iCloud keychain support

[filmackay]

Have you thought about using kSecAttrSynchronizable to read/write from iCloud instead of local keychain? Is there any reason why not?

[sorah]

I remember it wasn't available when I implemented envchain. No objection to add cli flag, but it must be default to false.

[filmackay]

Thanks. OK with reading from both (local then iCloud), so it's only the --set that would have --icloud?

[filmackay]

@sorah this requires code signing. Are you able/OK to use Apple Developer creds to sign the binary for release?

[sorah]

we don't have a binary release at all, so it would be fine? I'm not sure how distributors deal with this such as Homebrew bottles.

[filmackay]

Hrm.. it seems that to get the ability to write icloud items, you need:

• an entitlement; which requires
• developer signing (not ad-hoc signing); which requires
• Apple Developer membership (subscription)

We'd need to:

• build/sign a binary
• upload as a GitHub release
• have the brew tap point to this

Are you up for this? :)
(and do you have an Apple Developer sub?)

[filmackay]

I'm working on getting an apprpriately signed/notarized binary. @sorah then you can have a look and see if you want anything to do with it 😄