security 0.1.5 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f878a3070c6bc072f8bf7e0dfe17a8db85dec7b32685353498a642ea76c95176
-  data.tar.gz: '02093024c12b425b231eadbe56963433929e1844870dedeab1fda5f31b1c4a2b'
+  metadata.gz: c157bfbd48ec870177f4a269569efc87edad32606bc9a7332b4d26644a13edf9
+  data.tar.gz: 275fbb21545cde55939d4512cec08d3c52bcff6a96d5300cb746941813685bed
 SHA512:
-  metadata.gz: 7afe1f89bd8fda3701c8f31bb80b669107debea3ed191250a19d091fca665bc7b4572311f42b99a744b9a9c3a86657ca1d813420016fe07059bc4643a163c3de
-  data.tar.gz: eacec975d67c63faef11e7b20d4bd2c361d2daa5607ff7852fb2410bb0e71ba8e0926d75d2b158f733f423290648ca33ca91f522022ef987de64e41b2e16eea5
+  metadata.gz: 0f8a12a0decc2ab2e277816af45860be94894bf2b01dc307e5f4d3b88251d8a6676dbf5c0469af862c19a73679a8d444eb1b8502345756ac3595c35d7e38e9fb
+  data.tar.gz: e2b77b3d17ec02afb5c99d1a69d638633ab83026777fbb7c883fe4c8ae4b6896f269f38df28208508e15af937ea549eb7a9f95ecd82a32472956b3334605b13c

data/Gemfile

@@ -2,4 +2,10 @@
 
 source 'https://rubygems.org'
 
+gem 'rake', '~> 13.4'
+gem 'rspec', '~> 3.13'
+gem 'rubocop', '~> 1.90'
+# simplecov 1.x requires Ruby >= 3.2; hold at 0.x while Ruby 3.1 is supported
+gem 'simplecov', '~> 0.22'
+
 gemspec

data/Gemfile.lock

@@ -1,58 +1,74 @@
 PATH
   remote: .
   specs:
-    security (0.1.5)
+    security (0.3.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    ast (2.4.2)
-    diff-lcs (1.4.4)
-    parallel (1.20.1)
-    parser (3.0.0.0)
+    ast (2.4.3)
+    diff-lcs (1.6.2)
+    docile (1.4.1)
+    json (3.0.2)
+    language_server-protocol (3.17.0.6)
+    lint_roller (1.1.0)
+    parallel (2.2.0)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
-    rainbow (3.0.0)
-    rake (12.3.3)
-    regexp_parser (2.1.1)
-    rexml (3.2.4)
-    rspec (3.10.0)
-      rspec-core (~> 3.10.0)
-      rspec-expectations (~> 3.10.0)
-      rspec-mocks (~> 3.10.0)
-    rspec-core (3.10.1)
-      rspec-support (~> 3.10.0)
-    rspec-expectations (3.10.1)
+      racc
+    prism (1.9.0)
+    racc (1.8.1)
+    rainbow (3.1.1)
+    rake (13.4.2)
+    regexp_parser (2.12.0)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-github (2.3.1)
-      rspec-core (~> 3.0)
-    rspec-mocks (3.10.2)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.10.0)
-    rspec-support (3.10.2)
-    rubocop (1.12.0)
-      parallel (~> 1.10)
-      parser (>= 3.0.0.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.7)
+    rubocop (1.91.0)
+      json (>= 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
+      parallel (>= 1.10)
+      parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8, < 3.0)
-      rexml
-      rubocop-ast (>= 1.2.0, < 2.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.4.1)
-      parser (>= 2.7.1.5)
-    ruby-progressbar (1.11.0)
-    unicode-display_width (2.0.0)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.50.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.7)
+    ruby-progressbar (1.13.0)
+    simplecov (0.22.0)
+      docile (~> 1.1)
+      simplecov-html (~> 0.11)
+      simplecov_json_formatter (~> 0.1)
+    simplecov-html (0.13.2)
+    simplecov_json_formatter (0.1.4)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.2.0)
 
 PLATFORMS
-  x86_64-darwin-19
+  ruby
+  x86_64-linux
 
 DEPENDENCIES
-  rake (~> 12.3, >= 12.3.3)
-  rspec
-  rspec-github
-  rubocop
+  rake (~> 13.4)
+  rspec (~> 3.13)
+  rubocop (~> 1.90)
   security!
+  simplecov (~> 0.22)
 
 BUNDLED WITH
-   2.2.8
+   2.6.9

data/README.md

@@ -1,6 +1,6 @@
 # Security
 
-[![Build Status][build status badge]][build status]
+[![CI](https://github.com/fastlane-community/security/actions/workflows/ci.yml/badge.svg)](https://github.com/fastlane-community/security/actions/workflows/ci.yml)
 [![Gem](https://img.shields.io/gem/v/security.svg?style=flat)](https://rubygems.org/gems/security)
 [![License](https://img.shields.io/badge/license-MIT-green.svg?style=flat)](https://github.com/fastlane-community/security/blob/main/LICENSE.md)
 
@@ -14,14 +14,54 @@
 ```ruby
 require 'security'
 
-Security::Keychain::default_keychain.filename #=> "/Users/jappleseed/Library/Keychains/login.keychain"
+Security::Keychain.default_keychain.filename #=> "/Users/jappleseed/Library/Keychains/login.keychain-db"
 
-Security::InternetPassword.find(server: "itunesconnect.apple.com").password #=> "p4ssw0rd"
+item = Security::InternetPassword.find(server: "itunesconnect.apple.com")
+item&.password #=> "p4ssw0rd"
 ```
 
-## License
+## Keychains
+
+`find`, `add` and `delete` all take an optional `keychain:`, naming the keychain
+to act on. It accepts a `Security::Keychain` or a path. Without one, `security`
+adds to the default keychain and searches the default search list.
+
+```ruby
+keychain = Security::Keychain.new("/path/to/build.keychain-db")
+
+Security::InternetPassword.add("example.com", "jappleseed", "p4ssw0rd", keychain: keychain)
+Security::InternetPassword.find(server: "example.com", keychain: keychain)
+Security::InternetPassword.delete(server: "example.com", keychain: keychain)
+```
+
+## Errors
+
+The `security` command line tool reports failures through its exit status, and
+this library distinguishes the two cases a caller needs to tell apart:
 
-MIT
+- **Nothing matched.** `find` returns `nil`. The keychain answered, and it holds
+  no such item.
+- **The question could not be answered.** `find` raises `Security::Error`,
+  carrying the tool's exit `status` and its `output`. A locked keychain, a
+  keychain this process is not allowed to read, or a malformed request all
+  land here.
+
+```ruby
+begin
+  item = Security::InternetPassword.find(server: "itunesconnect.apple.com")
+rescue Security::Error => e
+  warn "could not read the keychain: #{e.message}"
+  item = nil
+end
+```
+
+`Keychain.list`, `Keychain.default_keychain` and `Keychain.login_keychain`
+raise `Security::Error` on failure in the same way.
+
+The methods that change the keychain — `add`, `delete`, and the `Keychain`
+instance methods — return `true` or `false` and print what the tool reported,
+the way `Kernel#system` does.
+
+## License
 
-[build status]: https://github.com/mattt/Security/actions?query=workflow%3ACI
-[build status badge]: https://github.com/mattt/Security/workflows/CI/badge.svg
+[MIT](https://github.com/fastlane-community/security/blob/main/LICENSE.md)

data/UPGRADE.md

@@ -0,0 +1,7 @@
+# Upgrade Guide
+
+## Upgrading from 0.2 to 0.3
+
+In previous versions, `find` attempted to detect failures by searching for a `security: ` prefix in the output. This approach was unreliable: certain errors (like ACL issues) produced no output, while others (like malformed requests) returned a usage banner. These cases would incorrectly result in a `Password` object with `nil` attributes, making it impossible for callers to distinguish a failed request from a successful one. Additionally, failures that *did* have the prefix returned `nil`, which was indistinguishable from a missing item.
+
+Starting with version 0.3, both cases now raise a `Security::Error`. If your code relies on `nil` to handle missing keychain items, you should now rescue `Security::Error` to prevent a locked or misconfigured keychain from being treated as empty.

data/lib/security/command.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require 'English'
+require 'open3'
+
+module Security
+  # :nodoc:
+  module Command
+    # TODO: replace with Data.define once Ruby 3.1 support is dropped.
+    # :nodoc:
+    Result = Struct.new(:stdout, :stderr, :status) do
+      def success?
+        !status.nil? && status.success?
+      end
+
+      def exitstatus
+        status&.exitstatus
+      end
+
+      # `security` splits what it has to say across both streams: find-*-password
+      # prints the attributes on stdout and the password on stderr.
+      def output
+        stdout + stderr
+      end
+    end
+
+    module_function
+
+    # Runs a `security` subcommand and captures what it produced. A missing
+    # `security` is a failed result rather than an exception: the tool is only
+    # present on macOS, and callers elsewhere should see the same failure they
+    # would get from a keychain that could not answer.
+    def run(command)
+      Result.new(*Open3.capture3(command))
+    rescue Errno::ENOENT => e
+      # Nothing ran, but the child Ruby forked exited 127 before exec, which is
+      # what a shell reports for a missing command, and what this library
+      # produced while it still went through one.
+      Result.new('', "#{e.message}\n", $CHILD_STATUS)
+    end
+
+    # Runs a `security` subcommand and lets the caller see what it said. The
+    # tool reports on stderr whether or not it succeeded: show-keychain-info
+    # prints its result there on exit 0.
+    def relay(command)
+      result = run(command)
+      warn result.stderr.chomp unless result.stderr.empty?
+
+      result
+    end
+  end
+end

data/lib/security/error.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Security
+  # :nodoc:
+  class Error < StandardError
+    attr_reader :status, :output
+
+    def initialize(status, output)
+      @status = status
+      @output = output
+
+      details = output.strip
+      super(details.empty? ? "`security` exited with status #{status}" : "#{details} (status #{status})")
+    end
+  end
+end

data/lib/security/keychain.rb

@@ -14,19 +14,19 @@ module Security
     end
 
     def info
-      system %(security show-keychain-info #{@filename.shellescape})
+      Command.relay(%(security show-keychain-info #{@filename.shellescape})).success?
     end
 
     def lock
-      system %(security lock-keychain #{@filename.shellescape})
+      Command.relay(%(security lock-keychain #{@filename.shellescape})).success?
     end
 
     def unlock(password)
-      system %(security unlock-keychain -p #{password.shellescape} #{@filename.shellescape})
+      Command.relay(%(security unlock-keychain -p #{password.shellescape} #{@filename.shellescape})).success?
     end
 
     def delete
-      system %(security delete-keychain #{@filename.shellescape})
+      Command.relay(%(security delete-keychain #{@filename.shellescape})).success?
     end
 
     class << self
@@ -35,31 +35,38 @@ module Security
       end
 
       def list(domain = :user)
-        raise ArgumentError "Invalid domain #{domain}, expected one of: #{DOMAINS}" unless DOMAINS.include?(domain)
+        raise ArgumentError, "Invalid domain #{domain}, expected one of: #{DOMAINS}" unless DOMAINS.include?(domain)
 
-        keychains_from_output(`security list-keychains -d #{domain}`)
+        keychains_from_command("security list-keychains -d #{domain}")
       end
 
       def lock
-        system %(security lock-keychain -a)
+        Command.relay(%(security lock-keychain -a)).success?
       end
 
       def unlock(password)
-        system %(security unlock-keychain -p #{password.shellescape})
+        Command.relay(%(security unlock-keychain -p #{password.shellescape})).success?
       end
 
       def default_keychain
-        keychains_from_output(`security default-keychain`).first
+        keychains_from_command('security default-keychain').first
       end
 
       def login_keychain
-        keychains_from_output(`security login-keychain`).first
+        keychains_from_command('security login-keychain').first
       end
 
       private
 
+      def keychains_from_command(command)
+        result = Command.run(command)
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+        keychains_from_output(result.stdout)
+      end
+
       def keychains_from_output(output)
-        output.split(/\n/).collect { |line| new(line.strip.gsub(/^"|"$/, '')) }
+        output.split("\n").collect { |line| new(line.strip.gsub(/^"|"$/, '')) }
       end
     end
   end

data/lib/security/password.rb

@@ -5,6 +5,10 @@ require 'shellwords'
 module Security
   # :nodoc:
   class Password
+    # `security` reports a missing item with this exit status. Every other
+    # non-zero status is a failure the caller needs to know about.
+    ITEM_NOT_FOUND = 44
+
     attr_reader :keychain, :attributes, :password
 
     private_class_method :new
@@ -18,13 +22,19 @@ module Security
     class << self
       private
 
-      def password_from_output(output)
-        return nil if output.match?(/^security: /)
+      def password_from_command(command)
+        result = Command.run(command)
+        return nil if result.exitstatus == ITEM_NOT_FOUND
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
 
+        password_from_output(result.output)
+      end
+
+      def password_from_output(output)
         keychain = nil
         attributes = {}
         password = nil
-        output.split(/\n/).each do |line|
+        output.split("\n").each do |line|
           case line
           when /^keychain: "(.+)"/
             keychain = Regexp.last_match(1)
@@ -44,6 +54,7 @@ module Security
 
       def flags_for_options(options = {})
         flags = options.dup
+        keychain = flags.delete(:keychain)
         flags[:a] ||= flags.delete(:account)
         flags[:c] ||= flags.delete(:creator)
         flags[:C] ||= flags.delete(:type)
@@ -51,7 +62,18 @@ module Security
         flags[:G] ||= flags.delete(:value)
         flags[:j] ||= flags.delete(:comment)
 
-        flags.delete_if { |_k, v| v.nil? }.collect { |k, v| "-#{k} #{v.shellescape}".strip }.join(' ')
+        arguments = flags.compact.collect { |k, v| "-#{k} #{v.shellescape}".strip }
+        arguments << filename_for_keychain(keychain) if keychain
+
+        arguments.join(' ')
+      end
+
+      # `security` takes the keychain to act on as a trailing argument. Without
+      # one it uses the default keychain, or the default search list.
+      def filename_for_keychain(keychain)
+        filename = keychain.is_a?(Keychain) ? keychain.filename : keychain
+
+        filename.shellescape
       end
 
       def decode_hex_blob(string)
@@ -68,22 +90,22 @@ module Security
         options[:s] = service
         options[:w] = password
 
-        system "security add-generic-password #{flags_for_options(options)}"
+        Command.relay("security add-generic-password #{flags_for_options(options)}").success?
       end
 
       def find(options)
-        password_from_output(`security 2>&1 find-generic-password -g #{flags_for_options(options)}`)
+        password_from_command("security find-generic-password -g #{flags_for_options(options)}")
       end
 
       def delete(options)
-        system "security delete-generic-password #{flags_for_options(options)}"
+        Command.run("security delete-generic-password #{flags_for_options(options)}").success?
       end
 
       private
 
       def flags_for_options(options = {})
         options[:s] ||= options.delete(:service)
-        super(options)
+        super
       end
     end
   end
@@ -95,16 +117,15 @@ module Security
         options[:a] = account
         options[:s] = server
         options[:w] = password
-
-        system "security add-internet-password #{flags_for_options(options)}"
+        Command.relay("security add-internet-password #{flags_for_options(options)}").success?
       end
 
       def find(options)
-        password_from_output(`security 2>&1 find-internet-password -g #{flags_for_options(options)}`)
+        password_from_command("security find-internet-password -g #{flags_for_options(options)}")
       end
 
       def delete(options)
-        system "security delete-internet-password #{flags_for_options(options)}"
+        Command.run("security delete-internet-password #{flags_for_options(options)}").success?
       end
 
       private
@@ -114,7 +135,7 @@ module Security
         options[:p] ||= options.delete(:path)
         options[:P] ||= options.delete(:port)
         options[:r] ||= options.delete(:protocol)
-        super(options)
+        super
       end
     end
   end

data/lib/security/version.rb

@@ -2,5 +2,5 @@
 
 # :nodoc:
 module Security
-  VERSION = '0.1.5'
+  VERSION = '0.3.0'
 end

data/lib/security.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require 'security/version'
+require 'security/error'
+require 'security/command'
 require 'security/keychain'
 require 'security/certificate'
 require 'security/password'

data/security.gemspec

@@ -1,11 +1,10 @@
 # frozen_string_literal: true
 
-$LOAD_PATH.push File.expand_path('lib', __dir__)
-require 'security'
+require_relative 'lib/security/version'
 
 Gem::Specification.new do |s|
   s.name        = 'security'
-  s.authors     = ['Josh Holtz', 'Mattt']
+  s.authors     = ['Josh Holtz', 'Mattt', 'iBotPeaches']
   s.email       = 'me@joshholtz.com'
   s.homepage    = 'https://github.com/fastlane-community/security'
   s.version     = Security::VERSION
@@ -13,14 +12,10 @@ Gem::Specification.new do |s|
   s.license     = 'MIT'
   s.summary     = 'Interact with the macOS Keychain'
 
-  s.files         = Dir['./**/*'].reject { |file| file =~ %r{\./(bin|log|pkg|script|spec|test|vendor)} }
-  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  s.files         = Dir['./**/*'].grep_v(%r{\./(bin|log|pkg|script|spec|test|vendor)})
   s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
   s.require_paths = ['lib']
-  s.required_ruby_version = '>= 2.4.0'
+  s.required_ruby_version = '>= 3.1.0'
 
-  s.add_development_dependency 'rake', '~> 12.3', '>= 12.3.3'
-  s.add_development_dependency 'rspec'
-  s.add_development_dependency 'rspec-github'
-  s.add_development_dependency 'rubocop'
+  s.metadata['rubygems_mfa_required'] = 'true'
 end

metadata

@@ -1,79 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: security
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.3.0
 platform: ruby
 authors:
 - Josh Holtz
 - Mattt
-autorequire:
+- iBotPeaches
 bindir: bin
 cert_chain: []
-date: 2021-03-25 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '12.3'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 12.3.3
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '12.3'
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 12.3.3
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rspec-github
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-description:
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
 email: me@joshholtz.com
 executables: []
 extensions: []
@@ -84,21 +21,20 @@ files:
 - "./LICENSE.md"
 - "./README.md"
 - "./Rakefile"
+- "./UPGRADE.md"
 - "./lib/security.rb"
 - "./lib/security/certificate.rb"
+- "./lib/security/command.rb"
+- "./lib/security/error.rb"
 - "./lib/security/keychain.rb"
 - "./lib/security/password.rb"
 - "./lib/security/version.rb"
 - "./security.gemspec"
-- spec/certificate_spec.rb
-- spec/keychain_spec.rb
-- spec/password_spec.rb
-- spec/spec_helper.rb
 homepage: https://github.com/fastlane-community/security
 licenses:
 - MIT
-metadata: {}
-post_install_message:
+metadata:
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -106,19 +42,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.4.0
+      version: 3.1.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Interact with the macOS Keychain
-test_files:
-- spec/certificate_spec.rb
-- spec/keychain_spec.rb
-- spec/password_spec.rb
-- spec/spec_helper.rb
+test_files: []

data/spec/certificate_spec.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-describe Certificate do
-  describe '#find' do
-    it 'should raise NotImplementedError' do
-      expect { Certificate.find }.to raise_error(NotImplementedError)
-    end
-  end
-
-  describe '#initialize' do
-    it 'should raise NoMethodError' do
-      expect { Certificate.new }.to raise_error(NoMethodError, /private method/)
-    end
-  end
-end

data/spec/keychain_spec.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-require 'tempfile'
-
-describe Keychain do
-  describe '#login_keychain' do
-    subject { Keychain.login_keychain }
-
-    it 'should be located in the user home directory' do
-      expect(subject.filename).to be == File.expand_path('~/Library/Keychains/login.keychain-db')
-    end
-  end
-
-  describe '#create' do
-    let(:password) { 'p4ssw0rd!' }
-
-    it 'should raise NotImplementedError' do
-      Tempfile.open('example.keychain-db') do |tmp|
-        expect { Keychain.create(tmp.path, password) }.to raise_error(NotImplementedError)
-      end
-    end
-  end
-
-  describe '#list' do
-    describe 'when passing no arguments' do
-      it 'should list keychains in user domain' do
-        expect(Keychain.list).to satisfy { |keychains|
-          keychains.map(&:filename) == Keychain.list(:user).map(&:filename)
-        }
-      end
-    end
-
-    describe 'when passing a valid domain' do
-      it 'should not raise an error' do
-        expect { Keychain.list(:user) }.not_to raise_error
-        expect { Keychain.list(:system) }.not_to raise_error
-        expect { Keychain.list(:common) }.not_to raise_error
-        expect { Keychain.list(:dynamic) }.not_to raise_error
-      end
-    end
-
-    describe 'when passing an invalid domain' do
-      it 'should raise an error' do
-        expect { Keychain.list(:invalid) }.to raise_error(NoMethodError) # FIXME
-      end
-    end
-  end
-end

data/spec/password_spec.rb

@@ -1,102 +0,0 @@
-# frozen_string_literal: true
-
-describe GenericPassword do
-  let(:keychain) { Keychain.login_keychain } # FIXME: we should create a temporary keychain for tests
-
-  describe '#add' do
-    let(:service) { 'com.example.service' }
-    let(:account) { 'jappleseed' }
-    let(:password) { 'p4ssw0rd!' }
-    let(:comment) { 'Some comment' }
-
-    around(:example) do |example|
-      GenericPassword.add(service, account, password, comment: comment)
-      example.run
-      GenericPassword.delete({ service: service, account: account })
-    end
-
-    it 'should be added to the keychain' do
-      entry = GenericPassword.find({ account: account })
-      expect(entry.keychain.filename).to be == keychain.filename
-      expect(entry.attributes).to include({
-                                            'acct' => account,
-                                            'svce' => service,
-                                            'icmt' => comment
-                                          })
-      expect(entry.password).to be == password
-    end
-  end
-end
-
-describe InternetPassword do
-  let(:keychain) { Keychain.login_keychain } # FIXME: we should create a temporary keychain for tests
-
-  describe '#add' do
-    let(:server) { 'example.com' }
-    let(:account) { 'jappleseed@example.com' }
-
-    describe 'ascii password' do
-      let(:password) { 'p4ssw0rd!' }
-      let(:comment) { 'Some comment' }
-
-      around(:example) do |example|
-        InternetPassword.add(server, account, password, comment: comment)
-        example.run
-        InternetPassword.delete({ server: server, account: account })
-      end
-
-      it 'should be added to the keychain' do
-        entry = InternetPassword.find({ account: account })
-        expect(entry.keychain.filename).to be == keychain.filename
-        expect(entry.attributes).to include({
-                                              'acct' => account,
-                                              'srvr' => server,
-                                              'icmt' => comment
-                                            })
-        expect(entry.password).to be == password
-      end
-    end
-
-    describe 'ascii password with backslash' do
-      let(:password) { 'p4ssw\0rd!' }
-
-      around(:example) do |example|
-        InternetPassword.add(server, account, password)
-        example.run
-        InternetPassword.delete({ server: server, account: account })
-      end
-
-      it 'should be added to the keychain' do
-        entry = InternetPassword.find({ account: account })
-        expect(entry.keychain.filename).to be == keychain.filename
-        expect(entry.attributes).to include({
-                                              'acct' => account,
-                                              'srvr' => server
-                                            })
-        expect(entry.password).to be == password
-      end
-    end
-
-    describe 'non-ascii password' do
-      let(:password) { '•••p4ssw0rd!••' }
-      let(:comment) { '•••Some comment•••' }
-
-      around(:example) do |example|
-        InternetPassword.add(server, account, password, comment: comment)
-        example.run
-        InternetPassword.delete({ server: server, account: account })
-      end
-
-      it 'should be added to the keychain' do
-        entry = InternetPassword.find({ account: account })
-        expect(entry.keychain.filename).to be == keychain.filename
-        expect(entry.attributes).to include({
-                                              'acct' => account,
-                                              'srvr' => server,
-                                              'icmt' => comment
-                                            })
-        expect(entry.password).to be == password
-      end
-    end
-  end
-end

data/spec/spec_helper.rb

@@ -1,106 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../lib/security'
-
-# rubocop:disable Style/MixinUsage
-include Security
-# rubocop:enable Style/MixinUsage
-
-# This file was generated by the `rspec --init` command. Conventionally, all
-# specs live under a `spec` directory, which RSpec adds to the `$LOAD_PATH`.
-# The generated `.rspec` file contains `--require spec_helper` which will cause
-# this file to always be loaded, without a need to explicitly require it in any
-# files.
-#
-# Given that it is always loaded, you are encouraged to keep this file as
-# light-weight as possible. Requiring heavyweight dependencies from this file
-# will add to the boot time of your test suite on EVERY test run, even for an
-# individual file that may not need all of that loaded. Instead, consider making
-# a separate helper file that requires the additional dependencies and performs
-# the additional setup, and require it from the spec files that actually need
-# it.
-#
-# See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
-RSpec.configure do |config|
-  # rspec-expectations config goes here. You can use an alternate
-  # assertion/expectation library such as wrong or the stdlib/minitest
-  # assertions if you prefer.
-  config.expect_with :rspec do |expectations|
-    # This option will default to `true` in RSpec 4. It makes the `description`
-    # and `failure_message` of custom matchers include text for helper methods
-    # defined using `chain`, e.g.:
-    #     be_bigger_than(2).and_smaller_than(4).description
-    #     # => "be bigger than 2 and smaller than 4"
-    # ...rather than:
-    #     # => "be bigger than 2"
-    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
-  end
-
-  # rspec-mocks config goes here. You can use an alternate test double
-  # library (such as bogus or mocha) by changing the `mock_with` option here.
-  config.mock_with :rspec do |mocks|
-    # Prevents you from mocking or stubbing a method that does not exist on
-    # a real object. This is generally recommended, and will default to
-    # `true` in RSpec 4.
-    mocks.verify_partial_doubles = true
-  end
-
-  # This option will default to `:apply_to_host_groups` in RSpec 4 (and will
-  # have no way to turn it off -- the option exists only for backwards
-  # compatibility in RSpec 3). It causes shared context metadata to be
-  # inherited by the metadata hash of host groups and examples, rather than
-  # triggering implicit auto-inclusion in groups with matching metadata.
-  config.shared_context_metadata_behavior = :apply_to_host_groups
-
-  # The settings below are suggested to provide a good initial experience
-  # with RSpec, but feel free to customize to your heart's content.
-  #   # This allows you to limit a spec run to individual examples or groups
-  #   # you care about by tagging them with `:focus` metadata. When nothing
-  #   # is tagged with `:focus`, all examples get run. RSpec also provides
-  #   # aliases for `it`, `describe`, and `context` that include `:focus`
-  #   # metadata: `fit`, `fdescribe` and `fcontext`, respectively.
-  #   config.filter_run_when_matching :focus
-  #
-  #   # Allows RSpec to persist some state between runs in order to support
-  #   # the `--only-failures` and `--next-failure` CLI options. We recommend
-  #   # you configure your source control system to ignore this file.
-  #   config.example_status_persistence_file_path = "spec/examples.txt"
-  #
-  #   # Limits the available syntax to the non-monkey patched syntax that is
-  #   # recommended. For more details, see:
-  #   #   - http://rspec.info/blog/2012/06/rspecs-new-expectation-syntax/
-  #   #   - http://www.teaisaweso.me/blog/2013/05/27/rspecs-new-message-expectation-syntax/
-  #   #   - http://rspec.info/blog/2014/05/notable-changes-in-rspec-3/#zero-monkey-patching-mode
-  #   config.disable_monkey_patching!
-  #
-  #   # This setting enables warnings. It's recommended, but in some cases may
-  #   # be too noisy due to issues in dependencies.
-  #   config.warnings = true
-  #
-  #   # Many RSpec users commonly either run the entire suite or an individual
-  #   # file, and it's useful to allow more verbose output when running an
-  #   # individual spec file.
-  #   if config.files_to_run.one?
-  #     # Use the documentation formatter for detailed output,
-  #     # unless a formatter has already been configured
-  #     # (e.g. via a command-line flag).
-  #     config.default_formatter = "doc"
-  #   end
-  #
-  #   # Print the 10 slowest examples and example groups at the
-  #   # end of the spec run, to help surface which specs are running
-  #   # particularly slow.
-  #   config.profile_examples = 10
-  #
-  #   # Run specs in random order to surface order dependencies. If you find an
-  #   # order dependency and want to debug it, you can fix the order by providing
-  #   # the seed, which is printed after each run.
-  #   #     --seed 1234
-  #   config.order = :random
-  #
-  #   # Seed global randomization in this process using the `--seed` CLI option.
-  #   # Setting this allows you to use `--seed` to deterministically reproduce
-  #   # test failures related to randomization by passing the same `--seed` value
-  #   # as the one that triggered the failure.
-  #   Kernel.srand config.seed
-end