Add support for `apw` to get iCloud Keychain secrets

[Baelson]

Is your feature request related to a problem? Please describe.

On macOS, chezmoi can currently get passwords from the login keyring and not from the iCloud keyring (as noted in #1137)

Describe the solution you'd like

https://github.com/bendews/apw enables read-only CLI access iCloud keyring. It would be great if it was integrated into chezmoi so we can pull API Keys and other text based secrets into our keyring and replace them with chezmoi templates which get the secrets at chezmoi apply time.

Enable the following scenarios:

• Test chezmoi integration with : chezmoi secret keyring get --service=icloud_keyring --user=chezmoi_icloud
• Get password from template file:
• {{- if .personal -}}
  {{- icloud "chezmoi_icloud" -}}
  {{- end -}}

Describe alternatives you've considered

Use supported age/gpg encryption of the files with secrets.

Additional context

Video demo from apw repo

apw.mov

[halostatue]

Unfortunately this no longer works with modern macOS unless you disable SIP. See bendews/apw#10.

Unless this changes, I cannot recommend its inclusion.

[Baelson]

Thank you for the quick triage and response!

[bendews]

I have found a different method for access in the latest version of apw, the new method should also be more resilient to similar issues occurring again.

[halostatue]

I have found a different method for access in the latest version of apw, the new method should also be more resilient to similar issues occurring again.

I haven't tried this, but the change is more than slightly concerning for making an official supported template function (the requirement for a chromium browser with Apple's extension installed). That's a lot of added infrastructure.

I'll give this a try later and maybe suggest some output patterns to use.

[bendews]

In full agreement - the current method is very much a workaround. Unfortunately it is probably the best we will get until Apple releases their own 😄 It still works well via the custom provider for anyone that is looking for this:

❱ chezmoi execute-template '{{ (index (secretJSON "pw" "get" "example.com" "testuser123").results 0).password }}'
password123