Store private key in keychain

We store it so it can only be accessed by our developer ID.

Author: mxcl

README.md

@@ -1,22 +1,24 @@
-# boats's personal barricade - pkgx updates
+# boats's personal barricade
 
 This is a tool to automatically sign git commits, replacing gpg for that
 purpose. It is very opinionated, and only useful if you use gpg the same way I
 do.
 
-## Updates
+## `pkgx` Updates
 
-updated to edition 2021 by pkgx
+* Updated to edition 2021 by pkgx
+* Stores the private key in the macOS keychain such that only this tool (when
+  codesigned) can access it.
 
-## How to install
+## How to Install
 
 ```sh
 git clone https://github.com/pkgxdev/bpb-pkgx
 cd bpb-pkgx
 cargo install --path .
 ```
 
-## How to set up
+## How to Set Up
 
 Once you've installed this program, you should run the `bpb init` subcommand.
 This command expects you to pass a userid argument. For example, this is how I
@@ -29,11 +31,13 @@ bpb init "withoutboats <boats@mozilla.com>"
 You can pass any string you want as your userid, but `"$NAME <$EMAIL>"` is the
 conventional standard for OpenPGP userids.
 
-This will create a file at ~/.bpb_keys.toml. This file contains your bpb public
-and private keys.
+This will create a file at ~/.bpb_keys.toml. This file contains your public
+key.
 
-It also prints your public key in OpenPGP format, so that you can upload it
-again. You can print your public key more times with:
+The private and public keys are output as JSON. This is the only time this
+tool will expose your private key publicly.
+
+You can print your public key more times with:
 
 ```sh
 bpb print
@@ -43,27 +47,19 @@ If you want to use it to sign git commits, you also need to inform git to call
 it instead of gpg. You can do this with this command:
 
 ```sh
-git config --global gpg.program bpb
+git config --global gpg.program bpb_pkgx
 ```
 
 You should also provide the public key to people who want to verify your
-commits. Personally, I just upload the public key to GitHub; you may have other
-requirements.
+commits. Personally, I just upload the public key to GitHub; you may have
+other requirements.
 
-## How it replaces gpg
+## How it Replaces GPG
 
-If this program receives a `-s` argument, it reads from stdin and then writes a
-signature to stdout. If it receives any arguments it doesn't recognize, it
+If this program receives a `-s` argument, it reads from stdin and then writes
+a signature to stdout. If it receives any arguments it doesn't recognize, it
 delegates to the gpg binary in your path.
 
 This means that this program can be used to replace gpg as a signing tool, but
-it does not replace any other functionality. For example, if you want to verify
-the signatures on other peoples' git commits, it will shell out to gpg.
-
-## Storing your private key
-
-By default, your private key is stored as a hex string in `~/.bpb_keys.toml`.
-However, if you are uncomfortable with the possibility of someone reading your
-private key from your home directory, you can instead store it somewhere else.
-To do this, replace the `key` field with a `program` field, and `bpb` will run
-this program, expecting it to print your key to stdout.
+it does not replace any other functionality. For example, if you want to
+verify the signatures on other peoples' git commits, it will shell out to gpg.

src/config.rs

@@ -4,6 +4,9 @@ use failure::Error;
 
 use crate::key_data::KeyData;
 
+use crate::keychain::get_keychain_item;
+use crate::keychain::add_keychain_item;
+
 #[derive(Serialize, Deserialize)]
 pub struct Config {
     public: PublicKey,
@@ -29,13 +32,17 @@ impl Config {
     }
 
     pub fn load(file: &mut impl Read) -> Result<Config, Error> {
-        let mut buf = vec![];
-        file.read_to_end(&mut buf)?;
-        Ok(toml::from_slice(&buf)?)
+        let service: &str = "xyz.tea.BASE.bpb";
+        let account: &str = "example_account";
+        let str = get_keychain_item(service, account).unwrap();
+        Ok(toml::from_str(&str)?)
     }
 
     pub fn write(&self, file: &mut impl Write) -> Result<(), Error> {
-        Ok(file.write_all(&toml::to_vec(self)?)?)
+        let secret = toml::to_string(self)?;
+        let service = "xyz.tea.BASE.bpb";
+        let account = "example_account"; //self.user_id();
+        add_keychain_item(service, account, &secret)
     }
 
     pub fn timestamp(&self) -> u64 {
@@ -46,10 +53,6 @@ impl Config {
         &self.public.userid
     }
 
-    // pub fn public(&self) -> &str {
-    //     &self.public.key
-    // }
-
     pub fn secret(&self) -> Result<[u8; 32], Error> {
         self.secret.secret()
     }
@@ -70,16 +73,11 @@ struct SecretKey {
 
 impl SecretKey {
     fn secret(&self) -> Result<[u8; 32], Error> {
-        if let Some(key) = &self.key {
-            to_32_bytes(key)
-        } else if let Some(cmd) = &self.program {
-            let mut args = cmd.split_whitespace();
-            let cmd = args.next().ok_or(failure::err_msg("Missing command"))?;
-            let output = std::process::Command::new(cmd).args(args).output().unwrap();
-            to_32_bytes(&String::from_utf8(output.stdout)?)
-        } else {
-            bail!("No secret key or program specified")
-        }
+      if let Some(key) = &self.key {
+        to_32_bytes(key)
+      } else {
+          bail!("No secret key or program specified")
+      }
     }
 }
 

src/keychain.rs

@@ -0,0 +1,181 @@
+use std::ffi::{CString, c_void};
+use failure::Error;
+use std::ptr;
+
+#[link(name = "Security", kind = "framework")]
+extern "C" {
+    fn SecItemAdd(attributes: *const c_void, result: *mut *const c_void) -> i32;
+    fn SecItemCopyMatching(query: *const c_void, result: *mut *const c_void) -> i32;
+    fn SecItemDelete(query: *const c_void) -> i32;
+
+    static kSecClass: *const c_void;
+    static kSecClassGenericPassword: *const c_void;
+    static kSecAttrService: *const c_void;
+    static kSecAttrAccount: *const c_void;
+    static kSecValueData: *const c_void;
+    static kSecReturnData: *const c_void;
+    static kCFBooleanTrue: *const c_void;
+    static kSecAttrAccessGroup: *const c_void;
+}
+
+const ERR_SUCCESS: i32 = 0;
+
+pub fn add_keychain_item(service: &str, account: &str, secret: &str) -> Result<(), Error> {
+  let service = CString::new(service).unwrap();
+  let account = CString::new(account).unwrap();
+  let secret_bytes = secret.as_bytes();
+
+  let cf_service = unsafe {
+      CFStringCreateWithCString(ptr::null(), service.as_ptr(), 0x08000100) // UTF-8 encoding
+  };
+  let cf_account = unsafe {
+      CFStringCreateWithCString(ptr::null(), account.as_ptr(), 0x08000100) // UTF-8 encoding
+  };
+  let cf_data = unsafe { CFDataCreate(ptr::null(), secret_bytes.as_ptr(), secret_bytes.len()) };
+  let cf_access_group = unsafe {
+      CFStringCreateWithCString(
+          ptr::null(),
+          "7WV56FL599.keychain_tool".as_ptr() as *const i8, // Fixed pointer type
+          0x08000100,
+      )
+  };
+
+  assert!(!cf_service.is_null(), "Failed to create CFString for service");
+  assert!(!cf_account.is_null(), "Failed to create CFString for account");
+  assert!(!cf_data.is_null(), "Failed to create CFData for secret");
+  assert!(!cf_access_group.is_null(), "Failed to create CFString for access group");
+
+  let attributes = vec![
+      (unsafe { kSecClass }, unsafe { kSecClassGenericPassword }),
+      (unsafe { kSecAttrService }, cf_service),
+      (unsafe { kSecAttrAccount }, cf_account),
+      (unsafe { kSecValueData }, cf_data),
+      (unsafe { kSecAttrAccessGroup }, cf_access_group), // Added access group
+  ];
+
+  let attributes_ptr = attributes_to_dict(&attributes);
+  assert!(!attributes_ptr.is_null(), "CFDictionary creation failed!");
+
+  unsafe {
+      let mut result: *mut c_void = ptr::null_mut();
+      let status = SecItemAdd(attributes_ptr, &mut result as *mut *mut c_void as *mut *const c_void);
+
+      CFRelease(attributes_ptr);  // Release dictionary
+      CFRelease(cf_service);      // Release service string
+      CFRelease(cf_account);      // Release account string
+      CFRelease(cf_data);         // Release data
+      CFRelease(cf_access_group); // Release access group string
+
+      if status == ERR_SUCCESS {
+          Ok(())
+      } else {
+          Err(failure::err_msg(format!("SecItemAdd failed with status: {}", status)))
+      }
+  }
+}
+
+pub fn get_keychain_item(service: &str, account: &str) -> Result<String, String> {
+  let service = CString::new(service).unwrap();
+  let account = CString::new(account).unwrap();
+
+  let cf_service = unsafe {
+      CFStringCreateWithCString(ptr::null(), service.as_ptr() as *const i8, 0x08000100) // UTF-8 encoding
+  };
+  let cf_account = unsafe {
+      CFStringCreateWithCString(ptr::null(), account.as_ptr() as *const i8, 0x08000100) // UTF-8 encoding
+  };
+
+  assert!(!cf_service.is_null(), "Failed to create CFString for service");
+  assert!(!cf_account.is_null(), "Failed to create CFString for account");
+
+  let query = vec![
+      (unsafe { kSecClass }, unsafe { kSecClassGenericPassword }),
+      (unsafe { kSecAttrService }, cf_service),
+      (unsafe { kSecAttrAccount }, cf_account),
+      (unsafe { kSecReturnData }, unsafe { kCFBooleanTrue }),
+  ];
+
+  let query_ptr = attributes_to_dict(&query);
+  assert!(!query_ptr.is_null(), "CFDictionary creation failed for query!");
+
+  unsafe {
+      let mut result: *mut c_void = ptr::null_mut();
+      let status = SecItemCopyMatching(query_ptr, &mut result as *mut *mut c_void as *mut *const c_void);
+
+      CFRelease(query_ptr);   // Release query dictionary
+      CFRelease(cf_service); // Release service string
+      CFRelease(cf_account); // Release account string
+
+      if status == ERR_SUCCESS {
+          assert!(!result.is_null(), "SecItemCopyMatching returned a null result");
+
+          // Convert the result to a Rust String
+          let data_ptr = CFDataGetBytePtr(result);
+          let data_len = CFDataGetLength(result);
+          let bytes = std::slice::from_raw_parts(data_ptr, data_len);
+          let secret = String::from_utf8_lossy(bytes).to_string();
+
+          CFRelease(result); // Release result data
+
+          Ok(secret)
+      } else {
+          Err(format!("SecItemCopyMatching failed with status: {}", status))
+      }
+  }
+}
+
+// Helpers for Keychain Constants and Conversions
+
+#[link(name = "CoreFoundation", kind = "framework")]
+extern "C" {
+    fn CFRelease(cf: *const c_void);
+    fn CFDataGetLength(data: *const c_void) -> usize;
+    fn CFDataGetBytePtr(data: *const c_void) -> *const u8;
+}
+
+extern "C" {
+  fn CFDictionaryCreate(
+      allocator: *const c_void,
+      keys: *const *const c_void,
+      values: *const *const c_void,
+      count: usize,
+      key_callbacks: *const c_void,
+      value_callbacks: *const c_void,
+  ) -> *const c_void;
+
+  fn CFStringCreateWithCString(
+      allocator: *const c_void,
+      cstr: *const i8,
+      encoding: u32,
+  ) -> *const c_void;
+
+  fn CFDataCreate(
+      allocator: *const c_void,
+      bytes: *const u8,
+      length: usize,
+  ) -> *const c_void;
+}
+
+fn attributes_to_dict(attrs: &[(/* key: */ *const c_void, /* value: */ *const c_void)]) -> *const c_void {
+  let keys: Vec<*const c_void> = attrs.iter().map(|(key, _)| *key).collect();
+  let values: Vec<*const c_void> = attrs.iter().map(|(_, value)| *value).collect();
+
+  unsafe {
+      CFDictionaryCreate(
+          ptr::null(),
+          keys.as_ptr(),
+          values.as_ptr(),
+          attrs.len(),
+          ptr::null(),
+          ptr::null(),
+      )
+  }
+}
+
+fn CFDataToString(data: *const c_void) -> String {
+    unsafe {
+        let length = CFDataGetLength(data);
+        let bytes = CFDataGetBytePtr(data);
+        String::from_utf8(Vec::from_raw_parts(bytes as *mut u8, length, length)).unwrap()
+    }
+}

src/main.rs

@@ -5,6 +5,7 @@ extern crate serde_derive;
 
 mod config;
 mod key_data;
+mod keychain;
 mod tests;
 
 use std::time::SystemTime;