security 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d010aca28c455caae65e0063ab5ee35336eace64fd8049012c66f77edc634f20
-  data.tar.gz: a46b316771d171579e241b7c875b99bdaaa0f0cc6e7f9312d1627767b90c3c9e
+  metadata.gz: 9c1d9c484b22dfdf437dbd6af09ccb5b1c197c94c1d396496cd93b35c93ae9fc
+  data.tar.gz: 72f35ca3c02f14e83e75aed6b10048bf85f78b4f95176302a34af671a3807567
 SHA512:
-  metadata.gz: 106ba3c86bc5254bd1d589d1de99ea992b4cb12731761ff79faeed1cbe48f495451520b6ebbf91c50f6fb41b838ecd01de11eec9ca08d97e39c853cc457844e5
-  data.tar.gz: 636bfaf6e7a5b88eb38112008d3a46ed13da71cd13e8e16bb9891a24b5fbd8fca85dd58017f505d1c0df45264a1be3773f9bf15e973b688f0069135463407cf6
+  metadata.gz: 40675d74911733f6316286730b6fe68dd4e28905f3dc00f7d260645de0707b905c0be386e42062601d8226b1e1240179c6607660dc349c92d08d982c83007f7a
+  data.tar.gz: 98ef0545f2155fc4c5e55d4969c62b2ed1ddb63634b633f7fec30cadb1726159be3cd7823a0ee0fa11cdc0b75210c7deb2df78bd24fa9a3a4d2b8f95ac1fcbbd

data/Gemfile

@@ -3,8 +3,8 @@
 source 'https://rubygems.org'
 
 gem 'rake', '~> 13.4'
-gem 'rspec'
-gem 'rubocop'
-gem 'simplecov'
+gem 'rspec', '~> 3.13'
+gem 'rubocop', '~> 1.92'
+gem 'simplecov', '~> 1.2'
 
 gemspec

data/Gemfile.lock

@@ -1,17 +1,17 @@
 PATH
   remote: .
   specs:
-    security (0.2.0)
+    security (0.4.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.3)
     diff-lcs (1.6.2)
-    json (2.21.2)
+    json (3.1.0)
     language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
-    parallel (2.1.0)
+    parallel (1.28.0)
     parser (3.3.12.0)
       ast (~> 2.4.1)
       racc
@@ -19,7 +19,7 @@ GEM
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.4.2)
-    regexp_parser (2.12.0)
+    regexp_parser (2.13.1)
     rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -33,14 +33,14 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.7)
-    rubocop (1.89.0)
-      json (~> 2.3)
+    rubocop (1.92.0)
+      json (>= 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
       parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 2.9.3, < 3.0)
+      regexp_parser (>= 2.11.3, < 3.0)
       rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
@@ -48,21 +48,20 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
-    simplecov (1.1.1)
-    unicode-display_width (3.2.0)
-      unicode-emoji (~> 4.1)
-    unicode-emoji (4.2.0)
+    simplecov (1.2.0)
+    unicode-display_width (3.3.0)
+      unicode-emoji (~> 4.3)
+    unicode-emoji (4.3.0)
 
 PLATFORMS
   ruby
-  x86_64-linux
 
 DEPENDENCIES
   rake (~> 13.4)
-  rspec
-  rubocop
+  rspec (~> 3.13)
+  rubocop (~> 1.92)
   security!
-  simplecov
+  simplecov (~> 1.2)
 
 BUNDLED WITH
-   2.6.9
+   2.7.2

data/README.md

@@ -1,6 +1,6 @@
 # Security
 
-[![Build Status][build status badge]][build status]
+[![CI](https://github.com/fastlane-community/security/actions/workflows/ci.yml/badge.svg)](https://github.com/fastlane-community/security/actions/workflows/ci.yml)
 [![Gem](https://img.shields.io/gem/v/security.svg?style=flat)](https://rubygems.org/gems/security)
 [![License](https://img.shields.io/badge/license-MIT-green.svg?style=flat)](https://github.com/fastlane-community/security/blob/main/LICENSE.md)
 
@@ -14,14 +14,81 @@
 ```ruby
 require 'security'
 
-Security::Keychain::default_keychain.filename #=> "/Users/jappleseed/Library/Keychains/login.keychain"
+Security::Keychain.default_keychain.filename #=> "/Users/jappleseed/Library/Keychains/login.keychain-db"
 
-Security::InternetPassword.find(server: "itunesconnect.apple.com").password #=> "p4ssw0rd"
+item = Security::InternetPassword.find(server: "itunesconnect.apple.com")
+item&.password #=> "p4ssw0rd"
 ```
 
-## License
+## Keychains
+
+`find`, `add` and `delete` all take an optional `keychain:`, naming the keychain
+to act on. It accepts a `Security::Keychain` or a path. Without one, `security`
+adds to the default keychain and searches the default search list.
+
+```ruby
+keychain = Security::Keychain.new("/path/to/build.keychain-db")
+
+Security::InternetPassword.add("example.com", "jappleseed", "p4ssw0rd", keychain: keychain)
+Security::InternetPassword.find(server: "example.com", keychain: keychain)
+Security::InternetPassword.delete(server: "example.com", keychain: keychain)
+```
+
+Keychains themselves:
 
-MIT
+```ruby
+keychain = Security::Keychain.create("/path/to/build.keychain-db", "p4ssw0rd")
+keychain.update_settings(timeout: 3600, lock_when_sleeping: true)
+keychain.set_key_partition_list("p4ssw0rd")
+
+Security::Keychain.set_search_list(Security::Keychain.list + [keychain])
+Security::Keychain.set_default_keychain(keychain)
+```
+
+## Certificates and identities
+
+```ruby
+Security::Certificate.import("/path/to/identity.p12", keychain: keychain, password: "p12 password")
+Security::Certificate.find(name: "Developer ID Installer", keychain: keychain).map(&:sha1)
+Security::Identity.find(keychain: keychain).map(&:name) #=> ["Apple Development: Jane Appleseed (TEAMID)"]
+```
+
+## Errors
+
+The `security` command line tool reports failures through its exit status, and
+this library distinguishes the two cases a caller needs to tell apart:
+
+- **Nothing matched.** `find` returns `nil`. The keychain answered, and it holds
+  no such item.
+- **The question could not be answered.** `find` raises `Security::Error`,
+  carrying the tool's exit `status` and its `output`. A locked keychain, a
+  keychain this process is not allowed to read, or a malformed request all
+  land here.
+
+```ruby
+begin
+  item = Security::InternetPassword.find(server: "itunesconnect.apple.com")
+rescue Security::Error => e
+  warn "could not read the keychain: #{e.message}"
+  item = nil
+end
+```
+
+`Keychain.list`, `Keychain.default_keychain`, `Keychain.login_keychain`,
+`Keychain.create`, `Certificate.find` and `Identity.find` raise `Security::Error`
+on failure in the same way. `Certificate.find` and `Identity.find` return an
+empty array when nothing matched.
+
+The methods that change the keychain — `add`, `delete` and the `Keychain`
+setters — return `true` or `false` and print what the tool reported, the way
+`Kernel#system` does. Two raise instead, because the caller needs to know why
+they failed:
+
+- `Certificate.import` raises `Security::DuplicateItemError` when the keychain
+  already holds the item, and `Security::Error` for any other failure.
+- `Keychain#set_key_partition_list` raises `Security::Error`, most often for a
+  wrong keychain password.
+
+## License
 
-[build status]: https://github.com/mattt/Security/actions?query=workflow%3ACI
-[build status badge]: https://github.com/mattt/Security/workflows/CI/badge.svg
+[MIT](https://github.com/fastlane-community/security/blob/main/LICENSE.md)

data/UPGRADE.md

@@ -0,0 +1,25 @@
+# Upgrade Guide
+
+## Upgrading from 0.3 to 0.4
+
+Ruby 3.2 is now the minimum.
+
+`Security::Command.run` and `Security::Command.relay` no longer go through a shell. They take the program and its arguments separately, so nothing needs escaping:
+
+```ruby
+# 0.3
+Security::Command.run("security show-keychain-info #{path.shellescape}")
+
+# 0.4
+Security::Command.run("security", "show-keychain-info", path)
+```
+
+A single string is now the name of the program to run, so a 0.3 command line fails as a missing command, with exit status 127.
+
+Passwords no longer appear in the arguments of the `security` process, where any local user could read them with `ps`: the commands that take one (adding a password, creating, unlocking or setting the partition list of a keychain, importing with a passphrase) are sent to `security -i` on stdin. A password or other argument containing a line break now raises `ArgumentError`, and so does a command longer than `security -i` reads (4096 bytes, 32 arguments).
+
+## Upgrading from 0.2 to 0.3
+
+In previous versions, `find` attempted to detect failures by searching for a `security: ` prefix in the output. This approach was unreliable: certain errors (like ACL issues) produced no output, while others (like malformed requests) returned a usage banner. These cases would incorrectly result in a `Password` object with `nil` attributes, making it impossible for callers to distinguish a failed request from a successful one. Additionally, failures that *did* have the prefix returned `nil`, which was indistinguishable from a missing item.
+
+Starting with version 0.3, both cases now raise a `Security::Error`. If your code relies on `nil` to handle missing keychain items, you should now rescue `Security::Error` to prevent a locked or misconfigured keychain from being treated as empty.

data/lib/security/certificate.rb

@@ -1,10 +1,40 @@
 # frozen_string_literal: true
 
+require 'openssl'
+
 module Security
   # :nodoc:
   class Certificate
+    # The tools allowed to use an imported item without asking the user. A
+    # keychain prompt in the middle of a build is a hang rather than a failure,
+    # which is why these are named rather than left to the default.
+    DEFAULT_TRUSTED_APPLICATIONS = [
+      '/usr/bin/codesign',
+      '/usr/bin/security',
+      '/usr/bin/productbuild',
+      '/usr/bin/productsign'
+    ].freeze
+
+    # What `security import` reports for an item the keychain already holds.
+    ALREADY_EXISTS = 'The specified item already exists in the keychain'
+
+    PEM = /-----BEGIN CERTIFICATE-----\n.*?-----END CERTIFICATE-----\n/m
+
+    attr_reader :sha1, :sha256, :pem
+
     private_class_method :new
 
+    def initialize(sha1:, sha256:, pem:)
+      @sha1 = sha1
+      @sha256 = sha256
+      @pem = pem
+    end
+
+    # The subject's common name, which is what the keychain shows as its name.
+    def name
+      OpenSSL::X509::Certificate.new(pem).subject.to_a.find { |key, _value, _type| key == 'CN' }&.at(1)
+    end
+
     def delete!
       raise NotImplementedError
     end
@@ -14,8 +44,46 @@ module Security
     end
 
     class << self
-      def find
-        raise NotImplementedError
+      # Every certificate whose name contains `name`. Finding none is not a
+      # failure: `security` prints nothing and exits 0.
+      def find(name:, keychain: nil)
+        command = ['security', 'find-certificate', '-a', '-c', name.to_s, '-Z', '-p']
+        command << filename_for(keychain) if keychain
+
+        result = Command.run(*command)
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+        certificates_from_output(result.stdout)
+      end
+
+      # Imports a certificate or identity file into `keychain`. `password` is
+      # the one protecting the file, not the keychain's. Raises
+      # DuplicateItemError when the keychain already holds it.
+      def import(path, keychain:, password: nil, format: nil,
+                 trusted_applications: DEFAULT_TRUSTED_APPLICATIONS)
+        command = ['security', 'import', path.to_s, '-k', filename_for(keychain)]
+        command += ['-P', password.to_s] if password
+        command += ['-f', format.to_s] if format
+        trusted_applications.each { |application| command += ['-T', application] }
+
+        result = password ? Command.run_interactive(*command.drop(1)) : Command.run(*command)
+        return true if result.success?
+
+        # Every failure exits 1, so only the message tells a duplicate apart.
+        error = result.stderr.include?(ALREADY_EXISTS) ? DuplicateItemError : Error
+        raise error.new(result.exitstatus, result.stderr)
+      end
+
+      private
+
+      def certificates_from_output(output)
+        output.scan(/^SHA-256 hash: (\h+)\nSHA-1 hash: (\h+)\n(#{PEM})/m).map do |sha256, sha1, pem|
+          new(sha1: sha1, sha256: sha256, pem: pem)
+        end
+      end
+
+      def filename_for(keychain)
+        keychain.respond_to?(:filename) ? keychain.filename : keychain.to_s
       end
     end
   end

data/lib/security/command.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require 'English'
+require 'open3'
+
+module Security
+  # :nodoc:
+  module Command
+    # TODO: replace with Data.define once Ruby 3.1 support is dropped.
+    # :nodoc:
+    Result = Struct.new(:stdout, :stderr, :status) do
+      def success?
+        !status.nil? && status.success?
+      end
+
+      def exitstatus
+        status&.exitstatus
+      end
+
+      # `security` splits what it has to say across both streams: find-*-password
+      # prints the attributes on stdout and the password on stderr.
+      def output
+        stdout + stderr
+      end
+    end
+
+    # What `security -i` reads at most: bytes per line, and arguments per command.
+    INTERACTIVE_LINE_LENGTH = 4096
+    INTERACTIVE_ARGUMENTS = 32
+
+    module_function
+
+    # Runs a `security` subcommand and captures what it produced. A missing
+    # `security` is a failed result rather than an exception: the tool is only
+    # present on macOS, and callers elsewhere should see the same failure they
+    # would get from a keychain that could not answer.
+    #
+    # Never through a shell, so a path containing a space or a quote needs no
+    # escaping:
+    #
+    #   run("security", "show-keychain-info", path)
+    def run(program, *, stdin: nil)
+      # [program, program] rather than program: Ruby hands a lone string with
+      # shell metacharacters to a shell.
+      # stdin_data only when there is some, so a command without a password is
+      # run, and can be stubbed, exactly as before.
+      Result.new(*Open3.capture3([program, program], *, **(stdin ? { stdin_data: stdin } : {})))
+    rescue Errno::ENOENT => e
+      # Nothing ran, but the child Ruby forked exited 127 before exec, which is
+      # what a shell reports for a missing command, and what this library
+      # produced while it still went through one.
+      Result.new('', "#{e.message}\n", $CHILD_STATUS)
+    end
+
+    # Runs a `security` subcommand and lets the caller see what it said. The
+    # tool reports on stderr whether or not it succeeded: show-keychain-info
+    # prints its result there on exit 0.
+    def relay(*command)
+      relayed(run(*command))
+    end
+
+    # Runs a `security` subcommand that takes a password: through `security -i`,
+    # which reads the command from stdin, so the password never shows in the
+    # arguments, which any local user can read with `ps`. Without -p (or -P),
+    # the tool would instead read it from the terminal when there is one, or
+    # import would ask through a dialog.
+    #
+    #   run_interactive("unlock-keychain", "-p", password, path)
+    def run_interactive(subcommand, *)
+      result = run('security', '-i', stdin: interactive_input(subcommand, *))
+      # -i adds a line naming the command and its status after any error.
+      result.stderr = result.stderr.sub(/^#{Regexp.escape(subcommand)}: returned -?\d+\n\z/, '')
+      result
+    end
+
+    def relay_interactive(*command)
+      relayed(run_interactive(*command))
+    end
+
+    # One command line for `security -i`: every argument double quoted, with
+    # backslashes and double quotes escaped. A line break would end the command,
+    # and a longer line or more arguments than the tool reads would be cut.
+    def interactive_input(*command)
+      if command.size > INTERACTIVE_ARGUMENTS
+        raise ArgumentError, "security -i takes at most #{INTERACTIVE_ARGUMENTS} arguments"
+      end
+
+      line = command.map do |argument|
+        argument = argument.to_s
+        raise ArgumentError, 'An argument for security -i cannot contain a line break' if argument.match?(/[\r\n]/)
+
+        %("#{argument.gsub(/[\\"]/) { |character| "\\#{character}" }}")
+      end.join(' ')
+      if line.bytesize >= INTERACTIVE_LINE_LENGTH - 1
+        raise ArgumentError, "A command for security -i must be shorter than #{INTERACTIVE_LINE_LENGTH} bytes"
+      end
+
+      "#{line}\n"
+    end
+
+    def relayed(result)
+      warn result.stderr.chomp unless result.stderr.empty?
+
+      result
+    end
+  end
+end

data/lib/security/error.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Security
+  # :nodoc:
+  class Error < StandardError
+    attr_reader :status, :output
+
+    def initialize(status, output)
+      @status = status
+      @output = output
+
+      details = output.strip
+      super(details.empty? ? "`security` exited with status #{status}" : "#{details} (status #{status})")
+    end
+  end
+
+  # Raised when the keychain already holds the item being added.
+  class DuplicateItemError < Error; end
+end

data/lib/security/identity.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Security
+  # :nodoc:
+  class Identity
+    attr_reader :sha1, :name, :status
+
+    private_class_method :new
+
+    # `status` is what `security` prints after the name for an identity it
+    # considers invalid, such as CSSMERR_TP_CERT_REVOKED, or nil.
+    def initialize(sha1, name, status = nil)
+      @sha1 = sha1
+      @name = name
+      @status = status
+    end
+
+    class << self
+      # The identities `security` can see, newest tool output shaped like:
+      #
+      #   1) A1B2... "Apple Development: someone (TEAM)"
+      #      1 valid identities found
+      #
+      # `valid_only` drops the ones the tool marks unusable. `keychain` limits
+      # the search to one; without it `security` searches the user's default,
+      # which is what `find-identity` does and why callers that do not name a
+      # keychain get whatever happens to be in the login one.
+      def find(policy: 'codesigning', valid_only: true, keychain: nil)
+        command = %w[security find-identity]
+        command << '-v' if valid_only
+        command += ['-p', policy.to_s] if policy
+        command << filename_for(keychain) if keychain
+
+        result = Command.run(*command)
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+        identities_from_output(result.stdout)
+      end
+
+      private
+
+      # Finding none is not a failure: `security` prints "0 valid identities
+      # found" and exits 0.
+      def identities_from_output(output)
+        output.scan(/^\s*\d+\)\s+(\h+)\s+"(.*)"(?:\s+\(([^()]*)\))?\s*$/).map do |sha1, name, status|
+          new(sha1, name, status)
+        end
+      end
+
+      def filename_for(keychain)
+        keychain.respond_to?(:filename) ? keychain.filename : keychain.to_s
+      end
+    end
+  end
+end

data/lib/security/keychain.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
-require 'shellwords'
-
 module Security
   # :nodoc:
   class Keychain
     DOMAINS = %i[user system common dynamic].freeze
 
+    # The partition IDs that let Apple's signing tools use an imported key
+    # without a keychain prompt.
+    DEFAULT_PARTITION_IDS = %w[apple-tool: apple: codesign:].freeze
+
     attr_reader :filename
 
     def initialize(filename)
@@ -14,50 +16,102 @@ module Security
     end
 
     def info
-      system %(security show-keychain-info #{@filename.shellescape})
+      Command.relay('security', 'show-keychain-info', @filename).success?
     end
 
     def lock
-      system %(security lock-keychain #{@filename.shellescape})
+      Command.relay('security', 'lock-keychain', @filename).success?
     end
 
     def unlock(password)
-      system %(security unlock-keychain -p #{password.shellescape} #{@filename.shellescape})
+      Command.relay_interactive('unlock-keychain', '-p', password.to_s, @filename).success?
     end
 
     def delete
-      system %(security delete-keychain #{@filename.shellescape})
+      Command.relay('security', 'delete-keychain', @filename).success?
+    end
+
+    # With no options the keychain never locks on its own.
+    def update_settings(timeout: nil, lock_when_sleeping: false, lock_after_timeout: false)
+      command = %w[security set-keychain-settings]
+      command += ['-t', timeout.to_s] if timeout
+      command << '-l' if lock_when_sleeping
+      command << '-u' if lock_after_timeout
+
+      Command.relay(*command, @filename).success?
+    end
+
+    # Raises rather than returning false: a wrong keychain password is the usual
+    # failure, and the caller needs the output to tell it from the others.
+    def set_key_partition_list(password, partition_ids: DEFAULT_PARTITION_IDS)
+      result = Command.run_interactive('set-key-partition-list', '-S', partition_ids.join(','), '-s',
+                                       '-k', password.to_s, @filename)
+      raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+      true
     end
 
     class << self
+      # Raises on failure, like the other class methods that answer with a keychain.
       def create(filename, password)
-        raise NotImplementedError
+        result = Command.run_interactive('create-keychain', '-p', password.to_s, filename.to_s)
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+        new(filename.to_s)
       end
 
       def list(domain = :user)
-        raise ArgumentError "Invalid domain #{domain}, expected one of: #{DOMAINS}" unless DOMAINS.include?(domain)
+        keychains_from_command('security', 'list-keychains', '-d', domain_name(domain))
+      end
 
-        keychains_from_output(`security list-keychains -d #{domain}`)
+      def set_search_list(keychains, domain: :user)
+        Command.relay('security', 'list-keychains', '-d', domain_name(domain), '-s',
+                      *keychains.map { |keychain| filename_for(keychain) }).success?
       end
 
       def lock
-        system %(security lock-keychain -a)
+        Command.relay('security', 'lock-keychain', '-a').success?
       end
 
       def unlock(password)
-        system %(security unlock-keychain -p #{password.shellescape})
+        Command.relay_interactive('unlock-keychain', '-p', password.to_s).success?
       end
 
       def default_keychain
-        keychains_from_output(`security default-keychain`).first
+        keychains_from_command('security', 'default-keychain').first
+      end
+
+      def set_default_keychain(keychain, domain: :user)
+        Command.relay('security', 'default-keychain', '-d', domain_name(domain), '-s', filename_for(keychain)).success?
       end
 
       def login_keychain
-        keychains_from_output(`security login-keychain`).first
+        keychains_from_command('security', 'login-keychain').first
+      end
+
+      def supports_key_partition_list?
+        Command.run('security', '-h').stdout.include?('set-key-partition-list')
       end
 
       private
 
+      def domain_name(domain)
+        raise ArgumentError, "Invalid domain #{domain}, expected one of: #{DOMAINS}" unless DOMAINS.include?(domain)
+
+        domain.to_s
+      end
+
+      def filename_for(keychain)
+        keychain.respond_to?(:filename) ? keychain.filename : keychain.to_s
+      end
+
+      def keychains_from_command(*command)
+        result = Command.run(*command)
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+        keychains_from_output(result.stdout)
+      end
+
       def keychains_from_output(output)
         output.split("\n").collect { |line| new(line.strip.gsub(/^"|"$/, '')) }
       end

data/lib/security/password.rb

@@ -1,10 +1,12 @@
 # frozen_string_literal: true
 
-require 'shellwords'
-
 module Security
   # :nodoc:
   class Password
+    # `security` reports a missing item with this exit status. Every other
+    # non-zero status is a failure the caller needs to know about.
+    ITEM_NOT_FOUND = 44
+
     attr_reader :keychain, :attributes, :password
 
     private_class_method :new
@@ -18,9 +20,15 @@ module Security
     class << self
       private
 
-      def password_from_output(output)
-        return nil if output.match?(/^security: /)
+      def password_from_command(*command)
+        result = Command.run(*command)
+        return nil if result.exitstatus == ITEM_NOT_FOUND
+        raise Error.new(result.exitstatus, result.stderr) unless result.success?
+
+        password_from_output(result.output)
+      end
 
+      def password_from_output(output)
         keychain = nil
         attributes = {}
         password = nil
@@ -44,6 +52,7 @@ module Security
 
       def flags_for_options(options = {})
         flags = options.dup
+        keychain = flags.delete(:keychain)
         flags[:a] ||= flags.delete(:account)
         flags[:c] ||= flags.delete(:creator)
         flags[:C] ||= flags.delete(:type)
@@ -51,7 +60,16 @@ module Security
         flags[:G] ||= flags.delete(:value)
         flags[:j] ||= flags.delete(:comment)
 
-        flags.delete_if { |_k, v| v.nil? }.collect { |k, v| "-#{k} #{v.shellescape}".strip }.join(' ')
+        arguments = flags.compact.flat_map { |k, v| ["-#{k}", v.to_s] }
+        arguments << filename_for_keychain(keychain) if keychain
+
+        arguments
+      end
+
+      # `security` takes the keychain to act on as a trailing argument. Without
+      # one it uses the default keychain, or the default search list.
+      def filename_for_keychain(keychain)
+        keychain.is_a?(Keychain) ? keychain.filename : keychain.to_s
       end
 
       def decode_hex_blob(string)
@@ -68,15 +86,15 @@ module Security
         options[:s] = service
         options[:w] = password
 
-        system "security add-generic-password #{flags_for_options(options)}"
+        Command.relay_interactive('add-generic-password', *flags_for_options(options)).success?
       end
 
       def find(options)
-        password_from_output(`security 2>&1 find-generic-password -g #{flags_for_options(options)}`)
+        password_from_command('security', 'find-generic-password', '-g', *flags_for_options(options))
       end
 
       def delete(options)
-        system "security delete-generic-password #{flags_for_options(options)}"
+        Command.run('security', 'delete-generic-password', *flags_for_options(options)).success?
       end
 
       private
@@ -95,16 +113,15 @@ module Security
         options[:a] = account
         options[:s] = server
         options[:w] = password
-
-        system "security add-internet-password #{flags_for_options(options)}"
+        Command.relay_interactive('add-internet-password', *flags_for_options(options)).success?
       end
 
       def find(options)
-        password_from_output(`security 2>&1 find-internet-password -g #{flags_for_options(options)}`)
+        password_from_command('security', 'find-internet-password', '-g', *flags_for_options(options))
       end
 
       def delete(options)
-        system "security delete-internet-password #{flags_for_options(options)}"
+        Command.run('security', 'delete-internet-password', *flags_for_options(options)).success?
       end
 
       private

data/lib/security/version.rb

@@ -2,5 +2,5 @@
 
 # :nodoc:
 module Security
-  VERSION = '0.2.0'
+  VERSION = '0.4.0'
 end

data/lib/security.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require 'security/version'
+require 'security/error'
+require 'security/command'
 require 'security/keychain'
 require 'security/certificate'
+require 'security/identity'
 require 'security/password'

data/security.gemspec

@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.files         = Dir['./**/*'].grep_v(%r{\./(bin|log|pkg|script|spec|test|vendor)})
   s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }
   s.require_paths = ['lib']
-  s.required_ruby_version = '>= 3.0.0'
+  s.required_ruby_version = '>= 3.2.0'
 
   s.metadata['rubygems_mfa_required'] = 'true'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: security
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Josh Holtz
@@ -21,8 +21,12 @@ files:
 - "./LICENSE.md"
 - "./README.md"
 - "./Rakefile"
+- "./UPGRADE.md"
 - "./lib/security.rb"
 - "./lib/security/certificate.rb"
+- "./lib/security/command.rb"
+- "./lib/security/error.rb"
+- "./lib/security/identity.rb"
 - "./lib/security/keychain.rb"
 - "./lib/security/password.rb"
 - "./lib/security/version.rb"
@@ -39,7 +43,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="