Add SetUseDataProtectionKeychain for the data protection keychain

[alphaxdev]

Summary

go-keychain could only target the legacy file-based keychain on macOS, whose per-item ACLs can trigger "X wants to use your keychain" password prompts for apps not on the ACL. macOS 10.15+ also exposes the data protection keychain (the iOS-style keychain), where access is scoped by access group and entitlements instead. It is opted into per call via kSecUseDataProtectionKeychain, but the library exposed no way to set it — no setter, no exported key, and Item.attr is unexported.

This adds Item.SetUseDataProtectionKeychain(bool) and the exported UseDataProtectionKeychainKey attribute key.

Availability handling

kSecUseDataProtectionKeychain is API_AVAILABLE(macos(10.15), ios(13.0)) — below the README's stated minimums (macOS 10.9, iOS 8). Resolving the weak-imported symbol unconditionally at package init would pass NULL to CFStringToString and crash the entire package on older systems, even for callers not using the new API. To avoid that:

• macOS: the key is resolved behind a __builtin_available(macOS 10.15, *) guard. On older systems it resolves empty and SetUseDataProtectionKeychain is a no-op.
• iOS: the data protection keychain is the only keychain, so SetUseDataProtectionKeychain is a no-op that never references the constant, and UseDataProtectionKeychainKey is always empty.

The README's stated minimum OS versions are therefore unchanged.

Usage

item := keychain.NewItem()
item.SetSecClass(keychain.SecClassGenericPassword)
item.SetService("MyService")
item.SetAccount("gabriel")
item.SetAccessGroup("A123456789.group.com.mycorp")
item.SetData([]byte("toomanysecrets"))
item.SetUseDataProtectionKeychain(true)
err := keychain.AddItem(item)

The flag must be set consistently across add/query/update/delete for a given item — the two keychains are separate stores.

Tests

Adds keychain_test.go covering key resolution (including the availability branch), the setter, and the bool → CFBoolean marshalling path. These are hermetic — no real keychain writes, so no prompts.

go build ./..., go vet ./..., and go vet -tags ios . all pass.

🤖 Generated with Claude Code