wooga / macos-security.groovy

91%

master: 0%

LAST BUILD ON BRANCH PR-15

branch: PR-15

CHANGE BRANCH

x

Reset

• PR-15
• PR-1
• PR-10
• PR-12
• PR-13
• PR-18
• PR-19
• PR-20
• PR-21
• PR-26
• PR-3
• PR-4
• PR-6
• PR-7
• PR-8
• PR-9
• master
• release/2.x

add JNI lib for interacting with macOS security framework

Description
===========

The `security` commandline tool on macOS is a horrible tool.
It has a very ugly interface and most commands have weird ways of
returnning values. Sometimes stuff gets pushed to `stdout` and
sometimes to `stderr`. Not all features are supported, like getting
the actual status of a keychain. To have more control over the
execution and the output I decided to move some of the core keychain
handling logic into a JNI lib.
At the moment this means most APIs that provide basic keychain
logic (`create`, `lock`, `unlock`, etc) are now implemented with
a JNI lib. The rest of the functionality is still provided with
the `security` cli wrapper commands.

JNI
---

JNI on its own is a tough bit of software. I decided to use the
[nokee] gradle plugin suite to build package a JNI jar with a native
libraty written in pure `c`. This is all contained in a seperate
gradle subproject.

```

 ┌────────────────┐
 │                │
 │ macos-security │
 │                │
 └───────┬────────┘
         │
         │        ┌────────────────────┐
         │        │                    │
         └───────►│ macos-security-jni │
                  │                    │
                  └────────────────────┘
```

This new project contains two major wrappers.

* MacOsSecurity
* KeychainRef

The `MacOsSecurity` class is the main native interface and provides
the raw JNI methods. I decided to wrap the functions provided by
the apple [Security Framework] as close as possible without to much
JNI back and forth. Means when possible only use scalar parameters
and simple types JNI supports out of the box.

`KeychainRef` on the other hand contains methods that allow to pass
more jave natural objects like `File`, `List<>` etc. These will
be translated back and forth. My main intention is that
`MacOsSecurity` should not be used directly from consuming libraries.

The `KeychainRef` object is also interesting ... (continued)