When I re-run `git webkit setup` to renew a GitHub access token, I'm asked to allow Python access to api.github.com in Keychain four times. This is very annoying, as I need to type my password every time. There is an "always allow" option, but that's super insecure, as any python script would then have the access.
<rdar://problem/95736776>
One way we could work around this is by building a helper program that does the keychain access on behalf of git-webkit. I spent some time hacking on a little Swift program that would facilitate this months ago, but never finished: https://github.com/emw-apple/WebKit/tree/wip-git-webkit-credentials-program/Tools/git-webkit-credentials
We'd probably want git-webkit itself to be binary, for better security. It can call out to the existing script as necessary, so we don't need to rewrite it all. One question is how to actually get it signed.