Set key partition

[pronebird]

Hi it would be great to add a tool to share keychain access with apple tools, akin to:

security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${{ env.KEYCHAIN_PASSPHRASE }}" ${{ env.KEYCHAIN_NAME }}

[priitlatt]

@pronebird thanks for the suggestion. Could you please describe a little further in which context this would be useful? I'm wondering if it should also be possible to do this already as part of keychain initialize, which unlocks and sets timeout on the created keychain.

[pronebird]

security set-key-partition-list should be called after importing items in the keychain AFAIK and not as a part of initialize because. From what I know, it marks existing items in the keychain for sharing with a set of tools.

Documentation is not very clear but I have seen this command as a part of nearly every workflow that involves signing and I suppose it opens access for the items in the keychain for a group of applications.

I have poor understanding of how that command is different from --allow-app for individual keychain items, but I am certain I had issues with keychain password prompts when not using set-key-partition-list.

We also use it in nym vpn app workflows:
https://github.com/nymtech/nym-vpn-client/blob/develop/.github/workflows/build-nym-vpn-apple.yml#L202

I wish I could give a better answer. I'll look into removing this command from our workflows and see if it makes any difference.

set-key-partition-list [-S partition-list] [-k password] [options...] [keychain] Sets the "partition list" for a key. The "partition
     list" is an extra parameter in the ACL which limits access to the key based on an application's code signature. You must present the
     keychain's password to change a partition list. If you'd like to run /usr/bin/codesign with the key, "apple:" must be an element of
     the partition list.

            -S partition-list
                            Comma-separated partition list. See output of "security dump-keychain" for examples.
            -k password     Password for keychain
            -a application-label
                            Match "application label" string
            -c creator      Match creator (four-character code)
            -d              Match keys that can decrypt
            -D description  Match "description" string
            -e              Match keys that can encrypt
            -j comment      Match comment string
            -l label        Match label string
            -r              Match keys that can derive
            -s              Match keys that can sign
            -t type         Type of key to find: one of "symmetric", "public", or "private"
            -u              Match keys that can unwrap
            -v              Match keys that can verify
            -w              Match keys that can wrap

[priitlatt]

Thanks for getting back so quickly. I would have assumed that the --allow-app option of keychain add-certificate would suffice. But if this is not the case then maybe there is indeed reason to add another action.