC))[:listLen:listLen]
-	acctTmp := (*[(1 << 29) - 1]*C.char)(unsafe.Pointer(acctsC))[:listLen:listLen]
-	for i := 0; i < listLen; i++ {
-		resp[C.GoString(pathTmp[i])] = C.GoString(acctTmp[i])
-	}
-
-	return resp, nil
-}
-
-// SupportsCredentialStorage returns true since storage is supported
-func (Secretservice) SupportsCredentialStorage() bool {
-	return true
-}
diff --git a/helper/secretservice/secretservice_linux.h b/helper/secretservice/secretservice_linux.h
deleted file mode 100644
index 998bd02..0000000
--- a/helper/secretservice/secretservice_linux.h
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright (c) 2016 David Calavera
-
-// Permission is hereby granted, free of charge, to any person obtaining
-// a copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to
-// permit persons to whom the Software is furnished to do so, subject to
-// the following conditions:
-
-// The above copyright notice and this permission notice shall be
-// included in all copies or substantial portions of the Software.
-
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// https://github.com/docker/docker-credential-helpers
-#define SECRET_WITH_UNSTABLE 1
-#define SECRET_API_SUBJECT_TO_CHANGE 1
-#include <libsecret/secret.h>
-
-const SecretSchema *docker_get_schema(void) G_GNUC_CONST;
-
-#define DOCKER_SCHEMA docker_get_schema()
-
-GError *add(char *label, char *server, char *username, char *secret);
-GError *delete(char *server);
-GError *get(char *server, char **username, char **secret);
-GError *list(char *label, char *** paths, char *** accts, unsigned int *list_l);
-void freeListData(char *** data, unsigned int length);
\ No newline at end of file


Test patch:
diff --git a/helper/secretservice/secretservice_linux_test.go b/helper/secretservice/secretservice_linux_test.go
deleted file mode 100644
index 5e22085..0000000
--- a/helper/secretservice/secretservice_linux_test.go
+++ /dev/null
@@ -1,112 +0,0 @@
-// Copyright (c) 2016 David Calavera
-
-// Permission is hereby granted, free of charge, to any person obtaining
-// a copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to
-// permit persons to whom the Software is furnished to do so, subject to
-// the following conditions:
-
-// The above copyright notice and this permission notice shall be
-// included in all copies or substantial portions of the Software.
-
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// https://github.com/docker/docker-credential-helpers
-package secretservice
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/versent/saml2aws/helper/credentials"
-)
-
-func TestSecretServiceHelper(t *testing.T) {
-	t.Skip("test requires gnome-keyring but travis CI doesn't have it")
-
-	creds := &credentials.Credentials{
-		ServerURL: "https://foobar.docker.io:2376/v1",
-		Username:  "foobar",
-		Secret:    "foobarbaz",
-	}
-
-	helper := Secretservice{}
-
-	// Check how many docker credentials we have when starting the test
-	old_auths, err := helper.List()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// If any docker credentials with the tests values we are providing, we
-	// remove them as they probably come from a previous failed test
-	for k, v := range old_auths {
-		if strings.Compare(k, creds.ServerURL) == 0 && strings.Compare(v, creds.Username) == 0 {
-
-			if err := helper.Delete(creds.ServerURL); err != nil {
-				t.Fatal(err)
-			}
-		}
-	}
-
-	// Check again how many docker credentials we have when starting the test
-	old_auths, err = helper.List()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// Add new credentials
-	if err := helper.Add(creds); err != nil {
-		t.Fatal(err)
-	}
-
-	// Verify that it is inside the secret service store
-	username, secret, err := helper.Get(creds.ServerURL)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if username != "foobar" {
-		t.Fatalf("expected %s, got %s\n", "foobar", username)
-	}
-
-	if secret != "foobarbaz" {
-		t.Fatalf("expected %s, got %s\n", "foobarbaz", secret)
-	}
-
-	// We should have one more credential than before adding
-	new_auths, err := helper.List()
-	if err != nil || (len(new_auths)-len(old_auths) != 1) {
-		t.Fatal(err)
-	}
-	old_auths = new_auths
-
-	// Deleting the credentials associated to current server url should succeed
-	if err := helper.Delete(creds.ServerURL); err != nil {
-		t.Fatal(err)
-	}
-
-	// We should have one less credential than before deleting
-	new_auths, err = helper.List()
-	if err != nil || (len(old_auths)-len(new_auths) != 1) {
-		t.Fatal(err)
-	}
-}
-
-func TestMissingCredentials(t *testing.T) {
-	t.Skip("test requires gnome-keyring but travis CI doesn't have it")
-
-	helper := Secretservice{}
-	_, _, err := helper.Get("https://adsfasdf.wrewerwer.com/asdfsdddd")
-	if !credentials.IsErrCredentialsNotFound(err) {
-		t.Fatalf("expected ErrCredentialsNotFound, got %v", err)
-	}
-}