ruby-keychain 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6e04321838eb56846f4466e1445a61fc151e0277
-  data.tar.gz: e72847b0ff4e7ae119c5c28f73f3fa572fcc36b0
+  metadata.gz: bb0999fd346873c8e15ccf0c8bc3c5628038b624
+  data.tar.gz: fc4c28aadbd999c1f7f209846cc3d108c96ac7a1
 SHA512:
-  metadata.gz: cdaddc9163798d7310dbb46112f5b70840243c16d1635736a4b7b15f0f9ee16166e72cce2cb2bbd6028e0be6b2d859f4aa61f4f5a8dfddf7443eeac6c1124a3a
-  data.tar.gz: 62e46ccd6d53e9d9e5b9f87b8818c25ac447d324086ee6435545281dc66138f5c7c3c545e8c37d5d4dff829c7fbcb3234ade5c13091457f26a93f6e049595598
+  metadata.gz: ca9482d75b40a474dd0c006132b317b40439a70bbb85a74970ad35dda8fb239bf18c57f548942d87fb57513955e418ea976ba9e594daefbdb6c2b4e27e038731
+  data.tar.gz: befc1c3a074dc4be549b2705135fbfcda18c958cbc3ef685eac1a88ead2f5140814c2019e53a1b9e48c10fda53c928fde08bb27c5bbbc1e4ae5b9f3efc09c34b

data/lib/keychain.rb

@@ -4,6 +4,9 @@ require 'keychain/sec'
 require 'keychain/keychain'
 require 'keychain/error'
 require 'keychain/item'
+require 'keychain/key'
+require 'keychain/certificate'
+require 'keychain/identity'
 require 'keychain/scope'
 require 'keychain/protocols'
 # top level constant for this library

data/lib/keychain/certificate.rb

@@ -0,0 +1,57 @@
+require 'openssl'
+
+module Sec
+  SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION = 0
+
+  attach_function 'SecCertificateCopyPublicKey', [:pointer, :pointer], :osstatus
+  attach_function 'SecCertificateCopyData', [:pointer], :pointer
+
+  attach_variable 'kSecAttrCertificateType', :pointer
+  attach_variable 'kSecAttrCertificateEncoding', :pointer
+  attach_variable 'kSecAttrSubject', :pointer
+  attach_variable 'kSecAttrIssuer', :pointer
+  attach_variable 'kSecAttrSerialNumber', :pointer
+  attach_variable 'kSecAttrSubjectKeyID', :pointer
+  attach_variable 'kSecAttrPublicKeyHash', :pointer
+end
+
+class Keychain::Certificate < Sec::Base
+  register_type 'SecCertificate'
+
+  ATTR_MAP = {CF::Base.typecast(Sec::kSecAttrAccessible) => :accessible,
+              CF::Base.typecast(Sec::kSecAttrAccessGroup) => :access_group,
+              CF::Base.typecast(Sec::kSecAttrCertificateType) => :certificate_type,
+              CF::Base.typecast(Sec::kSecAttrCertificateEncoding) => :certificate_encoding,
+              CF::Base.typecast(Sec::kSecAttrLabel) => :label,
+              CF::Base.typecast(Sec::kSecAttrSubject) => :subject,
+              CF::Base.typecast(Sec::kSecAttrIssuer) => :issuer,
+              CF::Base.typecast(Sec::kSecAttrSerialNumber) => :serial_number,
+              CF::Base.typecast(Sec::kSecAttrSubjectKeyID) => :subject_key_id,
+              CF::Base.typecast(Sec::kSecAttrPublicKeyHash) => :public_key_hash}
+
+  ATTR_MAP[CF::Base.typecast(Sec::kSecAttrAccessControl)] = :access_control if defined?(Sec::kSecAttrAccessControl)
+
+  INVERSE_ATTR_MAP = ATTR_MAP.invert
+  define_attributes(ATTR_MAP)
+
+  def klass
+    Sec::Classes::CERTIFICATE.to_ruby
+  end
+
+  def public_key
+    key_ref = FFI::MemoryPointer.new(:pointer)
+    status = Sec.SecCertificateCopyPublicKey(self, key_ref)
+    Sec.check_osstatus(status)
+
+    Keychain::Key.new(key_ref.read_pointer)
+  end
+
+  def x509
+    data_ptr = Sec.SecCertificateCopyData(self)
+    data = CF::Data.new(data_ptr)
+
+    result = OpenSSL::X509::Certificate.new(data.to_s)
+    data.release
+    result
+  end
+end

data/lib/keychain/identity.rb

@@ -0,0 +1,53 @@
+require 'openssl'
+
+module Sec
+  attach_function 'SecIdentityCopyPrivateKey', [:pointer, :pointer], :osstatus
+  attach_function 'SecIdentityCopyCertificate', [:pointer, :pointer], :osstatus
+
+  attach_variable 'kSecAttrKeyClass', :pointer
+  attach_variable 'kSecAttrLabel', :pointer
+end
+
+class Keychain::Identity < Sec::Base
+  register_type 'SecIdentity'
+
+  ATTR_MAP = Keychain::Certificate::ATTR_MAP.merge(Keychain::Key::ATTR_MAP)
+
+  INVERSE_ATTR_MAP = ATTR_MAP.invert
+  define_attributes(ATTR_MAP)
+
+  def klass
+    Sec::Classes::IDENTITY.to_ruby
+  end
+
+  def certificate
+    certificate_ref = FFI::MemoryPointer.new(:pointer)
+    status = Sec.SecIdentityCopyCertificate(self, certificate_ref)
+    Sec.check_osstatus(status)
+
+    Keychain::Certificate.new(certificate_ref.read_pointer)
+  end
+
+  def private_key
+    key_ref = FFI::MemoryPointer.new(:pointer)
+    status = Sec.SecIdentityCopyPrivateKey(self, key_ref)
+    Sec.check_osstatus(status)
+
+    Keychain::Key.new(key_ref.read_pointer)
+  end
+
+  def pkcs12(passphrase='')
+    flags = Sec::SecItemImportExportKeyParameters.new
+    flags[:version] = Sec::SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION
+    flags[:passphrase] = CF::String.from_string(passphrase).to_ptr
+
+    data_ptr = FFI::MemoryPointer.new(:pointer)
+    status = Sec.SecItemExport(self, :kSecFormatPKCS12, 0, flags, data_ptr)
+    Sec.check_osstatus(status)
+
+    data = CF::Data.new(data_ptr.read_pointer)
+    result = OpenSSL::PKCS12.new(data.to_s)
+    data.release
+    result
+  end
+end

data/lib/keychain/item.rb

@@ -4,33 +4,44 @@ module Sec
   attach_function 'SecItemAdd', [:pointer, :pointer], :osstatus
   attach_function 'SecItemUpdate', [:pointer, :pointer], :osstatus
   attach_function 'SecKeychainItemCopyKeychain', [:pointer, :pointer], :osstatus
-
 end
 
 # An individual item from the keychain. Individual accessors are generated for the items attributes
 #
 #
 class Keychain::Item < Sec::Base
-  attr_accessor :attributes
   register_type 'SecKeychainItem'
 
+  ATTR_MAP = {CF::Base.typecast(Sec::kSecAttrAccess) => :access,
+              CF::Base.typecast(Sec::kSecAttrAccount) => :account,
+              CF::Base.typecast(Sec::kSecAttrAuthenticationType) => :authentication_type,
+              CF::Base.typecast(Sec::kSecAttrComment) => :comment,
+              CF::Base.typecast(Sec::kSecAttrCreationDate) => :created_at,
+              CF::Base.typecast(Sec::kSecAttrCreator) => :creator,
+              CF::Base.typecast(Sec::kSecAttrDescription) => :description,
+              CF::Base.typecast(Sec::kSecAttrGeneric) => :generic,
+              CF::Base.typecast(Sec::kSecAttrIsInvisible) => :invisible,
+              CF::Base.typecast(Sec::kSecAttrIsNegative) => :negative,
+              CF::Base.typecast(Sec::kSecAttrLabel) => :label,
+              CF::Base.typecast(Sec::kSecAttrModificationDate) => :updated_at,
+              CF::Base.typecast(Sec::kSecAttrPath) => :path,
+              CF::Base.typecast(Sec::kSecAttrPort) => :port,
+              CF::Base.typecast(Sec::kSecAttrProtocol) => :protocol,
+              CF::Base.typecast(Sec::kSecAttrSecurityDomain) => :security_domain,
+              CF::Base.typecast(Sec::kSecAttrServer) => :server,
+              CF::Base.typecast(Sec::kSecAttrService) => :service,
+              CF::Base.typecast(Sec::kSecAttrType) => :type,
+              CF::Base.typecast(Sec::kSecClass)    => :klass}
+
+  INVERSE_ATTR_MAP = ATTR_MAP.invert
+  define_attributes(ATTR_MAP)
+
   # returns a programmer friendly description of the item
   # @return [String]
   def inspect
     "<SecKeychainItem 0x#{@ptr.address.to_s(16)} #{service ? "service: #{service}" : "server: #{server}"} account: #{account}>"
   end
 
-  Sec::ATTR_MAP.values.each do |ruby_name|
-    unless method_defined?(ruby_name)
-      define_method ruby_name do
-        @attributes[ruby_name]
-      end
-      define_method ruby_name.to_s+'=' do |value|
-        @attributes[ruby_name] = value
-      end
-    end
-  end
-
   # Creates a new keychain item either from an FFI::Pointer or a hash of attributes
   #
   # @param [FFI::Pointer, Hash] attrs_or_pointer Either an FFI::Pointer to an existing 
@@ -47,12 +58,6 @@ class Keychain::Item < Sec::Base
     end
   end
 
-  # @private
-  def initialize(*args)
-    super
-    @attributes = {}
-  end
-
   # Removes the item from the associated keychain
   #
   def delete
@@ -69,25 +74,15 @@ class Keychain::Item < Sec::Base
     @unsaved_password = value
   end
 
-  # Returns the keychain the item is in
-  #
-  # @return [Keychain::Keychain]
-  def keychain
-    out = FFI::MemoryPointer.new :pointer
-    status = Sec.SecKeychainItemCopyKeychain(self,out)
-    Sec.check_osstatus(status)
-    CF::Base.new(out.read_pointer).release_on_gc
-  end
-
   # Fetches the password data associated with the item. This may cause the user to be asked for access
   # @return [String] The password data, an ASCII_8BIT encoded string
   def password
     return @unsaved_password if @unsaved_password
     out_buffer = FFI::MemoryPointer.new(:pointer)
     status = Sec.SecItemCopyMatching({Sec::Query::ITEM_LIST => CF::Array.immutable([self]),
-                              Sec::Query::SEARCH_LIST => [self.keychain],
-                             Sec::Query::CLASS => klass, 
-                             Sec::Query::RETURN_DATA => true}.to_cf, out_buffer)
+                                      Sec::Query::SEARCH_LIST => [self.keychain],
+                                      Sec::Query::CLASS => self.klass,
+                                      Sec::Query::RETURN_DATA => true}.to_cf, out_buffer)
     Sec.check_osstatus(status)
     CF::Base.typecast(out_buffer.read_pointer).to_s
   end
@@ -102,7 +97,9 @@ class Keychain::Item < Sec::Base
       cf_dict = update
     else
       cf_dict = create(options)
-    end    
+      self.ptr = cf_dict[Sec::Value::REF].to_ptr
+      self.retain.release_on_gc
+    end
     @unsaved_password = nil
     update_self_from_dictionary(cf_dict)
     cf_dict.release
@@ -132,7 +129,9 @@ class Keychain::Item < Sec::Base
   end
 
   def update
-    status = Sec.SecItemUpdate({Sec::Query::SEARCH_LIST => [self.keychain], Sec::Query::ITEM_LIST => [self], Sec::INVERSE_ATTR_MAP[:klass] => klass}.to_cf, build_new_attributes);
+    status = Sec.SecItemUpdate({Sec::Query::SEARCH_LIST => [self.keychain],
+                                Sec::Query::ITEM_LIST => [self],
+                                Sec::Query::CLASS => klass}.to_cf, build_new_attributes);
     Sec.check_osstatus(status)
 
     result = FFI::MemoryPointer.new :pointer
@@ -142,21 +141,6 @@ class Keychain::Item < Sec::Base
     cf_dict = CF::Base.typecast(result.read_pointer)
   end
     
-
-
-  def update_self_from_dictionary(cf_dict)
-    if !persisted?
-      self.ptr = cf_dict[Sec::Value::REF].to_ptr
-      self.retain.release_on_gc
-    end
-    @attributes = cf_dict.inject({}) do |memo, (k,v)|
-      if ruby_name = Sec::ATTR_MAP[k]
-        memo[ruby_name] = v.to_ruby
-      end
-      memo
-    end
-  end
-
   def build_create_query options
     query = CF::Dictionary.mutable
     query[Sec::Value::DATA] = CF::Data.from_string(@unsaved_password) if @unsaved_password
@@ -172,7 +156,7 @@ class Keychain::Item < Sec::Base
     query[Sec::Query::ITEM_LIST] = CF::Array.immutable([self])
     query[Sec::Query::RETURN_ATTRIBUTES] = CF::Boolean::TRUE
     query[Sec::Query::RETURN_REF] = CF::Boolean::TRUE
-    query[Sec::INVERSE_ATTR_MAP[:klass]] = klass.to_cf
+    query[Sec::Query::CLASS] = klass.to_cf
     query
   end
 
@@ -181,7 +165,7 @@ class Keychain::Item < Sec::Base
     @attributes.each do |k,v|
       next if k == :created_at || k == :updated_at
       next if k == :klass && persisted?
-      k = Sec::INVERSE_ATTR_MAP[k]
+      k = self.class::INVERSE_ATTR_MAP[k]
       new_attributes[k] = v.to_cf
     end
     new_attributes[Sec::Value::DATA] = CF::Data.from_string(@unsaved_password) if @unsaved_password

data/lib/keychain/key.rb

@@ -0,0 +1,105 @@
+module Sec
+  attach_variable 'kSecAttrAccessible', :pointer
+
+  begin
+    attach_variable 'kSecAttrAccessControl', :pointer
+  rescue FFI::NotFoundError #Only available in 10.10
+  end
+
+  attach_variable 'kSecAttrAccessGroup', :pointer
+  attach_variable 'kSecAttrKeyClass', :pointer
+  attach_variable 'kSecAttrApplicationLabel', :pointer
+  attach_variable 'kSecAttrIsPermanent', :pointer
+  attach_variable 'kSecAttrApplicationTag', :pointer
+  attach_variable 'kSecAttrKeyType', :pointer
+  attach_variable 'kSecAttrKeySizeInBits', :pointer
+  attach_variable 'kSecAttrEffectiveKeySize', :pointer
+  attach_variable 'kSecAttrCanEncrypt', :pointer
+  attach_variable 'kSecAttrCanDecrypt', :pointer
+  attach_variable 'kSecAttrCanDerive', :pointer
+  attach_variable 'kSecAttrCanSign', :pointer
+  attach_variable 'kSecAttrCanVerify', :pointer
+  attach_variable 'kSecAttrCanWrap', :pointer
+  attach_variable 'kSecAttrCanUnwrap', :pointer
+
+  enum :SecItemImportExportFlags, [:kSecItemPemArmour, 1]
+
+  enum :SecExternalFormat, [:kSecFormatUnknown, 0,
+                            :kSecFormatOpenSSL,
+                            :kSecFormatSSH,
+                            :kSecFormatBSAFE,
+                            :kSecFormatRawKey,
+                            :kSecFormatWrappedPKCS8,
+                            :kSecFormatWrappedOpenSSL,
+                            :kSecFormatWrappedSSH,
+                            :kSecFormatWrappedLSH,
+                            :kSecFormatX509Cert,
+                            :kSecFormatPEMSequence,
+                            :kSecFormatPKCS7,
+                            :kSecFormatPKCS12,
+                            :kSecFormatNetscapeCertSequence,
+                            :kSecFormatSSHv2]
+
+  enum :SecKeyImportExportParameters, [:kSecKeyImportOnlyOne, 1,
+                                       :kSecKeySecurePassphrase, 2,
+                                       :kSecKeyNoAccessControl, 4]
+
+  class SecItemImportExportKeyParameters < FFI::Struct
+    layout  :version, :uint32,
+            :flags, :SecKeyImportExportParameters,
+            :passphrase, :pointer,
+            :alertTitle, :pointer,
+            :alertPrompt, :pointer,
+            :accessRef, :pointer,
+            :keyUsage, :pointer,
+            :keyAttributes, :pointer
+  end
+
+  attach_function 'SecItemExport', [:pointer, :SecExternalFormat, :SecItemImportExportFlags, :pointer, :pointer], :osstatus
+end
+
+class Keychain::Key < Sec::Base
+  register_type 'SecKey'
+
+  ATTR_MAP = {CF::Base.typecast(Sec::kSecAttrAccessible) => :accessible,
+              CF::Base.typecast(Sec::kSecAttrAccessGroup) => :access_group,
+              CF::Base.typecast(Sec::kSecAttrKeyClass) => :key_class,
+              CF::Base.typecast(Sec::kSecAttrLabel) => :label,
+              CF::Base.typecast(Sec::kSecAttrApplicationLabel) => :application_label,
+              CF::Base.typecast(Sec::kSecAttrIsPermanent) => :is_permanent,
+              CF::Base.typecast(Sec::kSecAttrApplicationTag) => :application_tag,
+              CF::Base.typecast(Sec::kSecAttrKeyType) => :key_type,
+              CF::Base.typecast(Sec::kSecAttrKeySizeInBits) => :size_in_bites,
+              CF::Base.typecast(Sec::kSecAttrEffectiveKeySize) => :effective_key_size,
+              CF::Base.typecast(Sec::kSecAttrCanEncrypt) => :can_encrypt,
+              CF::Base.typecast(Sec::kSecAttrCanDecrypt) => :can_decrypt,
+              CF::Base.typecast(Sec::kSecAttrCanDerive) => :can_derive,
+              CF::Base.typecast(Sec::kSecAttrCanSign) => :can_sign,
+              CF::Base.typecast(Sec::kSecAttrCanVerify) => :can_verify,
+              CF::Base.typecast(Sec::kSecAttrCanWrap) => :can_wrap,
+              CF::Base.typecast(Sec::kSecAttrCanUnwrap) => :can_unwrap}
+
+  ATTR_MAP[CF::Base.typecast(Sec::kSecAttrAccessControl)] = :access_control if defined?(Sec::kSecAttrAccessControl)
+
+  INVERSE_ATTR_MAP = ATTR_MAP.invert
+  define_attributes(ATTR_MAP)
+
+  def klass
+    Sec::Classes::KEY.to_ruby
+  end
+
+  def export(passphrase = nil, format = :kSecFormatUnknown)
+    flags = Sec::SecItemImportExportKeyParameters.new
+    flags[:version] = Sec::SEC_KEY_IMPORT_EXPORT_PARAMS_VERSION
+    flags[:passphrase] = CF::String.from_string(passphrase).to_ptr if passphrase
+
+    data_ptr = FFI::MemoryPointer.new(:pointer)
+    status = Sec.SecItemExport(self, format, :kSecItemPemArmour, flags, data_ptr)
+    Sec.check_osstatus(status)
+
+    data = CF::Data.new(data_ptr.read_pointer)
+    result = data.to_s
+    data.release
+    result
+  end
+end

data/lib/keychain/scope.rb

@@ -111,14 +111,31 @@ class Keychain::Scope
     unless result.is_a?(CF::Array)
       result = CF::Array.immutable([result])
     end
-    result.collect {|dictionary_of_attributes| Keychain::Item.from_dictionary_of_attributes(dictionary_of_attributes)}
+    result.collect do |dictionary_of_attributes|
+      item = dictionary_of_attributes[Sec::Value::REF]
+      item.update_self_from_dictionary(dictionary_of_attributes)
+      item
+    end
   end
 
-
   def to_query
     query = CF::Dictionary.mutable
+    # This is terrible but we need to know the result class to get the list of attributes
+    inverse_attributes = case @kind
+                           when Sec::Classes::CERTIFICATE
+                             Keychain::Certificate::INVERSE_ATTR_MAP
+                           when Sec::Classes::GENERIC
+                             Keychain::Item::INVERSE_ATTR_MAP
+                           when Sec::Classes::IDENTITY
+                             Keychain::Identity::INVERSE_ATTR_MAP
+                           when Sec::Classes::INTERNET
+                             Keychain::Item::INVERSE_ATTR_MAP
+                           when Sec::Classes::KEY
+                             Keychain::Key::INVERSE_ATTR_MAP
+                         end
+
     @conditions.each do |k,v|
-      k = Sec::INVERSE_ATTR_MAP[k]
+      k = inverse_attributes[k]
       query[k] = v.to_cf
     end
 

data/lib/keychain/sec.rb

@@ -15,10 +15,12 @@ module Sec
       :errSecInteractionNotAllowed, -25308
   ]
 
+  attach_variable 'kSecClass', :pointer
   attach_variable 'kSecClassInternetPassword', :pointer
   attach_variable 'kSecClassGenericPassword', :pointer
-
-  attach_variable 'kSecClass', :pointer
+  attach_variable 'kSecClassCertificate', :pointer
+  attach_variable 'kSecClassIdentity', :pointer
+  attach_variable 'kSecClassKey', :pointer
 
   attach_variable 'kSecAttrAccess', :pointer
   attach_variable 'kSecAttrAccount', :pointer
@@ -54,36 +56,6 @@ module Sec
   attach_variable 'kSecValueData', :pointer
   attach_variable 'kSecUseKeychain', :pointer
 
-  
-
-  # map of kSecAttr* constants to the corresponding ruby name for the attribute
-  # Used in {Keychain::Item#attributes}}
-  ATTR_MAP = {
-    CF::Base.typecast(kSecAttrAccess) => :access,
-    CF::Base.typecast(kSecAttrAccount) => :account,
-    CF::Base.typecast(kSecAttrAuthenticationType) => :authentication_type,
-    CF::Base.typecast(kSecAttrComment) => :comment,
-    CF::Base.typecast(kSecAttrCreationDate) => :created_at,
-    CF::Base.typecast(kSecAttrCreator) => :creator,
-    CF::Base.typecast(kSecAttrDescription) => :description,
-    CF::Base.typecast(kSecAttrGeneric) => :generic,
-    CF::Base.typecast(kSecAttrIsInvisible) => :invisible,
-    CF::Base.typecast(kSecAttrIsNegative) => :negative,
-    CF::Base.typecast(kSecAttrLabel) => :label,
-    CF::Base.typecast(kSecAttrModificationDate) => :updated_at,
-    CF::Base.typecast(kSecAttrPath) => :path,
-    CF::Base.typecast(kSecAttrPort) => :port,
-    CF::Base.typecast(kSecAttrProtocol) => :protocol,
-    CF::Base.typecast(kSecAttrSecurityDomain) => :security_domain,
-    CF::Base.typecast(kSecAttrServer) => :server,
-    CF::Base.typecast(kSecAttrService) => :service,
-    CF::Base.typecast(kSecAttrType) => :type,
-    CF::Base.typecast(kSecClass)    => :klass
-  }
-
-  # Inverse of {ATTR_MAP}
-  INVERSE_ATTR_MAP = ATTR_MAP.invert
-
   # Query options for use with SecCopyMatching, SecItemUpdate
   #
   module Query
@@ -105,10 +77,16 @@ module Sec
 
   # defines constants for use as the class of an item
   module Classes
-    # constant identifiying generic passwords (kSecClassGenericPassword)
+    # constant identifying certificates (kSecClassCertificate)
+    CERTIFICATE =   CF::Base.typecast(Sec.kSecClassCertificate)
+    # constant identifying generic passwords (kSecClassGenericPassword)
     GENERIC =   CF::Base.typecast(Sec.kSecClassGenericPassword)
+    # constant identifying generic passwords (kSecClassIdentity)
+    IDENTITY =   CF::Base.typecast(Sec.kSecClassIdentity)
     # constant identifying internet passwords (kSecClassInternetPassword)
     INTERNET = CF::Base.typecast(Sec.kSecClassInternetPassword)
+    # constant identifying public/private key items (kSecClassKey)
+    KEY = CF::Base.typecast(Sec.kSecClassKey)
   end
 
   # Search match types for use with SecCopyMatching
@@ -132,11 +110,62 @@ module Sec
   #
   # @abstract
   class Base < CF::Base
-    #@private
+    attr_reader :attributes
+
     def self.register_type(type_name)
       Sec.attach_function "#{type_name}GetTypeID", [], CF.find_type(:cftypeid)
       @@type_map[Sec.send("#{type_name}GetTypeID")] = self
     end
+
+    def self.define_attributes(attr_map)
+      attr_map.values.each do |ruby_name|
+        unless method_defined?(ruby_name)
+          define_method ruby_name do
+            self.attributes[ruby_name]
+          end
+          define_method ruby_name.to_s+'=' do |value|
+            self.attributes[ruby_name] = value
+          end
+        end
+      end
+    end
+
+    def initialize(ptr)
+      super
+      @attributes = {}
+    end
+
+    def update_self_from_dictionary(cf_dict)
+      @attributes = cf_dict.inject({}) do |memo, (k,v)|
+        if ruby_name = self.class::ATTR_MAP[k]
+          memo[ruby_name] = v.to_ruby
+        end
+        memo
+      end
+    end
+
+    # Returns the keychain the item is in
+    #
+    # @return [Keychain::Keychain]
+    def keychain
+      out = FFI::MemoryPointer.new :pointer
+      status = Sec.SecKeychainItemCopyKeychain(self,out)
+      Sec.check_osstatus(status)
+      CF::Base.new(out.read_pointer).release_on_gc
+    end
+
+    def load_attributes
+      result = FFI::MemoryPointer.new :pointer
+      status = Sec.SecItemCopyMatching({Sec::Query::SEARCH_LIST => [self.keychain],
+                                        Sec::Query::ITEM_LIST => [self],
+                                        Sec::Query::CLASS => self.klass,
+                                        Sec::Query::RETURN_ATTRIBUTES => true,
+                                        Sec::Query::RETURN_REF => false}.to_cf, result)
+      Sec.check_osstatus(status)
+
+      cf_dict = CF::Base.typecast(result.read_pointer)
+      update_self_from_dictionary(cf_dict)
+    end
   end
 
   # If the result is non-zero raises an exception.

data/lib/keychain/version.rb

@@ -1,4 +1,4 @@
 module Keychain
   # The current version string
-  VERSION = '0.1.2'
+  VERSION = '0.2.0'
 end

data/spec/certificate_spec.rb

@@ -0,0 +1,30 @@
+require 'spec_helper'
+
+describe Keychain::Certificate do
+  # Test using the com.apple.systemdefault self-signed certificate that
+  # all OSX machines should have installed.
+  let(:query){{:label => 'com.apple.systemdefault'}}
+
+  describe 'query' do
+    it 'should return a certificate' do
+      scope = Keychain::Scope.new(Sec::Classes::CERTIFICATE)
+      certs = scope.where(query).all
+      expect(certs.length).to be > 0
+      expect(certs.first).to be_kind_of(Keychain::Certificate)
+    end
+  end
+
+  describe 'certificate' do
+    it 'should have a public key' do
+      scope = Keychain::Scope.new(Sec::Classes::CERTIFICATE)
+      cert = scope.where(query).first
+      expect(cert.public_key).to be_kind_of(Keychain::Key)
+    end
+
+    it 'should be exportable to x509' do
+      scope = Keychain::Scope.new(Sec::Classes::CERTIFICATE)
+      cert = scope.where(query).first
+      expect(cert.x509).to be_kind_of(OpenSSL::X509::Certificate)
+    end
+  end
+end

data/spec/identity_spec.rb

@@ -0,0 +1,42 @@
+require 'spec_helper'
+
+describe Keychain::Identity do
+  before(:context) do
+    Keychain.user_interaction_allowed = false
+    @keychain = Keychain.open(File.join(File.dirname(__FILE__), 'spec.keychain'))
+    @keychain.unlock! 'DummyPassword'
+
+  end
+  after(:context) do
+    Keychain.user_interaction_allowed = true
+  end
+  describe 'query' do
+    it 'should return a identity' do
+      scope = Keychain::Scope.new(Sec::Classes::IDENTITY, @keychain)
+      identities = scope.all
+      expect(identities.length).to be > 0
+      expect(identities.first).to be_kind_of(Keychain::Identity)
+    end
+  end
+
+  describe 'identify' do
+    it 'should have a certificate' do
+      scope = Keychain::Scope.new(Sec::Classes::IDENTITY, @keychain)
+      identity = scope.all.first
+      expect(identity.certificate).to be_kind_of(Keychain::Certificate)
+    end
+
+    it 'should have a private key' do
+      scope = Keychain::Scope.new(Sec::Classes::IDENTITY, @keychain)
+      identity = scope.all.first
+      expect(identity.private_key).to be_kind_of(Keychain::Key)
+    end
+
+    #this fails on travis - not sure 100% why yet
+    skip 'should be exportable to pkcs12' do
+      scope = Keychain::Scope.new(Sec::Classes::IDENTITY, @keychain)
+      identity = scope.all.first
+      expect(identity.pkcs12).to be_kind_of(OpenSSL::PKCS12)
+    end
+  end
+end

data/spec/key_spec.rb

@@ -0,0 +1,20 @@
+require 'spec_helper'
+
+describe Keychain::Key do
+  describe 'query' do
+    it 'should return a certificate' do
+      scope = Keychain::Scope.new(Sec::Classes::KEY)
+      keys = scope.all
+      expect(keys.length).to be > 0
+      expect(keys.first).to be_kind_of(Keychain::Key)
+    end
+  end
+
+  describe 'identify' do
+    it 'should be exportable to a string' do
+      scope = Keychain::Scope.new(Sec::Classes::KEY)
+      key = scope.first
+      expect(key.export).to be_kind_of(String)
+    end
+  end
+end

data/spec/keychain_item_spec.rb

@@ -18,31 +18,31 @@ describe Keychain::Item do
 
   describe 'keychain' do
     it 'should return the keychain containing the item' do
-      subject.keychain.should == @keychain
+      expect(subject.keychain).to eq(@keychain)
     end
   end
   
   describe 'password' do
     it 'should retrieve the password' do
-      subject.password.should == 'some-password'
+      expect(subject.password).to eq('some-password')
     end
   end
 
   describe 'service' do
     it 'should retrieve the service' do
-      subject.service.should == 'some-service'
+      expect(subject.service).to eq('some-service')
     end
   end
 
   describe 'account' do
     it 'should retrieve the account' do
-      subject.account.should == 'some-account'
+      expect(subject.account).to eq('some-account')
     end
   end
 
   describe 'created_at' do
     it 'should retrieve the item creation date' do
-      subject.created_at.should be_within(2).of(Time.now)
+      expect(subject.created_at).to be_within(2).of(Time.now)
     end
   end
 
@@ -53,15 +53,15 @@ describe Keychain::Item do
       subject.save!
 
       fresh = find_item
-      fresh.password.should == 'new-password'
-      fresh.account.should == 'new-account'
+      expect(fresh.password).to eq('new-password')
+      expect(fresh.account).to eq('new-account')
     end
   end
 
   describe 'delete' do
     it 'should remove the item from the keychain' do
       subject.delete
-      find_item.should be_nil
+      expect(find_item).to be_nil
     end
   end
 end

data/spec/keychain_spec.rb

@@ -4,27 +4,27 @@ describe Keychain do
 
   describe 'user interaction' do
     it 'should be true by default' do
-      Keychain.user_interaction_allowed?.should be_true
+      expect(Keychain.user_interaction_allowed?).to be_truthy
     end
 
     it 'should be changeable' do
       Keychain.user_interaction_allowed = false
-      Keychain.user_interaction_allowed?.should be_false
+      expect(Keychain.user_interaction_allowed?).to be_falsey
       Keychain.user_interaction_allowed = true
-      Keychain.user_interaction_allowed?.should be_true
+      expect(Keychain.user_interaction_allowed?).to be_truthy
     end
   end
 
   describe 'default' do
     it "should return the login keychain" do
-      Keychain.default.path.should == File.expand_path(File.join(ENV['HOME'], 'Library','Keychains', 'login.keychain'))
+      expect(Keychain.default.path).to eq(File.expand_path(File.join(ENV['HOME'], 'Library','Keychains', 'login.keychain')))
     end
   end
 
   describe 'open' do
     it 'should create a keychain reference to a path' do
       keychain = Keychain.open(File.join(ENV['HOME'], 'Library','Keychains', 'login.keychain'))
-      keychain.path.should == Keychain.default.path
+      expect(keychain.path).to eq(Keychain.default.path)
     end
 
     it 'should raise when passed a nil path' do
@@ -37,7 +37,7 @@ describe Keychain do
       begin
         keychain = Keychain.create(File.join(Dir.tmpdir, "other_keychain_spec_#{Time.now.to_i}_#{Time.now.usec}_#{rand(1000)}.keychain"),
                             'password');
-        File.exists?(keychain.path).should be_true
+        expect(File.exists?(keychain.path)).to be_truthy
       ensure
        keychain.delete
       end
@@ -46,7 +46,12 @@ describe Keychain do
     context 'no password supplied' do
       #we have to stub this out as it would trigger a dialog box prompting for a password
       it 'should create a keychain by prompting the user' do
-        Sec.should_receive('SecKeychainCreate').with('akeychain', 0, nil, 1, nil,kind_of(FFI::Pointer)).and_return(0)
+        #we can't just use a kind_of matcher becaue FFI::Pointer#== raises an exception
+        #when compared to non pointer values
+        mock_pointer = double(FFI::MemoryPointer, :read_pointer => 0)
+        allow(FFI::MemoryPointer).to receive(:new).with(:pointer).and_return(mock_pointer)
+
+        expect(Sec).to receive('SecKeychainCreate').with('akeychain', 0, nil, 1, nil,mock_pointer).and_return(0)
         Keychain.create('akeychain')
       end
     end
@@ -55,14 +60,14 @@ describe Keychain do
   describe 'exists?' do
     context 'the keychain exists' do
       it 'should return true' do
-        Keychain.default.exists?.should be_true
+        expect(Keychain.default.exists?).to be_truthy
       end
     end 
 
     context 'the keychain does not exist' do
       it 'should return false' do
         k = Keychain.open('/some/path/that/does/not/exist')
-        k.exists?.should be_false
+        expect(k.exists?).to be_falsey
       end
     end
   end
@@ -74,14 +79,14 @@ describe Keychain do
 
     it 'should read/write lock_on_sleep' do
       @keychain.lock_on_sleep = true
-      @keychain.lock_on_sleep?.should == true
+      expect(@keychain.lock_on_sleep?).to eq(true)
       @keychain.lock_on_sleep = false
-      @keychain.lock_on_sleep?.should == false
+      expect(@keychain.lock_on_sleep?).to eq(false)
     end
 
     it 'should read/write lock_interval' do
       @keychain.lock_interval = 12345
-      @keychain.lock_interval.should == 12345
+      expect(@keychain.lock_interval).to eq(12345)
     end
 
     after(:all) do
@@ -102,7 +107,7 @@ describe Keychain do
 
       it 'should unlock on valid password' do
         @keychain.unlock! 'pass'
-        @keychain.should_not be_locked
+        expect(@keychain).not_to be_locked
       end
     end
   end
@@ -125,15 +130,15 @@ describe Keychain do
     describe('create') do
       it 'should add a password' do
         item =  @keychain_1.send(subject).create(create_arguments)
-        item.should be_a(Keychain::Item)
-        item.klass.should == expected_kind
-        item.password.should == 'some-password'
+        expect(item).to be_a(Keychain::Item)
+        expect(item.klass).to eq(expected_kind)
+        expect(item.password).to eq('some-password')
       end
 
       it 'should be findable' do        
         @keychain_1.send(subject).create(create_arguments)
         item = @keychain_1.send(subject).where(search_for_created_arguments).first
-        item.password.should == 'some-password'
+        expect(item.password).to eq('some-password')
       end
 
       context 'when a duplicate item exists' do
@@ -151,32 +156,32 @@ describe Keychain do
 
       context 'when the keychain does not contains a matching item' do
         it 'should return []' do
-          @keychain_1.send(subject).where(search_arguments_with_no_results).all.should == []
+          expect(@keychain_1.send(subject).where(search_arguments_with_no_results).all).to eq([])
         end
       end
 
       it 'should return an array of results' do
         item = @keychain_1.send(subject).where(search_arguments).all.first
-        item.should be_a(Keychain::Item)
-        item.password.should == 'some-password-1'
+        expect(item).to be_a(Keychain::Item)
+        expect(item.password).to eq('some-password-1')
       end
 
       context 'searching all keychains' do
         context 'when the keychain does contains matching items' do
           it 'should return all of them' do
-            Keychain.send(subject).where(search_arguments_with_multiple_results).all.length.should == 3
+            expect(Keychain.send(subject).where(search_arguments_with_multiple_results).all.length).to eq(3)
           end
         end
 
         context 'when the limit is option is set' do
           it 'should limit the return set' do
-            Keychain.send(subject).where(search_arguments_with_multiple_results).limit(1).all.length.should == 1
+            expect(Keychain.send(subject).where(search_arguments_with_multiple_results).limit(1).all.length).to eq(1)
           end
         end
 
         context 'when a subset of keychains is specified' do
           it 'should return items from those keychains' do
-            Keychain.send(subject).where(search_arguments_with_multiple_results).in(@keychain_1, @keychain_2).all.length.should == 2
+            expect(Keychain.send(subject).where(search_arguments_with_multiple_results).in(@keychain_1, @keychain_2).all.length).to eq(2)
           end
         end
       end
@@ -184,15 +189,15 @@ describe Keychain do
     describe 'first' do
       context 'when the keychain does not contain a matching item' do
         it 'should return nil' do
-          item = @keychain_1.send(subject).where(search_arguments_with_no_results).first.should be_nil
+          item = expect(@keychain_1.send(subject).where(search_arguments_with_no_results).first).to be_nil
         end
       end
 
       context 'when the keychain does contain a matching item' do
         it 'should find it' do
           item = @keychain_1.send(subject).where(search_arguments).first
-          item.should be_a(Keychain::Item)
-          item.password.should == 'some-password-1'
+          expect(item).to be_a(Keychain::Item)
+          expect(item.password).to eq('some-password-1')
         end
       end
 
@@ -202,7 +207,7 @@ describe Keychain do
         end
 
         it 'should not find it' do
-          @keychain_2.send(subject).where(search_arguments).first.should be_nil
+          expect(@keychain_2.send(subject).where(search_arguments).first).to be_nil
         end
       end
     end

data/spec/spec_helper.rb

@@ -7,5 +7,10 @@ require 'keychain'
 require 'tmpdir'
 
 RSpec.configure do |config|
-  
+  config.mock_with :rspec do |c|
+    c.syntax = [ :expect]
+  end
+  config.expect_with :rspec do |c|
+    c.syntax = [ :expect]
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-keychain
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - Frederick Cheung
@@ -14,84 +14,84 @@ dependencies:
   name: ffi
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: corefoundation
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.1.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 0.1.3
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.10'
+        version: 3.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.10'
+        version: 3.1.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: yard
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: redcarpet
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 description: 'Ruby wrapper for OS X''s keychain '
@@ -100,19 +100,26 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE
+- README.markdown
+- lib/keychain.rb
+- lib/keychain/certificate.rb
 - lib/keychain/error.rb
+- lib/keychain/identity.rb
 - lib/keychain/item.rb
+- lib/keychain/key.rb
 - lib/keychain/keychain.rb
 - lib/keychain/protocols.rb
 - lib/keychain/scope.rb
 - lib/keychain/sec.rb
 - lib/keychain/version.rb
-- lib/keychain.rb
+- spec/certificate_spec.rb
+- spec/identity_spec.rb
+- spec/key_spec.rb
 - spec/keychain_item_spec.rb
 - spec/keychain_spec.rb
+- spec/spec.keychain
 - spec/spec_helper.rb
-- README.markdown
-- LICENSE
 homepage: http://github.com/fcheung/keychain
 licenses:
 - MIT
@@ -123,19 +130,18 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: 1.9.2
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.1.9
+rubygems_version: 2.4.5
 signing_key: 
 specification_version: 4
 summary: Ruby wrapper for  OS X's keychain
 test_files: []
-has_rdoc: