From 86b29a953ca651fca848871a547eb3d6e71ea5a3 Mon Sep 17 00:00:00 2001 From: piekstra Date: Tue, 3 Nov 2026 07:09:27 -0500 Subject: [PATCH] fix(credentials): stop re-prompting for Keychain access on every upgrade Bump cli-common to v0.5.1, which reads macOS Keychain secrets through /usr/bin/security. A binary without a TeamIdentifier gets a per-build partition entry from Always Allow, so every release counted as a new application. security keeps one apple-tool entry across releases. Twapp-Session: 59d912f3-982f-402e-8bd8-3e31269a28b0 --- README.md | 8 ++++++++ go.mod | 2 +- go.sum | 4 ++-- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index e8db36ae..80335b1e 100644 --- a/README.md +++ b/README.md @@ -77,6 +77,14 @@ for the current user. | Windows | Credential Manager | | Linux | Secret Service | +On macOS, `cr` reads Keychain secrets through the system `/usr/bin/security` +executable, so access granted once carries across `cr` upgrades. The first read +of an item that does not yet trust `security` raises one prompt naming `security`; +choose **Always Allow**. Reads of that item do not prompt again. `cr set-credential` +and other writes still run as the `cr` binary, and a newly created item raises that +one prompt on its first read. A prompt left unanswered fails the read after 60 +seconds. + Configured stores can also target `1Password` desktop, service account, or Connect backends, `pass`, encrypted file storage, or in-memory storage. Configure additional stores from interactive `cr init` under **Configure secrets diff --git a/go.mod b/go.mod index 5e76988d..fb9efe2d 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/creack/pty v1.1.24 github.com/gobwas/glob v0.2.3 github.com/google/uuid v1.6.0 - github.com/open-cli-collective/cli-common v0.4.1 + github.com/open-cli-collective/cli-common v0.5.1 github.com/spf13/cobra v1.10.2 go.yaml.in/yaml/v3 v3.0.5 golang.org/x/image v0.47.0 diff --git a/go.sum b/go.sum index 5a614923..1193c989 100644 --- a/go.sum +++ b/go.sum @@ -111,8 +111,8 @@ github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWb github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno= github.com/noamcohen97/touchid-go v0.3.0 h1:fcXxVCizysD7KHRR6hrURt3nyNIs5JBGSbOIidD/3wo= github.com/noamcohen97/touchid-go v0.3.0/go.mod h1:X9MRNIBGEmPqwpDm1G3fQOAQX7fwBlhzUbnkDTxuta0= -github.com/open-cli-collective/cli-common v0.4.1 h1:6oNaUVmMtXWi4pJn1X+W6KZVDP/WAJwbyZUyxYpGdbQ= -github.com/open-cli-collective/cli-common v0.4.1/go.mod h1:3AzjCT0V8xgslHlGi1+rUkcV+Vf5wONGwISQkufLZLQ= +github.com/open-cli-collective/cli-common v0.5.1 h1:BbCngljAqHyxtfyQ680qOzn/IYIAOZRldDQvPKJuZ2o= +github.com/open-cli-collective/cli-common v0.5.1/go.mod h1:3AzjCT0V8xgslHlGi1+rUkcV+Vf5wONGwISQkufLZLQ= github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs= github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=