Put CLI and container-core-images in a keychain access group.

- Closes #1253 (hopefully).
- Requires apple/containerization#553.
- We share a keychain between the CLI and the image helper,
  but the user needs to opt-in the image helper for access
  to entries created by the CLI. Since both apps are
  notarized with the same team ID, we should be able to use
  an access group to avoid this step for release builds.

Author: jglogan

Makefile

@@ -117,12 +117,11 @@ $(STAGING_DIR):
 .PHONY: installer-pkg
 installer-pkg: $(STAGING_DIR)
 	@echo Signing container binaries...
-	@codesign $(CODESIGN_OPTS) --identifier com.apple.container.cli "$(join $(STAGING_DIR), bin/container)"
+	@codesign $(CODESIGN_OPTS) --identifier com.apple.container.cli --entitlements=signing/container.entitlements "$(join $(STAGING_DIR), bin/container)"
 	@codesign $(CODESIGN_OPTS) --identifier com.apple.container.apiserver "$(join $(STAGING_DIR), bin/container-apiserver)"
-	@codesign $(CODESIGN_OPTS) --prefix=com.apple.container. "$(join $(STAGING_DIR), libexec/container/plugins/container-core-images/bin/container-core-images)"
+	@codesign $(CODESIGN_OPTS) --prefix=com.apple.container. --entitlements=signing/container-core-images.entitlements "$(join $(STAGING_DIR), libexec/container/plugins/container-core-images/bin/container-core-images)"
 	@codesign $(CODESIGN_OPTS) --prefix=com.apple.container. --entitlements=signing/container-runtime-linux.entitlements "$(join $(STAGING_DIR), libexec/container/plugins/container-runtime-linux/bin/container-runtime-linux)"
 	@codesign $(CODESIGN_OPTS) --prefix=com.apple.container. --entitlements=signing/container-network-vmnet.entitlements "$(join $(STAGING_DIR), libexec/container/plugins/container-network-vmnet/bin/container-network-vmnet)"
-
 	@echo Creating application installer
 	@pkgbuild --root "$(STAGING_DIR)" --identifier com.apple.container-installer --install-location /usr/local --version ${RELEASE_VERSION} $(PKG_PATH)
 	@rm -rf "$(STAGING_DIR)"

Package.resolved

@@ -38,7 +38,7 @@ extension Application {
             aliases: ["ls"])
 
         public func run() async throws {
-            let keychain = KeychainHelper(securityDomain: Constants.keychainID)
+            let keychain = KeychainHelper(securityDomain: Constants.keychainID, accessGroup: Constants.keychainGroup)
             let registries = try keychain.list()
             try printRegistries(registries: registries, format: format)
         }

Sources/ContainerCommands/Registry/RegistryList.swift

@@ -57,7 +57,7 @@ extension Application {
                 }
                 password = String(decoding: passwordData, as: UTF8.self).trimmingCharacters(in: .whitespacesAndNewlines)
             }
-            let keychain = KeychainHelper(securityDomain: Constants.keychainID)
+            let keychain = KeychainHelper(securityDomain: Constants.keychainID, accessGroup: Constants.keychainGroup)
             if username == "" {
                 username = try keychain.userPrompt(hostname: server)
             }

Sources/ContainerCommands/Registry/RegistryLogin.swift

@@ -34,7 +34,7 @@ extension Application {
         var registry: String
 
         public func run() async throws {
-            let keychain = KeychainHelper(securityDomain: Constants.keychainID)
+            let keychain = KeychainHelper(securityDomain: Constants.keychainID, accessGroup: Constants.keychainGroup)
             let r = Reference.resolveDomain(domain: registry)
             try keychain.delete(hostname: r)
         }

Sources/ContainerCommands/Registry/RegistryLogout.swift

@@ -18,4 +18,6 @@
 public enum Constants {
     /// The keychain ID to use for registry credentials.
     public static let keychainID = "com.apple.container.registry"
+    /// The application access group to use for registry credentials.
+    public static let keychainGroup = "com.apple.container.keychain"
 }

Sources/Services/ContainerAPIService/Client/Constants.swift

@@ -427,7 +427,7 @@ extension ImagesService {
         if let authentication {
             return try await body(authentication)
         }
-        let keychain = KeychainHelper(securityDomain: Constants.keychainID)
+        let keychain = KeychainHelper(securityDomain: Constants.keychainID, accessGroup: Constants.keychainGroup)
         do {
             authentication = try keychain.lookup(hostname: host)
         } catch let err as KeychainHelper.Error {

Sources/Services/ContainerImagesService/Server/ImagesService.swift

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>keychain-access-groups</key>
+	<array>
+		<string>$(AppIdentifierPrefix)com.apple.container.keychain</string>
+	</array>
+</dict>
+</plist>

signing/container-core-images.entitlements

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>keychain-access-groups</key>
+	<array>
+		<string>$(AppIdentifierPrefix)com.apple.container.keychain</string>
+	</array>
+</dict>
+</plist>