mirror of
https://github.com/tinyhumansai/openhuman.git
synced 2026-07-28 13:32:23 +00:00
46 lines
1.6 KiB
Bash
Executable File
46 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Pre-seeds the "Chromium Safe Storage" keychain entry with a permissive
|
|
# ACL so CEF/Chromium reads it without prompting.
|
|
#
|
|
# Idempotent: if the entry already exists, leaves the encryption key alone
|
|
# (so existing cookies/IndexedDB stay decryptable) and only re-applies the
|
|
# permissive ACL via partition-list.
|
|
#
|
|
# macOS-only: the `security` CLI and the "Chromium Safe Storage" keychain
|
|
# entry are macOS Keychain concepts. On Linux Chromium uses kwallet/gnome
|
|
# keyring (or the basic password store via `--password-store=basic`, which
|
|
# the Tauri shell sets unconditionally), and on Windows it uses DPAPI. We
|
|
# no-op on every non-Darwin platform so this script can sit unconditionally
|
|
# in the cross-platform `dev:app` pipeline.
|
|
if [[ "$(uname -s)" != "Darwin" ]]; then
|
|
exit 0
|
|
fi
|
|
|
|
set -euo pipefail
|
|
|
|
SVC="Chromium Safe Storage"
|
|
ACCT="Chromium"
|
|
KEYCHAIN="$HOME/Library/Keychains/login.keychain-db"
|
|
|
|
if security find-generic-password -s "$SVC" -a "$ACCT" "$KEYCHAIN" >/dev/null 2>&1; then
|
|
echo "[chromium-safe-storage] entry exists — leaving key intact, refreshing ACL"
|
|
# Permissive partition list: any binary can read.
|
|
security set-generic-password-partition-list \
|
|
-S "apple-tool:,apple:,unsigned:" \
|
|
-s "$SVC" \
|
|
-a "$ACCT" \
|
|
-k "" \
|
|
"$KEYCHAIN" >/dev/null 2>&1 || true
|
|
else
|
|
echo "[chromium-safe-storage] entry missing — seeding with random key + permissive ACL"
|
|
KEY=$(openssl rand -base64 16)
|
|
security add-generic-password \
|
|
-s "$SVC" \
|
|
-a "$ACCT" \
|
|
-w "$KEY" \
|
|
-A \
|
|
"$KEYCHAIN"
|
|
fi
|
|
|
|
echo "[chromium-safe-storage] done"
|