[Feature Request] MacOS keychain or OS native credential storage

[Moulick]

Description

Support OS built in credential storage systems like Windows Credential Manager, MacOS Keychain, and Linux Secret Service.

Motivation

It would provide a way to use the OS built in credential storage system without having to install and configure a additional third party password manager.
I am personally interested in MacOS as that's my daily driver. I am already injecting secrets via the MacOS security cli like security find-generic-password -a moulick -s github-mcp -w. It would be great to have it integrated in Varlock

Proposed Solution

A reference could be https://www.npmjs.com/package/cross-keychain

Alternatives

No response

Additional Information

No response

[theoephraim]

Been working on this and it’s almost ready for publishing. For macOS, It will use Secure Enclave and be behind biometric unlock!

Will have something up soon. Would love you to test it out :)

[Moulick]

Ah cool, I see main...keychain-plugin

Just to say, Keychain is a very MacOS specific term, not sure that's the best for Windows and Linux users 😅

Another note, not sure if calling security cli would be the best as mostly likely then MacOS would then show security as the tool that's asking for authorization to access a keychain item instead of Varlock. And if a user does authorize security then any other app/script on the system could also call security to get the essentially pre-authorized items now. You can imagine the risk that introduces.
And once security is authorized, it never asks for biometric auth again afaik:(

[theoephraim]

Thats actually old :)

As you pointed out, using the keychain directly via security isn't great and not nearly as flexible as I'd like. The new implementation uses a custom swift binary that boots up a background daemon to manage the logic of when you need to re-scan your finger.

Re: "keychain" naming - I have seen quite a few cross-platform tools also use the term "keychain" or "keyring" - open to other suggestions though!

The plan is to have this built into varlock itself, so you wont need an extra plugin.

[theoephraim]

@Moulick New PR is open with a new implementation for mac and working through linux/windows. This new implementation uses the secure enclave directly (key pointer lives in a file, no keychain, encrypted values live within .env.local files) via a tiny swift binary that will be bundled directly with varlock, so no extra software to install. Would love for you to take it for a spin and get some feedback.

Are you in our discord?

[theoephraim]

@Moulick @melkir @schoero - would love some testers and feedback

install preview package - https://pkg.pr.new/varlock@567
some docs - https://feature-secure-enclave-plugin-varlock-website.dmno.workers.dev/guides/secrets/#local-encryption

in a .env.local add ITEM=varlock(prompt) and then run varlock load - it will prompt you to enter a secret and then write into your file, then prompt for fingerprint (if on mac laptop), shoudl gracefully fallback on other platforms. Unlock persists to the current terminal session only for 5 min. Can also lock again via varlock lock or using system menu (top right).