Locksmith
github.com/exabrial/locksmith- Category
- Developer Tools
- Rank
- No. 3350Tools index
Previous survey · No. 3187 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Security & Identity
- Interfaces
- Host Plugin
- GitHub
- 6 stars
- Latest release
- locksmith-parent-1.1.0
- Date
About
A Maven Core Extension and Plugin that lets Maven builds retrieve credentials from the macOS Keychain or a forwarded Unix socket instead of storing plaintext passwords in settings.xml. It supports FIPS-140 compliant secret handling and remote/SSH builds via a local agent that answers Keychain lookups over a socket.
What it does
Locksmith swaps each server password in your Maven settings for a short token naming a Keychain entry, a service and an account. When Maven reads that token at startup, the extension looks the entry up through Apple's Security framework, called directly from Java with no native helper. On Linux, or when the Keychain has no match, it asks a local socket instead. The intended pairing is an SSH session that forwards the socket from your Mac, where a small shell agent answers with the stored secret, so the remote machine never holds the password.
Why it's ranked here
It solves one narrow problem cleanly: build credentials sitting in plaintext in a home directory file that any process can read. The core is small enough to audit in one sitting, a Keychain query, a socket client and a dispatcher that picks between them. It ships as signed jars on Maven Central, the README gives a GPG verification script for the install, and the parent build wires in Checkstyle, SpotBugs and PMD. The licence is EUPL 1.2, a copyleft licence. The ceiling is scope: macOS Keychain or a socket, Java 25 or newer, and no test sources in the repository tree.
What's good
The Keychain read is careful with native memory: every Core Foundation object it creates is released in a finally block, and a missing item returns empty while any other Keychain error throws with the status code. The extension only activates for passwords tagged with its type, so a global install leaves unconfigured projects alone. Malformed tokens fail with a message naming the expected service and account format. The socket protocol is one line out, one line back, simple enough that the sample agent is a four line shell script and a custom password manager could answer it just as easily.
Tradeoffs
Java 25 is a hard floor because the native calls use the new foreign function interface; older projects need Maven toolchains to split the JDKs. Maven also has to find a security settings file before it calls any custom decryptor, so you create a placeholder one. With trace logging on, the core library writes the resolved password to the log. The sample agent answers any service and account pair it is asked for, so anyone who can reach the forwarded socket can read any generic password in your Keychain. If the socket override variable is set but points nowhere, the code does not fall back to the default socket locations.
How to use it well
Install the extension jar globally, verify the signature with the provided script, then move one server credential at a time into the Keychain and replace it with a token. Reach for the plugin only when a third party plugin wants a password as a project property; it sets that property during the validate phase. For remote Linux builds, forward the socket only to hosts you trust and keep trace logging off. This covers developer machines. It does not replace a CI secrets store, and Windows credential stores are not supported.
Technical notes+
CredentialReader.java routes by the os.name system property: on macOS it calls KeychainService.readPassword and falls back to SocketCredentialReader only when the Keychain returns null; elsewhere it goes straight to the socket, and throws IllegalStateException if both come back empty. It logs the password at trace level. KeychainService.java builds a five entry CFDictionary (kSecClassGenericPassword, service, account, kSecMatchLimitOne, kSecReturnData) and calls SecItemCopyMatching through jextract bindings in MacSecurity.java, which looks up the Security and CoreFoundation frameworks by absolute path; errSecItemNotFound (-25300) maps to null, any other status throws. LocksmithPasswordDecryptor.java is a Sisu component named locksmith implementing the plexus sec-dispatcher PasswordDecryptor, splitting the payload on the first slash. KeychainPasswordMojo.java defines the read-password goal bound to VALIDATE. SocketCredentialReader.java resolves LOCKSMITH_SOCK, then XDG_RUNTIME_DIR, then the home directory path, but returns null outright when LOCKSMITH_SOCK is set to a missing path; socket exceptions are logged at warn and swallowed. locksmith/pom.xml excludes the generated bindings from Checkstyle and PMD.
Observed
- License
- EUPL-1.2 (license.txt, declared in pom.xml)
- Language
- Java, using the foreign function and memory API
- Runtime requirement
- Java 25 or newer and Maven 3.9 or newer, per readme.md
- Packaging
- Three Maven modules: core library, Maven core extension, Maven plugin
- Interfaces
- Settings password token for the extension; read-password goal for the plugin; line-based Unix socket protocol
- Platform support
- macOS Keychain natively; Linux via a forwarded Unix socket; no Windows credential store
- Static analysis
- Checkstyle, SpotBugs and PMD configured in locksmith/pom.xml
- Tests
- No test sources in the repository tree
- Logging
- Resolved password written to the log at trace level in CredentialReader.java
Read from readme.md, pom.xml, locksmith/pom.xml, locksmith/src/main/java/com/github/exabrial/locksmith/macos/KeychainService.java, locksmith/src/main/java/com/github/exabrial/locksmith/macos/MacSecurity.java, locksmith/src/main/java/com/github/exabrial/locksmith/CredentialReader.java, locksmith-maven-extension/src/main/java/com/github/exabrial/locksmith/maven/LocksmithPasswordDecryptor.java, locksmith-maven-plugin/src/main/java/com/github/exabrial/locksmith/maven/KeychainPasswordMojo.java, locksmith/src/main/java/com/github/exabrial/locksmith/socket/SocketCredentialReader.java, license.txt.
What it can do
Retrieve credentials from macOS Keychain for use in Maven builds
Keychain credential reference → Resolved credential
Retrieve credentials over a forwarded Unix socket during remote/SSH builds
Socket credential request → Resolved credential
Resolve credential references in Maven settings.xml instead of storing plaintext passwords
settings.xml with credential reference → Resolved plaintext credential at runtime
Run a local agent that answers Keychain lookups over a socket for remote builds
Keychain lookup request → Credential response
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.