external
/
secretive
mirror of https://github.com/maxgoedjen/secretive.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

merge main branch

This commit is contained in:
David Gunzinger 2022-01-03 09:46:27 +01:00
parent 67e34337e0 05c5aca9b6
commit 98878a3023
122 changed files with 1971 additions and 2871 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
.github/workflows/release.yml vendored
View File

@ -20,9 +20,12 @@ jobs:
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
run: ./.github/scripts/signing.sh
- name: Set Environment
run: sudo xcrun xcode-select -s /Applications/Xcode_13.1.app
run: sudo xcrun xcode-select -s /Applications/Xcode_13.2.1.app
- name: Test
run: xcrun xcodebuild test -project Secretive.xcodeproj -scheme Secretive
run: |
pushd Sources/Packages
swift test
popd
build:
runs-on: macos-11.0
timeout-minutes: 10
@ -38,18 +41,18 @@ jobs:
APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
run: ./.github/scripts/signing.sh
- name: Set Environment
run: sudo xcrun xcode-select -s /Applications/Xcode_13.1.app
run: sudo xcrun xcode-select -s /Applications/Xcode_13.2.1.app
- name: Update Build Number
env:
TAG_NAME: ${{ github.ref }}
RUN_ID: ${{ github.run_id }}
run: |
export CLEAN_TAG=$(echo $TAG_NAME | sed -e 's/refs\/tags\/v//')
sed -i '' -e "s/GITHUB_CI_VERSION/$CLEAN_TAG/g" Config/Config.xcconfig
sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Config/Config.xcconfig
sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Secretive/Credits.rtf
sed -i '' -e "s/GITHUB_CI_VERSION/$CLEAN_TAG/g" Sources/Config/Config.xcconfig
sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
- name: Build
run: xcrun xcodebuild -project Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
- name: Create ZIPs
run: |
ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
@ -88,7 +91,7 @@ jobs:
draft: true
prerelease: false
- name: Upload App to Release
id: upload-release-asset
id: upload-release-asset-app
uses: actions/upload-release-asset@v1.0.1
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@ -97,13 +100,13 @@ jobs:
asset_path: ./Secretive.zip
asset_name: Secretive.zip
asset_content_type: application/zip
- name: Upload Archive to Artifacts
uses: actions/upload-artifact@v1
with:
name: Archive.zip
path: Archive.zip
- name: Upload Archive to Artifacts
- name: Upload App to Artifacts
uses: actions/upload-artifact@v1
with:
name: Secretive.zip
path: Secretive.zip
- name: Upload Archive to Artifacts
uses: actions/upload-artifact@v1
with:
name: Xcode_Archive.zip
path: Archive.zip

7
.github/workflows/test.yml vendored
View File

@ -8,6 +8,9 @@ jobs:
steps:
- uses: actions/checkout@v2
- name: Set Environment
run: sudo xcrun xcode-select -s /Applications/Xcode_13.1.app
run: sudo xcrun xcode-select -s /Applications/Xcode_13.2.1.app
- name: Test
run: xcrun xcodebuild test -project Secretive.xcodeproj -scheme Secretive
run: |
pushd Sources/Packages
swift test
popd

1
.gitignore vendored
View File

@ -92,3 +92,4 @@ iOSInjectionProject/
# Build script products
Archive.xcarchive
.DS_Store
contents.xcworkspacedata

19
Brief/Brief.h
View File

@ -1,19 +0,0 @@
//
// Brief.h
// Brief
//
// Created by Max Goedjen on 3/21/20.
// Copyright © 2020 Max Goedjen. All rights reserved.
//
#import <Foundation/Foundation.h>
//! Project version number for Brief.
FOUNDATION_EXPORT double BriefVersionNumber;
//! Project version string for Brief.
FOUNDATION_EXPORT const unsigned char BriefVersionString[];
// In this header, you should import all the public headers of your framework using statements like #import <Brief/PublicHeader.h>

24
Brief/Info.plist
View File

@ -1,24 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDevelopmentRegion</key>
<string>$(DEVELOPMENT_LANGUAGE)</string>
<key>CFBundleExecutable</key>
<string>$(EXECUTABLE_NAME)</string>
<key>CFBundleIdentifier</key>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>$(PRODUCT_NAME)</string>
<key>CFBundlePackageType</key>
<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
<key>CFBundleShortVersionString</key>
<string>1.0</string>
<key>CFBundleVersion</key>
<string>$(CURRENT_PROJECT_VERSION)</string>
<key>NSHumanReadableCopyright</key>
<string>$(PRODUCT_NAME) is MIT Licensed.</string>
</dict>
</plist>

178
Brief/Updater.swift
View File

@ -1,178 +0,0 @@
import Foundation
import Combine
public protocol UpdaterProtocol: ObservableObject {
var update: Release? { get }
}
public class Updater: ObservableObject, UpdaterProtocol {
@Published public var update: Release?
private let osVersion: SemVer
private let currentVersion: SemVer
public init(checkOnLaunch: Bool, osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion), currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")) {
self.osVersion = osVersion
self.currentVersion = currentVersion
if checkOnLaunch {
// Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet.
checkForUpdates()
}
let timer = Timer.scheduledTimer(withTimeInterval: 60*60*24, repeats: true) { _ in
self.checkForUpdates()
}
timer.tolerance = 60*60
}
public func checkForUpdates() {
URLSession.shared.dataTask(with: Constants.updateURL) { data, _, _ in
guard let data = data else { return }
guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
self.evaluate(releases: releases)
}.resume()
}
public func ignore(release: Release) {
guard !release.critical else { return }
defaults.set(true, forKey: release.name)
DispatchQueue.main.async {
self.update = nil
}
}
}
extension Updater {
func evaluate(releases: [Release]) {
guard let release = releases
.sorted()
.reversed()
.filter({ !$0.prerelease })
.first(where: { $0.minimumOSVersion <= osVersion }) else { return }
guard !userIgnored(release: release) else { return }
guard !release.prerelease else { return }
let latestVersion = SemVer(release.name)
if latestVersion > currentVersion {
DispatchQueue.main.async {
self.update = release
}
}
}
func userIgnored(release: Release) -> Bool {
guard !release.critical else { return false }
return defaults.bool(forKey: release.name)
}
var defaults: UserDefaults {
UserDefaults(suiteName: "com.maxgoedjen.Secretive.updater.ignorelist")!
}
}
public struct SemVer {
let versionNumbers: [Int]
public init(_ version: String) {
// Betas have the format 1.2.3_beta1
let strippedBeta = version.split(separator: "_").first!
var split = strippedBeta.split(separator: ".").compactMap { Int($0) }
while split.count < 3 {
split.append(0)
}
versionNumbers = split
}
public init(_ version: OperatingSystemVersion) {
versionNumbers = [version.majorVersion, version.minorVersion, version.patchVersion]
}
}
extension SemVer: Comparable {
public static func < (lhs: SemVer, rhs: SemVer) -> Bool {
for (latest, current) in zip(lhs.versionNumbers, rhs.versionNumbers) {
if latest < current {
return true
} else if latest > current {
return false
}
}
return false
}
}
extension Updater {
enum Constants {
static let updateURL = URL(string: "https://api.github.com/repos/maxgoedjen/secretive/releases")!
}
}
public struct Release: Codable {
public let name: String
public let prerelease: Bool
public let html_url: URL
public let body: String
public init(name: String, prerelease: Bool, html_url: URL, body: String) {
self.name = name
self.prerelease = prerelease
self.html_url = html_url
self.body = body
}
}
extension Release: Identifiable {
public var id: String {
html_url.absoluteString
}
}
extension Release: Comparable {
public static func < (lhs: Release, rhs: Release) -> Bool {
lhs.version < rhs.version
}
}
extension Release {
public var critical: Bool {
body.contains(Constants.securityContent)
}
public var version: SemVer {
SemVer(name)
}
public var minimumOSVersion: SemVer {
guard let range = body.range(of: "Minimum macOS Version"),
let numberStart = body.rangeOfCharacter(from: CharacterSet.decimalDigits, options: [], range: range.upperBound..<body.endIndex) else { return SemVer("11.0.0") }
let numbersEnd = body.rangeOfCharacter(from: CharacterSet.whitespacesAndNewlines, options: [], range: numberStart.upperBound..<body.endIndex)?.lowerBound ?? body.endIndex
let version = numberStart.lowerBound..<numbersEnd
return SemVer(String(body[version]))
}
}
extension Release {
enum Constants {
static let securityContent = "Critical Security Update"
}
}

50
Config/Secretive.xctestplan
View File

@ -1,50 +0,0 @@
{
"configurations" : [
{
"id" : "5896AE5A-6D5A-48D3-837B-668B646A3273",
"name" : "Configuration 1",
"options" : {
}
}
],
"defaultOptions" : {
},
"testTargets" : [
{
"parallelizable" : true,
"target" : {
"containerPath" : "container:Secretive.xcodeproj",
"identifier" : "50617DAF23FCE4AB0099B055",
"name" : "SecretKitTests"
}
},
{
"parallelizable" : true,
"target" : {
"containerPath" : "container:Secretive.xcodeproj",
"identifier" : "5099A073240242BA0062B6F2",
"name" : "SecretAgentKitTests"
}
},
{
"enabled" : false,
"parallelizable" : true,
"target" : {
"containerPath" : "container:Secretive.xcodeproj",
"identifier" : "50617D9323FCE48E0099B055",
"name" : "SecretiveTests"
}
},
{
"parallelizable" : true,
"target" : {
"containerPath" : "container:Secretive.xcodeproj",
"identifier" : "5091D31E2519D56D0049FD9B",
"name" : "BriefTests"
}
}
],
"version" : 1
}

3
DESIGN.md Normal file
View File

@ -0,0 +1,3 @@
# Design
The art assets for the App Icon and GitHub image are located on [Sketch Cloud](https://www.sketch.com/s/574333cd-8ceb-40e1-a6d9-189da3f1e5dd).

BIN
Icon.sketch
View File

Binary file not shown.

24
SecretAgentKit/Info.plist
View File

@ -1,24 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDevelopmentRegion</key>
<string>$(DEVELOPMENT_LANGUAGE)</string>
<key>CFBundleExecutable</key>
<string>$(EXECUTABLE_NAME)</string>
<key>CFBundleIdentifier</key>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>$(PRODUCT_NAME)</string>
<key>CFBundlePackageType</key>
<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
<key>CFBundleShortVersionString</key>
<string>$(CI_VERSION)</string>
<key>CFBundleVersion</key>
<string>$(CURRENT_PROJECT_VERSION)</string>
<key>NSHumanReadableCopyright</key>
<string>$(PRODUCT_NAME) is MIT Licensed.</string>
</dict>
</plist>

9
SecretAgentKit/SigningWitness.swift
View File

@ -1,9 +0,0 @@
import Foundation
import SecretKit
public protocol SigningWitness {
func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws
func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) throws
}

22
SecretAgentKitTests/Info.plist
View File

@ -1,22 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDevelopmentRegion</key>
<string>$(DEVELOPMENT_LANGUAGE)</string>
<key>CFBundleExecutable</key>
<string>$(EXECUTABLE_NAME)</string>
<key>CFBundleIdentifier</key>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>$(PRODUCT_NAME)</string>
<key>CFBundlePackageType</key>
<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
<key>CFBundleShortVersionString</key>
<string>1.0</string>
<key>CFBundleVersion</key>
<string>1</string>
</dict>
</plist>

30
SecretKit/Common/Types/SecretStore.swift
View File

@ -1,30 +0,0 @@
import Combine
public protocol SecretStore: ObservableObject, Identifiable {
associatedtype SecretType: Secret
var isAvailable: Bool { get }
var id: UUID { get }
var name: String { get }
var secrets: [SecretType] { get }
func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> SignedData
func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) throws
}
public protocol SecretStoreModifiable: SecretStore {
func create(name: String, requiresAuthentication: Bool) throws
func delete(secret: SecretType) throws
func update(secret: SecretType, name: String) throws
}
extension NSNotification.Name {
static let secretStoreUpdated = NSNotification.Name("com.maxgoedjen.Secretive.secretStore.updated")
}

13
SecretKit/Common/Types/SignedData.swift
View File

@ -1,13 +0,0 @@
import Foundation
public struct SignedData {
public let data: Data
public let requiredAuthentication: Bool
public init(data: Data, requiredAuthentication: Bool) {
self.data = data
self.requiredAuthentication = requiredAuthentication
}
}

53
SecretKit/Common/Types/SigningRequestProvenance.swift
View File

@ -1,53 +0,0 @@
import Foundation
import AppKit
public struct SigningRequestProvenance: Equatable {
public var chain: [Process]
public init(root: Process) {
self.chain = [root]
}
}
extension SigningRequestProvenance {
public var origin: Process {
chain.last!
}
public var intact: Bool {
chain.allSatisfy { $0.validSignature }
}
}
extension SigningRequestProvenance {
public struct Process: Equatable {
public let pid: Int32
public let processName: String
public let appName: String?
public let iconURL: URL?
public let path: String
public let validSignature: Bool
public let parentPID: Int32?
public init(pid: Int32, processName: String, appName: String?, iconURL: URL?, path: String, validSignature: Bool, parentPID: Int32?) {
self.pid = pid
self.processName = processName
self.appName = appName
self.iconURL = iconURL
self.path = path
self.validSignature = validSignature
self.parentPID = parentPID
}
public var displayName: String {
appName ?? processName
}
}
}

24
SecretKit/Info.plist
View File

@ -1,24 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDevelopmentRegion</key>
<string>$(DEVELOPMENT_LANGUAGE)</string>
<key>CFBundleExecutable</key>
<string>$(EXECUTABLE_NAME)</string>
<key>CFBundleIdentifier</key>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>$(PRODUCT_NAME)</string>
<key>CFBundlePackageType</key>
<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
<key>CFBundleShortVersionString</key>
<string>$(CI_VERSION)</string>
<key>CFBundleVersion</key>
<string>$(CURRENT_PROJECT_VERSION)</string>
<key>NSHumanReadableCopyright</key>
<string>$(PRODUCT_NAME) is MIT Licensed.</string>
</dict>
</plist>

11
SecretKit/SecretKit.h
View File

@ -1,11 +0,0 @@
#import <Foundation/Foundation.h>
//! Project version number for SecretKit.
FOUNDATION_EXPORT double SecretKitVersionNumber;
//! Project version string for SecretKit.
FOUNDATION_EXPORT const unsigned char SecretKitVersionString[];
// In this header, you should import all the public headers of your framework using statements like #import <SecretKit/PublicHeader.h>

1
SecretKit/SecureEnclave/SecureEnclave.swift
View File

@ -1 +0,0 @@
public enum SecureEnclave {}

1
SecretKit/SmartCard/SmartCard.swift
View File

@ -1 +0,0 @@
public enum SmartCard {}

22
SecretKitTests/Info.plist
View File

@ -1,22 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDevelopmentRegion</key>
<string>$(DEVELOPMENT_LANGUAGE)</string>
<key>CFBundleExecutable</key>
<string>$(EXECUTABLE_NAME)</string>
<key>CFBundleIdentifier</key>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>$(PRODUCT_NAME)</string>
<key>CFBundlePackageType</key>
<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
<key>CFBundleShortVersionString</key>
<string>1.0</string>
<key>CFBundleVersion</key>
<string>1</string>
</dict>
</plist>

2127
Secretive.xcodeproj/project.pbxproj
View File

File diff suppressed because it is too large Load Diff

85
Secretive.xcodeproj/xcshareddata/xcschemes/SecretAgentKit.xcscheme
View File

@ -1,85 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1140"
version = "1.7">
<BuildAction
parallelizeBuildables = "YES"
buildImplicitDependencies = "YES">
<BuildActionEntries>
<BuildActionEntry
buildForTesting = "YES"
buildForRunning = "YES"
buildForProfiling = "YES"
buildForArchiving = "YES"
buildForAnalyzing = "YES">
<BuildableReference
BuildableIdentifier = "primary"
BlueprintIdentifier = "5099A06B240242BA0062B6F2"
BuildableName = "SecretAgentKit.framework"
BlueprintName = "SecretAgentKit"
ReferencedContainer = "container:Secretive.xcodeproj">
</BuildableReference>
</BuildActionEntry>
</BuildActionEntries>
</BuildAction>
<TestAction
buildConfiguration = "Test"
selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
shouldUseLaunchSchemeArgsEnv = "YES">
<TestPlans>
<TestPlanReference
reference = "container:Config/Secretive.xctestplan"
default = "YES">
</TestPlanReference>
</TestPlans>
<Testables>
<TestableReference
skipped = "NO"
parallelizable = "YES"
testExecutionOrdering = "random">
<BuildableReference
BuildableIdentifier = "primary"
BlueprintIdentifier = "5099A073240242BA0062B6F2"
BuildableName = "SecretAgentKitTests.xctest"
BlueprintName = "SecretAgentKitTests"
ReferencedContainer = "container:Secretive.xcodeproj">
</BuildableReference>
</TestableReference>
</Testables>
</TestAction>
<LaunchAction
buildConfiguration = "Debug"
selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
launchStyle = "0"
useCustomWorkingDirectory = "NO"
ignoresPersistentStateOnLaunch = "NO"
debugDocumentVersioning = "YES"
debugServiceExtension = "internal"
allowLocationSimulation = "YES">
</LaunchAction>
<ProfileAction
buildConfiguration = "Release"
shouldUseLaunchSchemeArgsEnv = "YES"
savedToolIdentifier = ""
useCustomWorkingDirectory = "NO"
debugDocumentVersioning = "YES">
<MacroExpansion>
<BuildableReference
BuildableIdentifier = "primary"
BlueprintIdentifier = "5099A06B240242BA0062B6F2"
BuildableName = "SecretAgentKit.framework"
BlueprintName = "SecretAgentKit"
ReferencedContainer = "container:Secretive.xcodeproj">
</BuildableReference>
</MacroExpansion>
</ProfileAction>
<AnalyzeAction
buildConfiguration = "Debug">
</AnalyzeAction>
<ArchiveAction
buildConfiguration = "Release"
revealArchiveInOrganizer = "YES">
</ArchiveAction>
</Scheme>

71
Secretive.xcodeproj/xcshareddata/xcschemes/SecretKit.xcscheme
View File

@ -1,71 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1140"
version = "1.7">
<BuildAction
parallelizeBuildables = "YES"
buildImplicitDependencies = "YES">
<BuildActionEntries>
<BuildActionEntry
buildForTesting = "YES"
buildForRunning = "YES"
buildForProfiling = "YES"
buildForArchiving = "YES"
buildForAnalyzing = "YES">
<BuildableReference
BuildableIdentifier = "primary"
BlueprintIdentifier = "50617DA723FCE4AB0099B055"
BuildableName = "SecretKit.framework"
BlueprintName = "SecretKit"
ReferencedContainer = "container:Secretive.xcodeproj">
</BuildableReference>
</BuildActionEntry>
</BuildActionEntries>
</BuildAction>
<TestAction
buildConfiguration = "Test"
selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
shouldUseLaunchSchemeArgsEnv = "YES">
<TestPlans>
<TestPlanReference
reference = "container:Config/Secretive.xctestplan"
default = "YES">
</TestPlanReference>
</TestPlans>
</TestAction>
<LaunchAction
buildConfiguration = "Debug"
selectedDebuggerIdentifier = "Xcode.DebuggerFoundation.Debugger.LLDB"
selectedLauncherIdentifier = "Xcode.DebuggerFoundation.Launcher.LLDB"
launchStyle = "0"
useCustomWorkingDirectory = "NO"
ignoresPersistentStateOnLaunch = "NO"
debugDocumentVersioning = "YES"
debugServiceExtension = "internal"
allowLocationSimulation = "YES">
</LaunchAction>
<ProfileAction
buildConfiguration = "Release"
shouldUseLaunchSchemeArgsEnv = "YES"
savedToolIdentifier = ""
useCustomWorkingDirectory = "NO"
debugDocumentVersioning = "YES">
<MacroExpansion>
<BuildableReference
BuildableIdentifier = "primary"
BlueprintIdentifier = "50617DA723FCE4AB0099B055"
BuildableName = "SecretKit.framework"
BlueprintName = "SecretKit"
ReferencedContainer = "container:Secretive.xcodeproj">
</BuildableReference>
</MacroExpansion>
</ProfileAction>
<AnalyzeAction
buildConfiguration = "Debug">
</AnalyzeAction>
<ArchiveAction
buildConfiguration = "Release"
revealArchiveInOrganizer = "YES">
</ArchiveAction>
</Scheme>

22
SecretiveTests/Info.plist
View File

@ -1,22 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>CFBundleDevelopmentRegion</key>
<string>$(DEVELOPMENT_LANGUAGE)</string>
<key>CFBundleExecutable</key>
<string>$(EXECUTABLE_NAME)</string>
<key>CFBundleIdentifier</key>
<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
<key>CFBundleInfoDictionaryVersion</key>
<string>6.0</string>
<key>CFBundleName</key>
<string>$(PRODUCT_NAME)</string>
<key>CFBundlePackageType</key>
<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
<key>CFBundleShortVersionString</key>
<string>1.0</string>
<key>CFBundleVersion</key>
<string>1</string>
</dict>
</plist>

0
Config/Config.xcconfig → Sources/Config/Config.xcconfig
View File

26
Sources/Config/Secretive.xctestplan Normal file
View File

@ -0,0 +1,26 @@
{
"configurations" : [
{
"id" : "5896AE5A-6D5A-48D3-837B-668B646A3273",
"name" : "Configuration 1",
"options" : {
}
}
],
"defaultOptions" : {
},
"testTargets" : [
{
"enabled" : false,
"parallelizable" : true,
"target" : {
"containerPath" : "container:Secretive.xcodeproj",
"identifier" : "50617D9323FCE48E0099B055",
"name" : "SecretiveTests"
}
}
],
"version" : 1
}

70
Sources/Packages/Package.swift Normal file
View File

@ -0,0 +1,70 @@
// swift-tools-version:5.5
// The swift-tools-version declares the minimum version of Swift required to build this package.
import PackageDescription
let package = Package(
name: "SecretivePackages",
platforms: [
.macOS(.v11)
],
products: [
.library(
name: "SecretKit",
targets: ["SecretKit"]),
.library(
name: "SecureEnclaveSecretKit",
targets: ["SecureEnclaveSecretKit"]),
.library(
name: "SmartCardSecretKit",
targets: ["SmartCardSecretKit"]),
.library(
name: "SecretAgentKit",
targets: ["SecretAgentKit"]),
.library(
name: "SecretAgentKitHeaders",
targets: ["SecretAgentKitHeaders"]),
.library(
name: "Brief",
targets: ["Brief"]),
],
dependencies: [
],
targets: [
.target(
name: "SecretKit",
dependencies: []
),
.testTarget(
name: "SecretKitTests",
dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"]
),
.target(
name: "SecureEnclaveSecretKit",
dependencies: ["SecretKit"]
),
.target(
name: "SmartCardSecretKit",
dependencies: ["SecretKit"]
),
.target(
name: "SecretAgentKit",
dependencies: ["SecretKit", "SecretAgentKitHeaders"]
),
.systemLibrary(
name: "SecretAgentKitHeaders"
),
.testTarget(
name: "SecretAgentKitTests",
dependencies: ["SecretAgentKit"])
,
.target(
name: "Brief",
dependencies: []
),
.testTarget(
name: "BriefTests",
dependencies: ["Brief"]
),
]
)

15
Sources/Packages/Sources/Brief/Documentation.docc/Documentation.md Normal file
View File

@ -0,0 +1,15 @@
# ``Brief``
Brief is a collection of protocols and concrete implmentation describing updates.
## Topics
### Versioning
- ``SemVer``
- ``Release``
### Updater
- ``UpdaterProtocol``
- ``Updater``

80
Sources/Packages/Sources/Brief/Release.swift Normal file
View File

@ -0,0 +1,80 @@
import Foundation
/// A release is a representation of a downloadable update.
public struct Release: Codable {
/// The user-facing name of the release. Typically "Secretive 1.2.3"
public let name: String
/// A boolean describing whether or not the release is a prerelase build.
public let prerelease: Bool
/// A URL pointing to the HTML page for the release.
public let html_url: URL
/// A user-facing description of the contents of the update.
public let body: String
/// Initializes a Release.
/// - Parameters:
/// - name: The user-facing name of the release.
/// - prerelease: A boolean describing whether or not the release is a prerelase build.
/// - html_url: A URL pointing to the HTML page for the release.
/// - body: A user-facing description of the contents of the update.
public init(name: String, prerelease: Bool, html_url: URL, body: String) {
self.name = name
self.prerelease = prerelease
self.html_url = html_url
self.body = body
}
}
extension Release: Identifiable {
public var id: String {
html_url.absoluteString
}
}
extension Release: Comparable {
public static func < (lhs: Release, rhs: Release) -> Bool {
lhs.version < rhs.version
}
}
extension Release {
/// A boolean describing whether or not the release contains critical security content.
/// - Note: this is determined by the presence of the phrase "Critical Security Update" in the ``body``.
/// - Warning: If this property is true, the user will not be able to dismiss UI or reminders associated with the update.
public var critical: Bool {
body.contains(Constants.securityContent)
}
/// A ``SemVer`` representation of the version number of the release.
public var version: SemVer {
SemVer(name)
}
/// The minimum macOS version required to run the update.
public var minimumOSVersion: SemVer {
guard let range = body.range(of: "Minimum macOS Version"),
let numberStart = body.rangeOfCharacter(from: CharacterSet.decimalDigits, options: [], range: range.upperBound..<body.endIndex) else { return SemVer("11.0.0") }
let numbersEnd = body.rangeOfCharacter(from: CharacterSet.whitespacesAndNewlines, options: [], range: numberStart.upperBound..<body.endIndex)?.lowerBound ?? body.endIndex
let version = numberStart.lowerBound..<numbersEnd
return SemVer(String(body[version]))
}
}
extension Release {
enum Constants {
static let securityContent = "Critical Security Update"
}
}

43
Sources/Packages/Sources/Brief/SemVer.swift Normal file
View File

@ -0,0 +1,43 @@
import Foundation
/// A representation of a Semantic Version.
public struct SemVer {
/// The SemVer broken into an array of integers.
let versionNumbers: [Int]
/// Initializes a SemVer from a string representation.
/// - Parameter version: A string representation of the SemVer, formatted as "major.minor.patch".
public init(_ version: String) {
// Betas have the format 1.2.3_beta1
let strippedBeta = version.split(separator: "_").first!
var split = strippedBeta.split(separator: ".").compactMap { Int($0) }
while split.count < 3 {
split.append(0)
}
versionNumbers = split
}
/// Initializes a SemVer from an `OperatingSystemVersion` representation.
/// - Parameter version: An `OperatingSystemVersion` representation of the SemVer.
public init(_ version: OperatingSystemVersion) {
versionNumbers = [version.majorVersion, version.minorVersion, version.patchVersion]
}
}
extension SemVer: Comparable {
public static func < (lhs: SemVer, rhs: SemVer) -> Bool {
for (latest, current) in zip(lhs.versionNumbers, rhs.versionNumbers) {
if latest < current {
return true
} else if latest > current {
return false
}
}
return false
}
}

97
Sources/Packages/Sources/Brief/Updater.swift Normal file
View File

@ -0,0 +1,97 @@
import Foundation
import Combine
/// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
public class Updater: ObservableObject, UpdaterProtocol {
@Published public var update: Release?
public let testBuild: Bool
/// The current OS version.
private let osVersion: SemVer
/// The current version of the app that is running.
private let currentVersion: SemVer
/// Initializes an Updater.
/// - Parameters:
/// - checkOnLaunch: A boolean describing whether the Updater should check for available updates on launch.
/// - checkFrequency: The interval at which the Updater should check for updates. Subject to a tolerance of 1 hour.
/// - osVersion: The current OS version.
/// - currentVersion: The current version of the app that is running.
public init(checkOnLaunch: Bool, checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value, osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion), currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")) {
self.osVersion = osVersion
self.currentVersion = currentVersion
testBuild = currentVersion == SemVer("0.0.0")
if checkOnLaunch {
// Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet.
checkForUpdates()
}
let timer = Timer.scheduledTimer(withTimeInterval: checkFrequency, repeats: true) { _ in
self.checkForUpdates()
}
timer.tolerance = 60*60
}
/// Manually trigger an update check.
public func checkForUpdates() {
URLSession.shared.dataTask(with: Constants.updateURL) { data, _, _ in
guard let data = data else { return }
guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
self.evaluate(releases: releases)
}.resume()
}
/// Ignores a specified release. `update` will be nil if the user has ignored the latest available release.
/// - Parameter release: The release to ignore.
public func ignore(release: Release) {
guard !release.critical else { return }
defaults.set(true, forKey: release.name)
DispatchQueue.main.async {
self.update = nil
}
}
}
extension Updater {
/// Evaluates the available downloadable releases, and selects the newest non-prerelease release that the user is able to run.
/// - Parameter releases: An array of ``Release`` objects.
func evaluate(releases: [Release]) {
guard let release = releases
.sorted()
.reversed()
.filter({ !$0.prerelease })
.first(where: { $0.minimumOSVersion <= osVersion }) else { return }
guard !userIgnored(release: release) else { return }
guard !release.prerelease else { return }
let latestVersion = SemVer(release.name)
if latestVersion > currentVersion {
DispatchQueue.main.async {
self.update = release
}
}
}
/// Checks whether the user has ignored a release.
/// - Parameter release: The release to check.
/// - Returns: A boolean describing whether the user has ignored the release. Will always be false if the release is critical.
func userIgnored(release: Release) -> Bool {
guard !release.critical else { return false }
return defaults.bool(forKey: release.name)
}
/// The user defaults used to store user ignore state.
var defaults: UserDefaults {
UserDefaults(suiteName: "com.maxgoedjen.Secretive.updater.ignorelist")!
}
}
extension Updater {
enum Constants {
static let updateURL = URL(string: "https://api.github.com/repos/maxgoedjen/secretive/releases")!
}
}

12
Sources/Packages/Sources/Brief/UpdaterProtocol.swift Normal file
View File

@ -0,0 +1,12 @@
import Foundation
/// A protocol for retreiving the latest available version of an app.
public protocol UpdaterProtocol: ObservableObject {
/// The latest update
var update: Release? { get }
/// A boolean describing whether or not the current build of the app is a "test" build (ie, a debug build or otherwise special build)
var testBuild: Bool { get }
}

26
SecretAgentKit/Agent.swift → Sources/Packages/Sources/SecretAgentKit/Agent.swift
View File

@ -4,6 +4,7 @@ import OSLog
import SecretKit
import AppKit
/// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
public class Agent {
private let storeList: SecretStoreList
@ -11,6 +12,10 @@ public class Agent {
private let writer = OpenSSHKeyWriter()
private let requestTracer = SigningRequestTracer()
/// Initializes an agent with a store list and a witness.
/// - Parameters:
/// - storeList: The `SecretStoreList` to make available.
/// - witness: A witness to notify of requests.
public init(storeList: SecretStoreList, witness: SigningWitness? = nil) {
Logger().debug("Agent is running")
self.storeList = storeList
@ -21,10 +26,16 @@ public class Agent {
extension Agent {
/// Handles an incoming request.
/// - Parameters:
/// - reader: A ``FileHandleReader`` to read the content of the request.
/// - writer: A ``FileHandleWriter`` to write the response to.
/// - Return value:
/// - Boolean if data could be read
public func handle(reader: FileHandleReader, writer: FileHandleWriter) -> Bool {
Logger().debug("Agent handling new data")
let data = reader.availableData
guard !data.isEmpty else { return false}
let data = Data(reader.availableData)
guard data.count > 4 else { return false}
let requestTypeInt = data[4]
guard let requestType = SSHAgent.RequestType(rawValue: requestTypeInt) else {
writer.write(OpenSSHKeyWriter().lengthAndData(of: SSHAgent.ResponseType.agentFailure.data))
@ -65,6 +76,8 @@ extension Agent {
extension Agent {
/// Lists the identities available for signing operations
/// - Returns: An OpenSSH formatted Data payload listing the identities available for signing operations.
func identities() -> Data {
let secrets = storeList.stores.flatMap(\.secrets)
var count = UInt32(secrets.count).bigEndian
@ -81,6 +94,11 @@ extension Agent {
return countData + keyData
}
/// Notifies witnesses of a pending signature request, and performs the signing operation if none object.
/// - Parameters:
/// - data: The data to sign.
/// - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request.
/// - Returns: An OpenSSH formatted Data payload containing the signed data response.
func sign(data: Data, provenance: SigningRequestProvenance) throws -> Data {
let reader = OpenSSHReader(data: data)
let hash = reader.readNextChunk()
@ -148,6 +166,9 @@ extension Agent {
extension Agent {
/// Finds a ``Secret`` matching a specified hash whos signature was requested.
/// - Parameter hash: The hash to match against.
/// - Returns: A ``Secret`` and the ``SecretStore`` containing it, if a match is found.
func secret(matching hash: Data) -> (AnySecretStore, AnySecret)? {
storeList.stores.compactMap { store -> (AnySecretStore, AnySecret)? in
let allMatching = store.secrets.filter { secret in
@ -165,6 +186,7 @@ extension Agent {
extension Agent {
/// An error involving agent operations..
enum AgentError: Error {
case unhandledType
case noMatchingKey

23
Sources/Packages/Sources/SecretAgentKit/Documentation.docc/Documentation.md Normal file
View File

@ -0,0 +1,23 @@
# ``SecretAgentKit``
SecretAgentKit is a collection of types that allow SecretAgent to conform to the SSH agent protocol.
## Topics
### Agent
- ``Agent``
### Protocol
- ``SSHAgent``
### Request Notification
- ``SigningWitness``
### Socket Operations
- ``SocketController``
- ``FileHandleReader``
- ``FileHandleWriter``

6
SecretAgentKit/FileHandleProtocols.swift → Sources/Packages/Sources/SecretAgentKit/FileHandleProtocols.swift
View File

@ -1,15 +1,21 @@
import Foundation
/// Protocol abstraction of the reading aspects of FileHandle.
public protocol FileHandleReader {
/// Gets data that is available for reading.
var availableData: Data { get }
/// A file descriptor of the handle.
var fileDescriptor: Int32 { get }
/// The process ID of the process coonnected to the other end of the FileHandle.
var pidOfConnectedProcess: Int32 { get }
}
/// Protocol abstraction of the writing aspects of FileHandle.
public protocol FileHandleWriter {
/// Writes data to the handle.
func write(_ data: Data)
}

5
SecretAgentKit/SSHAgentProtocol.swift → Sources/Packages/Sources/SecretAgentKit/SSHAgentProtocol.swift
View File

@ -1,10 +1,13 @@
import Foundation
/// A namespace for the SSH Agent Protocol, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html
public enum SSHAgent {}
extension SSHAgent {
/// The type of the SSH Agent Request, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html#rfc.section.5.1
public enum RequestType: UInt8, CustomDebugStringConvertible {
case requestIdentities = 11
case signRequest = 13
@ -18,7 +21,9 @@ extension SSHAgent {
}
}
/// The type of the SSH Agent Response, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html#rfc.section.5.1
public enum ResponseType: UInt8, CustomDebugStringConvertible {
case agentFailure = 5
case agentIdentitiesAnswer = 12
case agentSignResponse = 14

17
SecretAgentKit/SigningRequestTracer.swift → Sources/Packages/Sources/SecretAgentKit/SigningRequestTracer.swift
View File

@ -2,12 +2,17 @@ import Foundation
import AppKit
import Security
import SecretKit
import SecretAgentKitHeaders
/// An object responsible for generating ``SecretKit.SigningRequestProvenance`` objects.
struct SigningRequestTracer {
}
extension SigningRequestTracer {
/// Generates a ``SecretKit.SigningRequestProvenance`` from a ``FileHandleReader``.
/// - Parameter fileHandleReader: The reader involved in processing the request.
/// - Returns: A ``SecretKit.SigningRequestProvenance`` describing the origin of the request.
func provenance(from fileHandleReader: FileHandleReader) -> SigningRequestProvenance {
let firstInfo = process(from: fileHandleReader.pidOfConnectedProcess)
@ -18,6 +23,9 @@ extension SigningRequestTracer {
return provenance
}
/// Generates a `kinfo_proc` representation of the provided process ID.
/// - Parameter pid: The process ID to look up.
/// - Returns: a `kinfo_proc` struct describing the process ID.
func pidAndNameInfo(from pid: Int32) -> kinfo_proc {
var len = MemoryLayout<kinfo_proc>.size
let infoPointer = UnsafeMutableRawPointer.allocate(byteCount: len, alignment: 1)
@ -26,6 +34,9 @@ extension SigningRequestTracer {
return infoPointer.load(as: kinfo_proc.self)
}
/// Generates a ``SecretKit.SigningRequestProvenance.Process`` from a provided process ID.
/// - Parameter pid: The process ID to look up.
/// - Returns: A ``SecretKit.SigningRequestProvenance.Process`` describing the process.
func process(from pid: Int32) -> SigningRequestProvenance.Process {
var pidAndNameInfo = self.pidAndNameInfo(from: pid)
let ppid = pidAndNameInfo.kp_eproc.e_ppid != 0 ? pidAndNameInfo.kp_eproc.e_ppid : nil
@ -40,6 +51,9 @@ extension SigningRequestTracer {
return SigningRequestProvenance.Process(pid: pid, processName: procName, appName: appName(for: pid), iconURL: iconURL(for: pid), path: path, validSignature: valid, parentPID: ppid)
}
/// Looks up the URL for the icon of a process ID, if it has one.
/// - Parameter pid: The process ID to look up.
/// - Returns: A URL to the icon, if the process has one.
func iconURL(for pid: Int32) -> URL? {
do {
if let app = NSRunningApplication(processIdentifier: pid), let icon = app.icon?.tiffRepresentation {
@ -53,6 +67,9 @@ extension SigningRequestTracer {
return nil
}
/// Looks up the application name of a process ID, if it has one.
/// - Parameter pid: The process ID to look up.
/// - Returns: The process's display name, if the process has one.
func appName(for pid: Int32) -> String? {
NSRunningApplication(processIdentifier: pid)?.localizedName
}

23
Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift Normal file
View File

@ -0,0 +1,23 @@
import Foundation
import SecretKit
/// A protocol that allows conformers to be notified of access to secrets, and optionally prevent access.
public protocol SigningWitness {
/// A ridiculously named method that notifies the callee that a signing operation is about to be performed using a secret. The callee may `throw` an `Error` to prevent access from occurring.
/// - Parameters:
/// - secret: The `Secret` that will be used to sign the request.
/// - store: The `Store` being asked to sign the request..
/// - provenance: A `SigningRequestProvenance` object describing the origin of the request.
/// - Note: This method being called does not imply that the requst has been authorized. If a secret requires authentication, authentication will still need to be performed by the user before the request will be performed. If the user declines or fails to authenticate, the request will fail.
func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws
/// Notifies the callee that a signing operation has been performed for a given secret.
/// - Parameters:
/// - secret: The `Secret` that will was used to sign the request.
/// - store: The `Store` that signed the request..
/// - provenance: A `SigningRequestProvenance` object describing the origin of the request.
/// - requiredAuthentication: A boolean describing whether or not authentication was required for the request.
func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) throws
}

17
SecretAgentKit/SocketController.swift → Sources/Packages/Sources/SecretAgentKit/SocketController.swift
View File

@ -1,12 +1,20 @@
import Foundation
import OSLog
/// A controller that manages socket configuration and request dispatching.
public class SocketController {
/// The active FileHandle.
private var fileHandle: FileHandle?
/// The active SocketPort.
private var port: SocketPort?
/// A handler that will be notified when a new read/write handle is available.
/// False if no data could be read
public var handler: ((FileHandleReader, FileHandleWriter) -> Bool)?
d)?
/// Initializes a socket controller with a specified path.
/// - Parameter path: The path to use as a socket.
public init(path: String) {
Logger().debug("Socket controller setting up at \(path)")
if let _ = try? FileManager.default.removeItem(atPath: path) {
@ -20,6 +28,8 @@ public class SocketController {
Logger().debug("Socket listening at \(path)")
}
/// Configures the socket and a corresponding FileHandle.
/// - Parameter path: The path to use as a socket.
func configureSocket(at path: String) {
guard let port = port else { return }
fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
@ -28,6 +38,9 @@ public class SocketController {
fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
}
/// Creates a SocketPort for a path.
/// - Parameter path: The path to use as a socket.
/// - Returns: A configured SocketPort.
func socketPort(at path: String) -> SocketPort {
var addr = sockaddr_un()
addr.sun_family = sa_family_t(AF_UNIX)
@ -49,6 +62,8 @@ public class SocketController {
return SocketPort(protocolFamily: AF_UNIX, socketType: SOCK_STREAM, protocol: 0, address: data)!
}
/// Handles a new connection being accepted, invokes the handler, and prepares to accept new connections.
/// - Parameter notification: A `Notification` that triggered the call.
@objc func handleConnectionAccept(notification: Notification) {
Logger().debug("Socket controller accepted connection")
guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { return }
@ -57,6 +72,8 @@ public class SocketController {
fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
}
/// Handles a new connection providing data and invokes the handler callback.
/// - Parameter notification: A `Notification` that triggered the call.
@objc func handleConnectionDataAvailable(notification: Notification) {
Logger().debug("Socket controller has new data available")
guard let new = notification.object as? FileHandle else { return }

1
Sources/Packages/Sources/SecretAgentKitHeaders/Stub.swift Normal file
View File

@ -0,0 +1 @@

0
SecretAgentKit/SecretAgentKit.h → Sources/Packages/Sources/SecretAgentKitHeaders/include/SecretAgentKit.h
View File

4
Sources/Packages/Sources/SecretAgentKitHeaders/module.modulemap Normal file
View File

@ -0,0 +1,4 @@
module SecretAgentKitHeaders [system] {
header "include/SecretAgentKit.h"
export *
}

31
Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md Normal file
View File

@ -0,0 +1,31 @@
# ``SecretKit``
SecretKit is a collection of protocols describing secrets and stores.
## Topics
### Base Protocols
- ``Secret``
- ``SecretStore``
- ``SecretStoreModifiable``
### Store List
- ``SecretStoreList``
### Type Erasers
- ``AnySecret``
- ``AnySecretStore``
- ``AnySecretStoreModifiable``
### OpenSSH
- ``OpenSSHKeyWriter``
- ``OpenSSHReader``
### Signing Process
- ``SignedData``
- ``SigningRequestProvenance``

1
SecretKit/Common/Erasers/AnySecret.swift → Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift
View File

@ -1,5 +1,6 @@
import Foundation
/// Type eraser for Secret.
public struct AnySecret: Secret {
let base: Any

1
SecretKit/Common/Erasers/AnySecretStore.swift → Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift
View File

@ -1,6 +1,7 @@
import Foundation
import Combine
/// Type eraser for SecretStore.
public class AnySecretStore: SecretStore {
let base: Any

39
SecretKit/Common/OpenSSH/OpenSSHKeyWriter.swift → Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift
View File

@ -1,24 +1,31 @@
import Foundation
import CryptoKit
// For the moment, only supports ecdsa-sha2-nistp256 and ecdsa-sha2-nistp386 keys
/// Generates OpenSSH representations of Secrets.
public struct OpenSSHKeyWriter {
/// Initializes the writer.
public init() {
}
/// Generates an OpenSSH data payload identifying the secret.
/// - Returns: OpenSSH data payload identifying the secret.
public func data<SecretType: Secret>(secret: SecretType) -> Data {
lengthAndData(of: curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
lengthAndData(of: curveIdentifier(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
lengthAndData(of: secret.publicKey)
}
/// Generates an OpenSSH string representation of the secret.
/// - Returns: OpenSSH string representation of the secret.
public func openSSHString<SecretType: Secret>(secret: SecretType, comment: String? = nil) -> String {
[curveType(for: secret.algorithm, length: secret.keySize), data(secret: secret).base64EncodedString(), comment]
.compactMap { $0 }
.joined(separator: " ")
}
/// Generates an OpenSSH SHA256 fingerprint string.
/// - Returns: OpenSSH SHA256 fingerprint string.
public func openSSHSHA256Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
// OpenSSL format seems to strip the padding at the end.
let base64 = Data(SHA256.hash(data: data(secret: secret))).base64EncodedString()
@ -27,6 +34,8 @@ public struct OpenSSHKeyWriter {
return "SHA256:\(cleaned)"
}
/// Generates an OpenSSH MD5 fingerprint string.
/// - Returns: OpenSSH MD5 fingerprint string.
public func openSSHMD5Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
Insecure.MD5.hash(data: data(secret: secret))
.compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
@ -37,23 +46,37 @@ public struct OpenSSHKeyWriter {
extension OpenSSHKeyWriter {
/// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
/// - Parameter data: The data payload.
/// - Returns: OpenSSH data.
public func lengthAndData(of data: Data) -> Data {
let rawLength = UInt32(data.count)
var endian = rawLength.bigEndian
return Data(bytes: &endian, count: UInt32.bitWidth/8) + data
}
public func curveIdentifier(for algorithm: Algorithm, length: Int) -> String {
switch algorithm {
case .ellipticCurve:
return "nistp" + String(describing: length)
}
}
/// The fully qualified OpenSSH identifier for the algorithm.
/// - Parameters:
/// - algorithm: The algorithm to identify.
/// - length: The key length of the algorithm.
/// - Returns: The OpenSSH identifier for the algorithm.
public func curveType(for algorithm: Algorithm, length: Int) -> String {
switch algorithm {
case .ellipticCurve:
return "ecdsa-sha2-nistp" + String(describing: length)
}
}
/// The OpenSSH identifier for an algorithm.
/// - Parameters:
/// - algorithm: The algorithm to identify.
/// - length: The key length of the algorithm.
/// - Returns: The OpenSSH identifier for the algorithm.
private func curveIdentifier(for algorithm: Algorithm, length: Int) -> String {
switch algorithm {
case .ellipticCurve:
return "nistp" + String(describing: length)
}
}
}

5
SecretKit/Common/OpenSSH/OpenSSHReader.swift → Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHReader.swift
View File

@ -1,13 +1,18 @@
import Foundation
/// Reads OpenSSH protocol data.
public class OpenSSHReader {
var remaining: Data
/// Initialize the reader with an OpenSSH data payload.
/// - Parameter data: The data to read.
public init(data: Data) {
remaining = Data(data)
}
/// Reads the next chunk of data from the playload.
/// - Returns: The next chunk of data.
public func readNextChunk() -> Data {
let lengthRange = 0..<(UInt32.bitWidth/8)
let lengthChunk = remaining[lengthRange]

41
Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift Normal file
View File

@ -0,0 +1,41 @@
import Foundation
import OSLog
/// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
public class PublicKeyFileStoreController {
private let logger = Logger()
private let directory: String
/// Initializes a PublicKeyFileStoreController.
public init(homeDirectory: String) {
directory = homeDirectory.appending("/PublicKeys")
}
/// Writes out the keys specified to disk.
/// - Parameter secrets: The Secrets to generate keys for.
/// - Parameter clear: Whether or not the directory should be erased before writing keys.
public func generatePublicKeys(for secrets: [AnySecret], clear: Bool = false) throws {
logger.log("Writing public keys to disk")
if clear {
try? FileManager.default.removeItem(at: URL(fileURLWithPath: directory))
}
try? FileManager.default.createDirectory(at: URL(fileURLWithPath: directory), withIntermediateDirectories: false, attributes: nil)
let keyWriter = OpenSSHKeyWriter()
for secret in secrets {
let path = path(for: secret)
guard let data = keyWriter.openSSHString(secret: secret).data(using: .utf8) else { continue }
FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
}
logger.log("Finished writing public keys")
}
/// The path for a Secret's public key.
/// - Parameter secret: The Secret to return the path for.
/// - Returns: The path to the Secret's public key.
/// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
public func path<SecretType: Secret>(for secret: SecretType) -> String {
directory.appending("/").appending("\(secret.name.replacingOccurrences(of: " ", with: "-")).pub")
}
}

7
SecretKit/Common/SecretStoreList.swift → Sources/Packages/Sources/SecretKit/SecretStoreList.swift
View File

@ -1,25 +1,32 @@
import Foundation
import Combine
/// A "Store Store," which holds a list of type-erased stores.
public class SecretStoreList: ObservableObject {
/// The Stores managed by the SecretStoreList.
@Published public var stores: [AnySecretStore] = []
/// A modifiable store, if one is available.
@Published public var modifiableStore: AnySecretStoreModifiable?
private var sinks: [AnyCancellable] = []
/// Initializes a SecretStoreList.
public init() {
}
/// Adds a non-type-erased SecretStore to the list.
public func add<SecretStoreType: SecretStore>(store: SecretStoreType) {
addInternal(store: AnySecretStore(store))
}
/// Adds a non-type-erased modifiable SecretStore.
public func add<SecretStoreType: SecretStoreModifiable>(store: SecretStoreType) {
let modifiable = AnySecretStoreModifiable(modifiable: store)
modifiableStore = modifiable
addInternal(store: modifiable)
}
/// A boolean describing whether there are any Stores available.
public var anyAvailable: Bool {
stores.reduce(false, { $0 || $1.isAvailable })
}

12
SecretKit/Common/Types/Secret.swift → Sources/Packages/Sources/SecretKit/Types/Secret.swift
View File

@ -1,14 +1,26 @@
import Foundation
/// The base protocol for describing a Secret
public protocol Secret: Identifiable, Hashable {
/// A user-facing string identifying the Secret.
var name: String { get }
/// The algorithm this secret uses.
var algorithm: Algorithm { get }
/// The key size for the secret.
var keySize: Int { get }
/// The public key data for the secret.
var publicKey: Data { get }
}
/// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported.
public enum Algorithm: Hashable {
case ellipticCurve
/// Initializes the Algorithm with a secAttr representation of an algorithm.
/// - Parameter secAttr: the secAttr, represented as an NSNumber.
public init(secAttr: NSNumber) {
let secAttrString = secAttr.stringValue as CFString
switch secAttrString {

61
Sources/Packages/Sources/SecretKit/Types/SecretStore.swift Normal file
View File

@ -0,0 +1,61 @@
import Foundation
import Combine
/// Manages access to Secrets, and performs signature operations on data using those Secrets.
public protocol SecretStore: ObservableObject, Identifiable {
associatedtype SecretType: Secret
/// A boolean indicating whether or not the store is available.
var isAvailable: Bool { get }
/// A unique identifier for the store.
var id: UUID { get }
/// A user-facing name for the store.
var name: String { get }
/// The secrets the store manages.
var secrets: [SecretType] { get }
/// Signs a data payload with a specified Secret.
/// - Parameters:
/// - data: The data to sign.
/// - secret: The ``Secret`` to sign with.
/// - provenance: A ``SigningRequestProvenance`` describing where the request came from.
/// - Returns: A ``SignedData`` object, containing the signature and metadata about the signature process.
func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> SignedData
/// Persists user authorization for access to a secret.
/// - Parameters:
/// - secret: The ``Secret`` to persist the authorization for.
/// - duration: The duration that the authorization should persist for.
/// - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret.
func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) throws
}
/// A SecretStore that the Secretive admin app can modify.
public protocol SecretStoreModifiable: SecretStore {
/// Creates a new ``Secret`` in the store.
/// - Parameters:
/// - name: The user-facing name for the ``Secret``.
/// - requiresAuthentication: A boolean indicating whether or not the user will be required to authenticate before performing signature operations with the secret.
func create(name: String, requiresAuthentication: Bool) throws
/// Deletes a Secret in the store.
/// - Parameters:
/// - secret: The ``Secret`` to delete.
func delete(secret: SecretType) throws
/// Updates the name of a Secret in the store.
/// - Parameters:
/// - secret: The ``Secret`` to update.
/// - name: The new name for the Secret.
func update(secret: SecretType, name: String) throws
}
extension NSNotification.Name {
public static let secretStoreUpdated = NSNotification.Name("com.maxgoedjen.Secretive.secretStore.updated")
}

20
Sources/Packages/Sources/SecretKit/Types/SignedData.swift Normal file
View File

@ -0,0 +1,20 @@
import Foundation
/// Describes the output of a sign request.
public struct SignedData {
/// The signed data.
public let data: Data
/// A boolean describing whether authentication was required during the signature process.
public let requiredAuthentication: Bool
/// Initializes a new SignedData.
/// - Parameters:
/// - data: The signed data.
/// - requiredAuthentication: A boolean describing whether authentication was required during the signature process.
public init(data: Data, requiredAuthentication: Bool) {
self.data = data
self.requiredAuthentication = requiredAuthentication
}
}

76
Sources/Packages/Sources/SecretKit/Types/SigningRequestProvenance.swift Normal file
View File

@ -0,0 +1,76 @@
import Foundation
import AppKit
/// Describes the chain of applications that requested a signature operation.
public struct SigningRequestProvenance: Equatable {
/// A list of processes involved in the request.
/// - Note: A chain will typically consist of many elements even for a simple request. For example, running `git fetch` in Terminal.app would generate a request chain of `ssh` -> `git` -> `zsh` -> `login` -> `Terminal.app`
public var chain: [Process]
public init(root: Process) {
self.chain = [root]
}
}
extension SigningRequestProvenance {
/// The `Process` which initiated the signing request.
public var origin: Process {
chain.last!
}
/// A boolean describing whether all processes in the request chain had a valid code signature.
public var intact: Bool {
chain.allSatisfy { $0.validSignature }
}
}
extension SigningRequestProvenance {
/// Describes a process in a `SigningRequestProvenance` chain.
public struct Process: Equatable {
/// The pid of the process.
public let pid: Int32
/// A user-facing name for the process.
public let processName: String
/// A user-facing name for the application, if one exists.
public let appName: String?
/// An icon representation of the application, if one exists.
public let iconURL: URL?
/// The path the process exists at.
public let path: String
/// A boolean describing whether or not the process has a valid code signature.
public let validSignature: Bool
/// The pid of the process's parent.
public let parentPID: Int32?
/// Initializes a Process.
/// - Parameters:
/// - pid: The pid of the process.
/// - processName: A user-facing name for the process.
/// - appName: A user-facing name for the application, if one exists.
/// - iconURL: An icon representation of the application, if one exists.
/// - path: The path the process exists at.
/// - validSignature: A boolean describing whether or not the process has a valid code signature.
/// - parentPID: The pid of the process's parent.
public init(pid: Int32, processName: String, appName: String?, iconURL: URL?, path: String, validSignature: Bool, parentPID: Int32?) {
self.pid = pid
self.processName = processName
self.appName = appName
self.iconURL = iconURL
self.path = path
self.validSignature = validSignature
self.parentPID = parentPID
}
/// The best user-facing name to display for the process.
public var displayName: String {
appName ?? processName
}
}
}

3
Sources/Packages/Sources/SecureEnclaveSecretKit/Documentation.docc/Documentation.md Normal file
View File

@ -0,0 +1,3 @@
# ``SecureEnclaveSecretKit``
SecureEnclaveSecretKit contains implementations of SecretKit protocols backed by the Secure Enclave.

14
Sources/Packages/Sources/SecureEnclaveSecretKit/Documentation.docc/SecureEnclave.md Normal file
View File

@ -0,0 +1,14 @@
# ``SecureEnclaveSecretKit/SecureEnclave``
## Topics
### Implementations
- ``Secret``
- ``Store``
### Errors
- ``KeychainError``
- ``SigningError``
- ``SecurityError``

2
Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclave.swift Normal file
View File

@ -0,0 +1,2 @@
/// Namespace for the Secure Enclave implementations.
public enum SecureEnclave {}

2
SecretKit/SecureEnclave/SecureEnclaveSecret.swift → Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveSecret.swift
View File

@ -1,8 +1,10 @@
import Foundation
import Combine
import SecretKit
extension SecureEnclave {
/// An implementation of Secret backed by the Secure Enclave.
public struct Secret: SecretKit.Secret {
public let id: Data

45
SecretKit/SecureEnclave/SecureEnclaveStore.swift → Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift
View File

@ -2,9 +2,11 @@ import Foundation
import Security
import CryptoTokenKit
import LocalAuthentication
import SecretKit
extension SecureEnclave {
/// An implementation of Store backed by the Secure Enclave.
public class Store: SecretStoreModifiable {
public var isAvailable: Bool {
@ -19,6 +21,7 @@ extension SecureEnclave {
private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:]
/// Initializes a Store.
public init() {
DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { _ in
self.reloadSecrets(notify: false)
@ -56,13 +59,15 @@ extension SecureEnclave {
]
] as CFDictionary
var privateKey: SecKey? = nil
var publicKey: SecKey? = nil
let status = SecKeyGeneratePair(attributes, &publicKey, &privateKey)
guard privateKey != nil, let pk = publicKey else {
throw KeychainError(statusCode: status)
var createKeyError: SecurityError?
let keypair = SecKeyCreateRandomKey(attributes, &createKeyError)
if let error = createKeyError {
throw error.takeRetainedValue() as Error
}
try savePublicKey(pk, name: name)
guard let keypair = keypair, let publicKey = SecKeyCopyPublicKey(keypair) else {
throw KeychainError(statusCode: nil)
}
try savePublicKey(publicKey, name: name)
reloadSecrets()
}
@ -94,7 +99,7 @@ extension SecureEnclave {
}
reloadSecrets()
}
public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> SignedData {
let context: LAContext
if let existing = persistedAuthenticationContexts[secret], existing.valid {
@ -140,6 +145,7 @@ extension SecureEnclave {
public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) throws {
let newContext = LAContext()
newContext.touchIDAuthenticationAllowableReuseDuration = duration
newContext.localizedCancelTitle = "Deny"
let formatter = DateComponentsFormatter()
@ -164,6 +170,8 @@ extension SecureEnclave {
extension SecureEnclave.Store {
/// Reloads all secrets from the store.
/// - Parameter notify: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
private func reloadSecrets(notify: Bool = true) {
secrets.removeAll()
loadSecrets()
@ -172,6 +180,7 @@ extension SecureEnclave.Store {
}
}
/// Loads all secrets from the store.
private func loadSecrets() {
let attributes = [
kSecClass: kSecClassKey,
@ -196,6 +205,10 @@ extension SecureEnclave.Store {
secrets.append(contentsOf: wrapped)
}
/// Saves a public key.
/// - Parameters:
/// - publicKey: The public key to save.
/// - name: A user-facing name for the key.
private func savePublicKey(_ publicKey: SecKey, name: String) throws {
let attributes = [
kSecClass: kSecClassKey,
@ -217,11 +230,15 @@ extension SecureEnclave.Store {
extension SecureEnclave {
/// A wrapper around an error code reported by a Keychain API.
public struct KeychainError: Error {
public let statusCode: OSStatus
/// The status code involved, if one was reported.
public let statusCode: OSStatus?
}
/// A signing-related error.
public struct SigningError: Error {
/// The underlying error reported by the API, if one was returned.
public let error: SecurityError?
}
@ -245,13 +262,22 @@ extension SecureEnclave {
extension SecureEnclave {
/// A context describing a persisted authentication.
private struct PersistentAuthenticationContext {
/// The Secret to persist authentication for.
let secret: Secret
/// The LAContext used to authorize the persistent context.
let context: LAContext
// Monotonic time instead of Date() to prevent people setting the clock back.
/// An expiration date for the context.
/// - Note - Monotonic time instead of Date() to prevent people setting the clock back.
let expiration: UInt64
/// Initializes a context.
/// - Parameters:
/// - secret: The Secret to persist authentication for.
/// - context: The LAContext used to authorize the persistent context.
/// - duration: The duration of the authorization context, in seconds.
init(secret: Secret, context: LAContext, duration: TimeInterval) {
self.secret = secret
self.context = context
@ -259,6 +285,7 @@ extension SecureEnclave {
self.expiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
}
/// A boolean describing whether or not the context is still valid.
var valid: Bool {
clock_gettime_nsec_np(CLOCK_MONOTONIC) < expiration
}

3
Sources/Packages/Sources/SmartCardSecretKit/Documentation.docc/Documentation.md Normal file
View File

@ -0,0 +1,3 @@
# ``SmartCardSecretKit``
SmartCardSecretKit contains implementations of SecretKit protocols backed by a Smart Card.

14
Sources/Packages/Sources/SmartCardSecretKit/Documentation.docc/SmartCard.md Normal file
View File

@ -0,0 +1,14 @@
# ``SmartCardSecretKit/SmartCard``
## Topics
### Implementations
- ``Secret``
- ``Store``
### Errors
- ``KeychainError``
- ``SigningError``
- ``SecurityError``

2
Sources/Packages/Sources/SmartCardSecretKit/SmartCard.swift Normal file
View File

@ -0,0 +1,2 @@
/// Namespace for the Smart Card implementations.
public enum SmartCard {}

2
SecretKit/SmartCard/SmartCardSecret.swift → Sources/Packages/Sources/SmartCardSecretKit/SmartCardSecret.swift
View File

@ -1,8 +1,10 @@
import Foundation
import Combine
import SecretKit
extension SmartCard {
/// An implementation of Secret backed by a Smart Card.
public struct Secret: SecretKit.Secret {
public let id: Data

18
SecretKit/SmartCard/SmartCardStore.swift → Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift
View File

@ -2,11 +2,11 @@ import Foundation
import Security
import CryptoTokenKit
import LocalAuthentication
import SecretKit
// TODO: Might need to split this up into "sub-stores?"
// ie, each token has its own Store.
extension SmartCard {
/// An implementation of Store backed by a Smart Card.
public class Store: SecretStore {
@Published public var isAvailable: Bool = false
@ -16,6 +16,7 @@ extension SmartCard {
private let watcher = TKTokenWatcher()
private var tokenID: String?
/// Initializes a Store.
public init() {
tokenID = watcher.nonSecureEnclaveTokens.first
watcher.setInsertionHandler { string in
@ -55,7 +56,7 @@ extension SmartCard {
kSecAttrTokenID: tokenID,
kSecUseAuthenticationContext: context,
kSecReturnRef: true
] as CFDictionary
] as CFDictionary
var untyped: CFTypeRef?
let status = SecItemCopyMatching(attributes, &untyped)
if status != errSecSuccess {
@ -90,11 +91,14 @@ extension SmartCard {
extension SmartCard.Store {
/// Resets the token ID and reloads secrets.
/// - Parameter tokenID: The ID of the token that was removed.
private func smartcardRemoved(for tokenID: String? = nil) {
self.tokenID = nil
reloadSecrets()
}
/// Reloads all secrets from the store.
private func reloadSecrets() {
DispatchQueue.main.async {
self.isAvailable = self.tokenID != nil
@ -103,6 +107,7 @@ extension SmartCard.Store {
}
}
/// Loads all secrets from the store.
private func loadSecrets() {
guard let tokenID = tokenID else { return }
@ -130,7 +135,7 @@ extension SmartCard.Store {
kSecReturnRef: true,
kSecMatchLimit: kSecMatchLimitAll,
kSecReturnAttributes: true
] as CFDictionary
] as CFDictionary
var untyped: CFTypeRef?
SecItemCopyMatching(attributes, &untyped)
guard let typed = untyped as? [[CFString: Any]] else { return }
@ -152,6 +157,7 @@ extension SmartCard.Store {
extension TKTokenWatcher {
/// All available tokens, excluding the Secure Enclave.
fileprivate var nonSecureEnclaveTokens: [String] {
tokenIDs.filter { !$0.contains("setoken") }
}
@ -160,11 +166,15 @@ extension TKTokenWatcher {
extension SmartCard {
/// A wrapper around an error code reported by a Keychain API.
public struct KeychainError: Error {
/// The status code involved.
public let statusCode: OSStatus
}
/// A signing-related error.
public struct SigningError: Error {
/// The underlying error reported by the API, if one was returned.
public let error: SecurityError?
}

0
BriefTests/ReleaseParsingTests.swift → Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift
View File

0
BriefTests/SemVerTests.swift → Sources/Packages/Tests/BriefTests/SemVerTests.swift
View File

0
SecretAgentKitTests/AgentTests.swift → Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift
View File

0
SecretAgentKitTests/StubFileHandleReader.swift → Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleReader.swift
View File

1
SecretAgentKitTests/StubFileHandleWriter.swift → Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift
View File

@ -1,3 +1,4 @@
import Foundation
import SecretAgentKit
class StubFileHandleWriter: FileHandleWriter {

1
SecretAgentKitTests/StubStore.swift → Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift
View File

@ -1,3 +1,4 @@
import Foundation
import SecretKit
import CryptoKit

0
SecretAgentKitTests/StubWitness.swift → Sources/Packages/Tests/SecretAgentKitTests/StubWitness.swift
View File

2
SecretKitTests/AnySecretTests.swift → Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift
View File

@ -1,6 +1,8 @@
import Foundation
import XCTest
@testable import SecretKit
@testable import SecureEnclaveSecretKit
@testable import SmartCardSecretKit
class AnySecretTests: XCTestCase {

2
SecretKitTests/OpenSSHReaderTests.swift → Sources/Packages/Tests/SecretKitTests/OpenSSHReaderTests.swift
View File

@ -1,6 +1,8 @@
import Foundation
import XCTest
@testable import SecretKit
@testable import SecureEnclaveSecretKit
@testable import SmartCardSecretKit
class OpenSSHReaderTests: XCTestCase {

2
SecretKitTests/OpenSSHWriterTests.swift → Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift
View File

@ -1,6 +1,8 @@
import Foundation
import XCTest
@testable import SecretKit
@testable import SecureEnclaveSecretKit
@testable import SmartCardSecretKit
class OpenSSHWriterTests: XCTestCase {

8
SecretAgent/AppDelegate.swift → Sources/SecretAgent/AppDelegate.swift
View File

@ -2,6 +2,8 @@ import Cocoa
import OSLog
import Combine
import SecretKit
import SecureEnclaveSecretKit
import SmartCardSecretKit
import SecretAgentKit
import Brief
@ -16,6 +18,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
}()
private let updater = Updater(checkOnLaunch: false)
private let notifier = Notifier()
private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
private lazy var agent: Agent = {
Agent(storeList: storeList, witness: notifier)
}()
@ -30,6 +33,10 @@ class AppDelegate: NSObject, NSApplicationDelegate {
DispatchQueue.main.async {
self.socketController.handler = self.agent.handle(reader:writer:)
}
DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { [self] _ in
try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
}
try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
notifier.prompt()
updateSink = updater.$update.sink { update in
guard let update = update else { return }
@ -37,6 +44,5 @@ class AppDelegate: NSObject, NSApplicationDelegate {
}
}
}

0
SecretAgent/Assets.xcassets/AppIcon.appiconset/Contents.json → Sources/SecretAgent/Assets.xcassets/AppIcon.appiconset/Contents.json
View File

0
SecretAgent/Assets.xcassets/AppIcon.appiconset/Mac Icon.png → Sources/SecretAgent/Assets.xcassets/AppIcon.appiconset/Mac Icon.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 16 KiB

After

Width:  |  Height:  |  Size: 16 KiB

0
SecretAgent/Assets.xcassets/AppIcon.appiconset/Mac Icon@0.25x.png → Sources/SecretAgent/Assets.xcassets/AppIcon.appiconset/Mac Icon@0.25x.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 40 KiB

After

Width:  |  Height:  |  Size: 40 KiB

0
SecretAgent/Assets.xcassets/Contents.json → Sources/SecretAgent/Assets.xcassets/Contents.json
View File

0
SecretAgent/Base.lproj/Main.storyboard → Sources/SecretAgent/Base.lproj/Main.storyboard
View File

0
SecretAgent/Info.plist → Sources/SecretAgent/Info.plist
View File

0
SecretAgent/InternetAccessPolicy.plist → Sources/SecretAgent/InternetAccessPolicy.plist
View File

0
SecretAgent/Notifier.swift → Sources/SecretAgent/Notifier.swift
View File

0
SecretAgent/Preview Content/Preview Assets.xcassets/Contents.json → Sources/SecretAgent/Preview Content/Preview Assets.xcassets/Contents.json
View File

0
SecretAgent/SecretAgent.entitlements → Sources/SecretAgent/SecretAgent.entitlements
View File

1027
Sources/Secretive.xcodeproj/project.pbxproj Normal file
View File

File diff suppressed because it is too large Load Diff

0
Secretive.xcodeproj/project.xcworkspace/contents.xcworkspacedata → Sources/Secretive.xcodeproj/project.xcworkspace/contents.xcworkspacedata generated
View File

0
Secretive.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist → Sources/Secretive.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist
View File

2
Secretive.xcodeproj/xcshareddata/xcschemes/SecretAgent.xcscheme → Sources/Secretive.xcodeproj/xcshareddata/xcschemes/SecretAgent.xcscheme
View File

@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1140"
LastUpgradeVersion = "1320"
version = "1.7">
<BuildAction
parallelizeBuildables = "YES"

2
Secretive.xcodeproj/xcshareddata/xcschemes/Secretive.xcscheme → Sources/Secretive.xcodeproj/xcshareddata/xcschemes/Secretive.xcscheme
View File

@ -1,6 +1,6 @@
<?xml version="1.0" encoding="UTF-8"?>
<Scheme
LastUpgradeVersion = "1140"
LastUpgradeVersion = "1320"
version = "1.7">
<BuildAction
parallelizeBuildables = "YES"

4
Secretive/App.swift → Sources/Secretive/App.swift
View File

@ -1,6 +1,8 @@
import Cocoa
import SwiftUI
import SecretKit
import SecureEnclaveSecretKit
import SmartCardSecretKit
import Brief
@main
@ -36,7 +38,7 @@ struct Secretive: App {
if agentStatusChecker.running && justUpdatedChecker.justUpdated {
// Relaunch the agent, since it'll be running from earlier update still
reinstallAgent()
} else if !agentStatusChecker.running {
} else if !agentStatusChecker.running && !agentStatusChecker.developmentBuild {
forceLaunchAgent()
}
}

0
Secretive/Assets.xcassets/AppIcon.appiconset/Contents.json → Sources/Secretive/Assets.xcassets/AppIcon.appiconset/Contents.json
View File

0
Secretive/Assets.xcassets/AppIcon.appiconset/Mac Icon.png → Sources/Secretive/Assets.xcassets/AppIcon.appiconset/Mac Icon.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 16 KiB

After

Width:  |  Height:  |  Size: 16 KiB

0
Secretive/Assets.xcassets/AppIcon.appiconset/Mac Icon@0.25x.png → Sources/Secretive/Assets.xcassets/AppIcon.appiconset/Mac Icon@0.25x.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 40 KiB

After

Width:  |  Height:  |  Size: 40 KiB

0
Secretive/Assets.xcassets/Contents.json → Sources/Secretive/Assets.xcassets/Contents.json
View File

7
Secretive/Controllers/AgentStatusChecker.swift → Sources/Secretive/Controllers/AgentStatusChecker.swift
View File

@ -5,6 +5,7 @@ import SecretKit
protocol AgentStatusCheckerProtocol: ObservableObject {
var running: Bool { get }
var developmentBuild: Bool { get }
}
class AgentStatusChecker: ObservableObject, AgentStatusCheckerProtocol {
@ -36,6 +37,12 @@ class AgentStatusChecker: ObservableObject, AgentStatusCheckerProtocol {
return nil
}
// Whether Secretive is being run in an Xcode environment.
var developmentBuild: Bool {
Bundle.main.bundleURL.absoluteString.contains("/Library/Developer/Xcode")
}
}

0
Secretive/Controllers/ApplicationDirectoryController.swift → Sources/Secretive/Controllers/ApplicationDirectoryController.swift
View File

0
Secretive/Controllers/JustUpdatedChecker.swift → Sources/Secretive/Controllers/JustUpdatedChecker.swift
View File

0
Secretive/Controllers/LaunchAgentController.swift → Sources/Secretive/Controllers/LaunchAgentController.swift
View File

2
Secretive/Controllers/ShellConfigurationController.swift → Sources/Secretive/Controllers/ShellConfigurationController.swift
View File

@ -29,7 +29,7 @@ struct ShellConfigurationController {
}
func addToShell(shellInstructions: ShellConfigInstruction) -> Bool {
@MainActor func addToShell(shellInstructions: ShellConfigInstruction) -> Bool {
let openPanel = NSOpenPanel()
// This is sync, so no need to strongly retain
let delegate = Delegate(name: shellInstructions.shellConfigFilename)

0
Secretive/Credits.rtf → Sources/Secretive/Credits.rtf
View File

Some files were not shown because too many files have changed in this diff Show More