kc/lib.rs
1//! Reading and writing macOS `.keychain` database files directly.
2//!
3//! This is the CDSA-era keychain format — the one `security create-keychain`
4//! still writes on macOS 26 — parsed and produced without the Security
5//! framework, so it works on any host and needs no entitlements.
6//!
7//! * [`mod@format`] is the `kych` container: tables, records, attribute values.
8//! * [`schema`] is the self-describing schema every keychain carries.
9//! * [`crypto`] is the encryption the container specification omits.
10//! * [`db`] ties them together: open, unlock, query, decrypt.
11//! * [`mod@write`] creates keychains and adds items.
12//!
13//! See `README.md` for the format notes and the security caveats.
14
15pub mod acl;
16pub mod apple_schema;
17pub mod crypto;
18pub mod cssm;
19pub mod db;
20pub mod der;
21pub mod error;
22pub mod format;
23pub mod index;
24pub mod output;
25pub mod records;
26pub mod schema;
27pub mod secret;
28pub mod write;
29
30pub use db::{Info, Item, KeychainFile, Query};
31pub use error::{Error, Result};
32pub use format::{Keychain, Record, Value};
33pub use schema::{AttributeFormat, RecordType, Schema};
34pub use write::{CreateOptions, NewItem, create};
35
36/// Reading an application's designated requirement out of its code signature.
37///
38/// Needed to name a trusted application in an item's ACL: the ACL embeds the
39/// application's requirement blob verbatim. Gated behind the `trust-apps`
40/// feature, which pulls in the `macho-codesign` crate; without it, a requirement
41/// can still be supplied as bytes (`csreq -b` output).
42pub mod requirement;