realm / realm-core / 2207 / 14

91%

master: 91%

push

Evergreen

RCORE-2070 Allow setting a security access group for the metadata realm keychain (#7552)

Access groups are shared storage for one or more apps on iOS (and other Apple
platforms). Sharing a metadata Realm between apps requires placing the file in
the access group storage and storing the encryption key in the access group's
keychain.

Including the bundle ID in the service name breaks sharing the key between
apps, as different apps will have different bundle IDs. For everything but
un-sandboxed macOS there wasn't actually any reason to include the bundle ID in
the first place, as each app has its own keychain anyway. As such, this
switches back to not including it. On macOS this continues to include the
bundle ID when not using an access group, as otherwise different applications
could conflict with each other. This means that sharing users between macOS
applications will currently only work if an encryption key is explicitly set or
if the applications have sandboxing enabled.

Since this is slightly changing how keys are stored anyway, it also switches to
using unique keys per server app ID rather than always using "metadata" as the
account name.

The keychain code was mostly multiprocess-safe, but there was one race
condition when two apps generated a new key at once which is fixed.

94966 of 176358 branches covered (53.85%)

206788 of 229791 relevant lines covered (89.99%)

2645424.93 hits per line