Problem
The keyring backend uses zalando/go-keyring, which on macOS shells out to /usr/bin/security. Verified against v0.2.8 and by local experiment:
- Secrets are passed via stdin (
security -i), so the existing "never argv" guarantee holds — that part is fine.
- Keychain items created through
security carry security itself in their ACL. Any process running as the user can read stored tokens back with security find-generic-password -w — no prompt, ever (reproduced locally). The keychain adds effectively no protection over a plaintext file against same-user local attackers.
- Keychain permission prompts (when they do appear) attribute access to "security", not tfvault, so users can't make an informed decision.
Details in zalando/go-keyring#64 (see tekumara's comment) and maintainer feedback in bendrucker/terraform-credentials-keychain#69.
Proposal
Use the native Keychain API on darwin (CGO — e.g. 99designs/keyring or keybase/go-keychain) so items are ACL-scoped to the tfvault binary: an "Always Allow" grant then covers tfvault only, not every process on the machine.
Hard dependency: #13
ACLs identify trusted apps by code signature. Without a stable signing identity, every release upgrade invalidates the ACL and re-prompts — worse UX than today. Do not ship this before #13.
Open questions
- Library choice: 99designs/keyring (broader backends, heavier) vs keybase/go-keychain for darwin only, keeping zalando/go-keyring for Linux Secret Service
- goreleaser: darwin builds need CGO (macOS runner or zig/osxcross cross-compilation); today's builds are presumably CGO_ENABLED=0
- Migration: existing items were created by
security — read-and-rewrite them on first use, or document a one-time re-login?
- README security notes should meanwhile document the current macOS limitation honestly (interim, independent of this issue)
References
Problem
The
keyringbackend uses zalando/go-keyring, which on macOS shells out to/usr/bin/security. Verified against v0.2.8 and by local experiment:security -i), so the existing "never argv" guarantee holds — that part is fine.securitycarrysecurityitself in their ACL. Any process running as the user can read stored tokens back withsecurity find-generic-password -w— no prompt, ever (reproduced locally). The keychain adds effectively no protection over a plaintext file against same-user local attackers.Details in zalando/go-keyring#64 (see tekumara's comment) and maintainer feedback in bendrucker/terraform-credentials-keychain#69.
Proposal
Use the native Keychain API on darwin (CGO — e.g. 99designs/keyring or keybase/go-keychain) so items are ACL-scoped to the tfvault binary: an "Always Allow" grant then covers tfvault only, not every process on the machine.
Hard dependency: #13
ACLs identify trusted apps by code signature. Without a stable signing identity, every release upgrade invalidates the ACL and re-prompts — worse UX than today. Do not ship this before #13.
Open questions
security— read-and-rewrite them on first use, or document a one-time re-login?References