keybase / go-keychain

Golang keychain package for iOS and macOS

Go Keychain

A library for accessing the Keychain for macOS, iOS, and Linux in Go (golang).

Requires macOS 10.9 or greater and iOS 8 or greater. On Linux, communicates to a provider of the DBUS SecretService spec like gnome-keyring or ksecretservice.

import "github.com/keybase/go-keychain"

Mac/iOS Usage

The API is meant to mirror the macOS/iOS Keychain API and is not necessarily idiomatic go.

Add Item

item := keychain.NewItem()
item.SetSecClass(keychain.SecClassGenericPassword)
item.SetService("MyService")
item.SetAccount("gabriel")
item.SetLabel("A label")
item.SetAccessGroup("A123456789.group.com.mycorp")
item.SetData([]byte("toomanysecrets"))
item.SetSynchronizable(keychain.SynchronizableNo)
item.SetAccessible(keychain.AccessibleWhenUnlocked)
err := keychain.AddItem(item)

if err == keychain.ErrorDuplicateItem {
  // Duplicate
}

Query Item

Query for multiple results, returning attributes:

query := keychain.NewItem()
query.SetSecClass(keychain.SecClassGenericPassword)
query.SetService(service)
query.SetAccount(account)
query.SetAccessGroup(accessGroup)
query.SetMatchLimit(keychain.MatchLimitAll)
query.SetReturnAttributes(true)
results, err := keychain.QueryItem(query)
if err != nil {
  // Error
} else {
  for _, r := range results {
    fmt.Printf("%#v\n", r)
  }
}

Query for a single result, returning data:

query := keychain.NewItem()
query.SetSecClass(keychain.SecClassGenericPassword)
query.SetService(service)
query.SetAccount(account)
query.SetAccessGroup(accessGroup)
query.SetMatchLimit(keychain.MatchLimitOne)
query.SetReturnData(true)
results, err := keychain.QueryItem(query)
if err != nil {
  // Error
} else if len(results) != 1 {
  // Not found
} else {
  password := string(results[0].Data)
}

Delete Item

Delete a generic password item with service and account:

item := keychain.NewItem()
item.SetSecClass(keychain.SecClassGenericPassword)
item.SetService(service)
item.SetAccount(account)
err := keychain.DeleteItem(item)

Other

There are some convenience methods for generic password:

// Create generic password item with service, account, label, password, access group
item := keychain.NewGenericPassword("MyService", "gabriel", "A label", []byte("toomanysecrets"), "A123456789.group.com.mycorp")
item.SetSynchronizable(keychain.SynchronizableNo)
item.SetAccessible(keychain.AccessibleWhenUnlocked)
err := keychain.AddItem(item)
if err == keychain.ErrorDuplicateItem {
  // Duplicate
}

password, err := keychain.GetGenericPassword("MyService", "gabriel", "A label", "A123456789.group.com.mycorp")

accounts, err := keychain.GetGenericPasswordAccounts("MyService")
// Should have 1 account == "gabriel"

err := keychain.DeleteGenericPasswordItem("MyService", "gabriel")
if err == keychain.ErrorItemNotFound {
  // Not found
}

iOS

Bindable package in bind. iOS project in ios. Run that project to test iOS.

To re-generate framework:

(cd bind && gomobile bind -target=ios -tags=ios -o ../ios/bind.framework)

go-keychain's Issues

Custom keychain management is no longer supported in macOS 12.0

cgo-gcc-prolog:60:11: warning: 'SecKeychainCreate' is deprecated: first deprecated in macOS 12.0 - Custom keychain management is no longer supported [-Wdeprecated-declarations]
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:301:10: note: 'SecKeychainCreate' has been explicitly marked deprecated here
cgo-gcc-prolog:118:11: warning: 'SecKeychainLock' is deprecated: first deprecated in macOS 12.0 - Custom keychain management is no longer supported [-Wdeprecated-declarations]
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:357:10: note: 'SecKeychainLock' has been explicitly marked deprecated here
cgo-gcc-prolog:138:11: warning: 'SecKeychainOpen' is deprecated: first deprecated in macOS 12.0 - Custom keychain management is no longer supported [-Wdeprecated-declarations]
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:287:10: note: 'SecKeychainOpen' has been explicitly marked deprecated here
cgo-gcc-prolog:162:11: warning: 'SecKeychainUnlock' is deprecated: first deprecated in macOS 12.0 - Custom keychain management is no longer supported [-Wdeprecated-declarations]
/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychain.h:347:10: note: 'SecKeychainUnlock' has been explicitly marked deprecated here

Getting `Keychain Error (-25293)`

I get this error when I try to store things on the keychain using bind.AddGenericPassword() or keychain.AddItem(keychain.NewGenericPassword()). I found out that error code maps to errKCAuthFailed (Googling for that doesn't provide any additional information), but I'm not sure why I would be getting that since I've unlocked my keychain. I'm not familiar with MacOS's keychain APIs, so perhaps I'm passing malformed strings for service, account, label, or access group (respectively, "Hello", "[email protected]", "Hello", and "login"--I have absolutely no idea what an access group is, and Googling hasn't turned anything up at all)?

No way to opt-out of automatically trusting the calling application

For security sensitive applications you often want to not allow the calling application access to Keychain without prompting the user.

Currently this lib hardcodes the addition of the calling application to the list of trusted applications:

go-keychain/macos.go

Line 45 in ea111bd

trustedApplications = append([]string{""}, trustedApplications...)

Is there any way around this? I had a go at it in #13, but never heard back.

Does SynchronizableYes work?

I have followed the same example on the readme, this time changing the line:

item.SetSynchronizable(keychain.SynchronizableYes)

And the item is not even added to the keychain.
Is there a way to set this flag to yes? I also see SynchronizableAny does that work for Set, or is it only for Get?
Thanks.

not seeing all the expected exports after importing the package

Hello,

After importing "github.com/keybase/go-keychain" I'm not seeing all the expected exports, I see only:
keychain.RandBytes
keychain.RandomID

I'm using VSCode on Windows 11 (I compile code here for macos, linux, and windows).

Any ideas?

Thanks

Generate unextractable keychain private key via kSecAttrIsExtractable?

Hi,

Is there a way to generate a RSA keypair in KeyChain and make it unextractable using this library?

use mac to build .a file

./../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:55:8: query.SetMatchSearchList undefined (type keychain.Item has no field or method SetMatchSearchList)
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:55:28: undefined: keychain.NewWithPath
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:115:34: undefined: keychain.Keychain
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:124:12: queryItem.SetMatchSearchList undefined (type keychain.Item has no field or method SetMatchSearchList)
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:136:8: kcItem.SetAccess undefined (type keychain.Item has no field or method SetAccess)
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:146:9: undefined: keychain.Keychain
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:166:9: kcItem.UseKeychain undefined (type keychain.Item has no field or method UseKeychain)
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:181:9: kcItem.SetAccess undefined (type keychain.Item has no field or method SetAccess)
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:181:21: undefined: keychain.Access
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:267:36: undefined: keychain.Keychain
../../go/pkg/mod/github.com/99designs/[email protected]/keychain.go:181:21: too many errors

Go test fails to compile

Go test fails to compile on my computer after installing the latest updates of Xcode command line tools, it worked fine until yesterday.

go test -v ./...  -tags skipsecretserviceintegrationtests
# github.com/keybase/go-keychain
./macos_1.10.go:89:13: could not determine kind of name for C.SecTrustedApplicationCreateFromPath
FAIL	github.com/keybase/go-keychain [build failed]
# github.com/keybase/go-keychain
./macos_1.10.go:89:13: could not determine kind of name for C.SecTrustedApplicationCreateFromPath
FAIL	github.com/keybase/go-keychain/bindtest [build failed]
=== RUN   TestNewKeypair
--- PASS: TestNewKeypair (0.00s)
=== RUN   TestKeygen
--- PASS: TestKeygen (0.00s)
=== RUN   TestEncryption
--- PASS: TestEncryption (0.00s)
=== RUN   TestEncryptionRng
--- PASS: TestEncryptionRng (0.00s)
=== RUN   TestPKCS7
--- PASS: TestPKCS7 (0.00s)
PASS
ok  	github.com/keybase/go-keychain/secretservice	0.015s

Xcode Version 10.2.1 (10E1001)

go version
go version go1.12.5 darwin/amd64

Deprecated libcall SecKeychainItemDelete

Running the example code provided in readme.MD provides the following deprecation warning

cgo-gcc-prolog:53:11: warning: 'SecKeychainItemDelete' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations]
/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychainItem.h:257:10: note: 'SecKeychainItemDelete' has been explicitly marked deprecated here

Versions:
OSX Monterey 12.5.1
go 1.19
github.com/keybase/go-keychain v0.0.0-20221114143418-13d058a3d612

https://developer.apple.com/documentation/security/1400090-seckeychainitemdelete indicates that this call has indeed been deprecated.

Need to regenerate bind for go 1.10

#23 also updated the gomobile bind stuff. We'll need to do that once we stop supporting pre 1.10.

Warnings when compiling

I'm getting the following warnings when compiling this package on "El capitan"

cgo-gcc-prolog:43:27: warning: passing 'void **' to parameter of type 'const void **' discards qualifiers in nested pointer types [-Wincompatible-pointer-types-discards-qualifiers]
/System/Library/Frameworks/CoreFoundation.framework/Headers/CFArray.h:174:65: note: passing argument to parameter 'values' here
cgo-gcc-prolog:92:33: warning: passing 'void **' to parameter of type 'const void **' discards qualifiers in nested pointer types [-Wincompatible-pointer-types-discards-qualifiers]
/System/Library/Frameworks/CoreFoundation.framework/Headers/CFArray.h:360:72: note: passing argument to parameter 'values' here
cgo-gcc-prolog:232:32: warning: passing 'void **' to parameter of type 'const void **' discards qualifiers in nested pointer types [-Wincompatible-pointer-types-discards-qualifiers]
/System/Library/Frameworks/CoreFoundation.framework/Headers/CFDictionary.h:279:75: note: passing argument to parameter 'keys' here
cgo-gcc-prolog:232:39: warning: passing 'void **' to parameter of type 'const void **' discards qualifiers in nested pointer types [-Wincompatible-pointer-types-discards-qualifiers]
/System/Library/Frameworks/CoreFoundation.framework/Headers/CFDictionary.h:279:94: note: passing argument to parameter 'values' here
cgo-gcc-prolog:265:38: warning: passing 'void **' to parameter of type 'const void **' discards qualifiers in nested pointer types [-Wincompatible-pointer-types-discards-qualifiers]
/System/Library/Frameworks/CoreFoundation.framework/Headers/CFDictionary.h:557:73: note: passing argument to parameter 'keys' here
cgo-gcc-prolog:265:45: warning: passing 'void **' to parameter of type 'const void **' discards qualifiers in nested pointer types [-Wincompatible-pointer-types-discards-qualifiers]
/System/Library/Frameworks/CoreFoundation.framework/Headers/CFDictionary.h:557:92: note: passing argument to parameter 'values' here

Would CI via Github Actions be useful ?

I had created a pull request (#68) thinking there was no visibility into builds but then I saw the badge with Travis CI. Perhaps Githu Actions still has some use ? If so I'll recreate the PR. Just wanted to get confirmation before throwing away the work.

Compilation fails with go 1.10

See https://golang.org/doc/go1.10#cgo

"Cgo now translates some C types that would normally map to a pointer type in Go, to a uintptr instead."

Triggers a bunch of errors in go-keychain, eg "cannot use nil as type _Ctype_CFDataRef in return argument".

Thank you!

Support for kSecClassIdentity and kSecClassCertificate

Hey there, thank you for the amazing work on this project. I am looking for a way to add both certificates and identities into the keychain on macOS using this package. However, this package only seems to include the item classes:

• kSecClassGenericPassword
• kSecClassInternetPassword

Referring to the Apple docs here: https://developer.apple.com/documentation/security/keychain_services/keychain_items/item_class_keys_and_values#1678477 it would be great to include all of these item class values.

Cannot compile for other GOOS

Of course I make keychain calls only on darwin but it's a runtime check for runtime.GOOS. I'd like to be able to compile for other OSes as well.

How to obtain SSH passphrases (macOS High Sierra)

In macOS High Sierra (10.13.3) how could the ssh passphrases be obtained, currently trying with this without success:

    usr, _ := user.Current()
    dir := usr.HomeDir
    keyPath, err := filepath.Abs(filepath.Join(dir, ".ssh/id_rsa"))
    if err != nil {
            log.Fatal(err)
    }
    keyPassword, err := GetGenericPassword("SSH", keyPath, "", "")
    if err != nil {
            log.Fatal(err)
    }
    fmt.Printf("keyPassword = %s\n", keyPassword)

or also with:

    keyPassword, err := keychain.GetGenericPassword("OpenSSH", keyPath, "SSH: "+keyPath, "com.apple.ssh.passphrases")
    if err != nil {
            log.Fatal(err)
    }
    fmt.Printf("keyPassword = %s\n", keyPassword)

Any idea?

This seems to be related: https://apple.stackexchange.com/a/268175/104123

secretservice.replaceBehavior is not exported

The type secretservice.replaceBehavior is not exported, though constants secretservice.ReplaceBehaviorDoNotReplace and secretservice.ReplaceBehaviorReplace are.

This may be a golang newbie problem, but this appears to prevent the use of the flag as a variable, e.g.

        replaceFlag := secretservice.ReplaceBehaviorDoNotReplace
        if replaceIfExists {
                replaceFlag = secretservice.ReplaceBehaviorReplace
        }
        _, err = srv.CreateItem(collection, secreteservice.NewSecretProperties("label", makeAPropertiesMap()), password, replaceFlag)

as the type of replaceFlag to decay to int, resulting in error

cannot use replaceFlag (type int) as type secretservice.replaceBehavior in argument to srv.CreateItem

If the initialization of replaceFlag is explicitly typed secretservice.replaceBehavior then the build will fail with cannot refer to unexported name secretservice.replaceBehavior. Same if an explicit cast is used when passing the argument.

Unless this is me being a golang ignoramus, it seems like secretservice.replaceBehavior should be exported as secretservice.ReplaceBehavior instead.

Add support for SecureEnclave

Per https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/protecting_keys_with_the_secure_enclave it'd be nice if this library supported the ability to generate keys directly on the Secure Enclave.

Error of clang-14: error: linker command failed with exit code 1 (use -v to see invocation) in macOS

I tried to run a demo of Go on macOS, but I always get the error go-keychain ld: framework not found CoreFoundation clang-14: error: linker command failed with exit code 1 (use -v to see invocation), that code can run successfully in Linux, Does go-keychain not work on MacOS?

go version
go version go1.18.3 darwin/amd64


xcode-select -p && xcodebuild -version
/Applications/Xcode.app/Contents/Developer
Xcode 14.2
Build version 14C18

Thanks so much for any feedback.

Support for user-presence requirements?

The Keychain API supports requiring that the user is present when accessing a secret, e.g. by entering a password or using touch ID.

• https://developer.apple.com/documentation/security/secaccesscontrolcreateflags
• https://developer.apple.com/documentation/security/keychain_services/keychain_items/restricting_keychain_item_accessibility#2974973
• https://developer.apple.com/documentation/security/secaccesscontrolcreateflags/1392879-userpresence

Currently this is not a supported option: https://pkg.go.dev/github.com/keybase/go-keychain?GOOS=darwin

secretservice subpackage not documented or exported

There's support for the D-Bus based secretservice in the secretservice/ subdir and secretservice package.

But as far as I can tell (admittedly as an absolute golang newbie) it doesn't seem to be usable from outside the tests that are the secretservice package itself. Should the secretservice tests not use a different package and import secretservice ?

Using

go init secretserviceexample
go get github.com/keybase/go-keychain

then secretserviceexample.go:

package secretserviceexample
import (
    "github.com/keybase/go-keychain"
)
func main() {
    srv, err := keychain.NewService()
}

this fails with

$ go build
./secretserviceexample.go:8:17: undefined: keychain.NewService

There doesn't appear to be anything in the keychain package to adapt the secretservice API to the Keychain API such that the main keychain package funcs can be used transparently-ish on Linux. Maybe that was intended but unfinished?

cannot get correct dates

CreationDate and ModificationDate is returning "0001-01-01 00:00:00 +0000 UTC".

╰─$ go env
GOARCH="amd64"
GOBIN="/Users/mattb/go/bin"
GOCACHE="/Users/mattb/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/mattb/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/go"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/6s/5_jg3hdx52d1t4gf1tky_2b80000gq/

package main

import (
"fmt"
"log"

"github.com/keybase/go-keychain"

)

func main() {
query := keychain.NewItem()
query.SetSecClass(keychain.SecClassGenericPassword)
query.SetService("itrac")
query.SetMatchLimit(keychain.MatchLimitOne)
query.SetReturnData(true)
results, err := keychain.QueryItem(query)
if err != nil {
log.Fatalln(err)
}
fmt.Println(results[0].ModificationDate)
fmt.Println(results[0].CreationDate)
}

building for linux ends in error 2

Getting the following when building for Windows or Linux. Do I have something misconfigured? I'm new to go.

go version
go version go1.12.4 darwin/amd64

go build -ldflags '-s -w'

keychains

./main.go:9:9: undefined: keychain.NewItem
./main.go:10:18: undefined: keychain.SecClassGenericPassword
./main.go:16:24: undefined: keychain.SynchronizableNo
./main.go:17:20: undefined: keychain.AccessibleWhenUnlocked
./main.go:18:8: undefined: keychain.AddItem
./main.go:20:11: undefined: keychain.ErrorDuplicateItem
./main.go:21:10: undefined: keychain.DeleteItem
./main.go:25:8: undefined: keychain.AddItem
./main.go:37:10: undefined: keychain.NewItem
./main.go:38:19: undefined: keychain.SecClassGenericPassword
./main.go:38:19: too many errors
make: *** [linux] Error 2

Support for creating new keychains and querying agains them

We are operating off a fork of the old go-osxkeychain codebase for aws-vault: https://github.com/99designs/aws-vault/blob/master/keyring/keychain.go.

If you guys are interested, I'll open a PR for adding a Keychain type, along with a NewKeychain function for creating new keychains and an AddItem method on the Keychain type and a SetMatchSearchList on Item for searching specific keychains?

Compilation failure on tip

Using the following development version of Go:

$ go version
go version devel +bcf964de5e Tue Dec 5 16:47:21 2017 +0000 darwin/amd64

On MacOS Sierra version 10.12.6, I'm getting the following compilation errors:

./corefoundation.go:29: cannot use nil as type _Ctype_CFDataRef in return argument
./corefoundation.go:35: cannot use nil as type _Ctype_CFAllocatorRef in argument to _Cfunc_CFDataCreate
./corefoundation.go:36: cannot convert nil to type _Ctype_CFDataRef
./corefoundation.go:37: cannot use nil as type _Ctype_CFDataRef in return argument
./corefoundation.go:61: cannot use nil as type _Ctype_CFAllocatorRef in argument to func literal
./corefoundation.go:62: cannot convert nil to type _Ctype_CFDictionaryRef
./corefoundation.go:63: cannot use nil as type _Ctype_CFDictionaryRef in return argument
./corefoundation.go:74: cannot convert &keys[0] (type *_Ctype_CFTypeRef) to type *unsafe.Pointer
./corefoundation.go:74: cannot convert &values[0] (type *_Ctype_CFTypeRef) to type *unsafe.Pointer
./corefoundation.go:87: cannot use nil as type _Ctype_CFStringRef in return argument

This might be a problem in the Go compiler or standard library, I haven't investigated it at all yet. I can't reproduce the issue using Go 1.9.

support: API compatibility?

Hi. Are the suggestions of API-compatible alternatives for other platforms?

Thank you!

warning: 'SecKeychainItemDelete' is deprecated'

cgo-gcc-prolog:53:11: warning: 'SecKeychainItemDelete' is deprecated: first deprecated in macOS 10.10 - SecKeychain is deprecated [-Wdeprecated-declarations]
/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecKeychainItem.h:257:10: note: 'SecKeychainItemDelete' has been explicitly marked deprecated here
//
It can build, but wanna be better if no warning left :)

Compile failure on Go 1.11 beta 2

Please see golang/go#26721 for more information. Here is the error I get when building this library with tip.

$ go build .
# github.com/keybase/go-keychain
./corefoundation_1.10.go:55: cannot use nil as type _Ctype_CFAllocatorRef in argument to _Cfunc_CFDataCreate
./corefoundation_1.10.go:81: cannot use nil as type _Ctype_CFAllocatorRef in argument to func literal
./corefoundation_1.10.go:118: cannot use nil as type _Ctype_CFAllocatorRef in argument to _Cfunc_CFStringCreateWithBytes
./corefoundation_1.10.go:153: cannot use nil as type _Ctype_CFAllocatorRef in argument to func literal

Devices - New Paper Key

On the iOS app if you goto your Settings tab and Select "Devices" then select "+ Add New", then "Paper Key" it will generate a new Key. It seems that it requires you to click/slide the options saying that you wrote it down to continue/add it to your account.

You can just Click the Setting Page Button 2-3 times and it will go back and add the paper Key despite the user's confirmation selection (that it was copied down somewhere).
It added the paper Key when its generated not when the user confirms that they have a copy.

Blank labels when Keychain prompts for access to items

I'm having a really strange problem with Keychain entries created via Keychain:

Despite having a Label, my items show a blank string when queried. When I create one manually it works fine.

Interest in TouchID support?

I'm considering implementing TouchID support as mentioned here: https://developer.apple.com/documentation/localauthentication

Any interest in a PR?

Using SecClassInternetPassword

Any reason the library doesn't work with SecClassInternetPassword? Is there a specific reason this is limited for this library or is it a feature that would be appreciated?

a

MacOS 10.15 Deprecation

Updated MacOS earlier and now I'm getting this warning.

# github.com/keybase/go-keychain
cgo-gcc-prolog:203:11: warning: 'SecTrustedApplicationCreateFromPath' is deprecated: first deprecated in macOS 10.15 - No longer supported [-Wdeprecated-declarations]
/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/System/Library/Frameworks/Security.framework/Headers/SecTrustedApplication.h:59:10: note: 'SecTrustedApplicationCreateFromPath' has been explicitly marked deprecated here

TouchID access control?

Similar to #11, but not quite.

It looks like if you set a certain attribute on the keychain item, you can have it prompt for a TouchID instead of a password.

https://developer.apple.com/documentation/localauthentication/accessing_keychain_items_with_face_id_or_touch_id

This would be a lot better from a UX perspective, and might deter users from clicking Always Allow.

signal: killed

I'm unable to run keychain.NewItem() on OSX 10.12.5 (16F73) using go1.8 darwin/amd64. I keep getting a signal: killed with no other output in spite of me running print-lines before and after accessing anything keychain related. Might it be in the init it fails?

I am getting the same error when running go test in the repo as well,

// main.go
func main() {
	fmt.Println("new")
	item := keychain.NewItem()
	fmt.Println("done")
	item.SetSecClass(keychain.SecClassGenericPassword)
	item.SetService("MyService")
	item.SetAccount("gabriel")
	item.SetLabel("A label")
	item.SetAccessGroup("A123456789.group.com.mycorp")
	item.SetData([]byte("toomanysecrets"))
	item.SetSynchronizable(keychain.SynchronizableNo)
	item.SetAccessible(keychain.AccessibleWhenUnlocked)

	fmt.Println("attempting to add..")
	err := keychain.AddItem(item)

	if err == keychain.ErrorDuplicateItem {
		fmt.Println("failed to add")
		fmt.Println(err)
		os.Exit(1)
	}
}

output:

> go run main.go
signal: killed

> go test
signal: killed
FAIL	github.com/keybase/go-keychain	0.004s

Does anyone have any ideas? Is there maybe a step I am missing?

`undefined: keychain.NewItem` when building for Linux from macOS

Hello! I see Linux support is mentioned in readme, but when I try to build for Linux, I'm seeing many undefined errors. Is Linux support official? Thank you!

Saw a few other discussions using xgo: https://github.com/karalabe/xgo, and using different build files for different os: #14. Is this package only meant to be called in darwin, and not supposed to be called in other os? How to make it work like mentioned in readme, communicates to a provider of the DBUS SecretService spec like gnome-keyring or ksecretservice.?