Move file

.github/templates/release.md

@@ -1,16 +0,0 @@
-Update description
-
-## Features
-
-
-## Fixes
-
-
-## Minimum macOS Version
-
-
-## Build
-https://github.com/maxgoedjen/secretive/actions/runs/RUN_ID
-
-## Attestation
-https://github.com/maxgoedjen/secretive/attestations/ATTESTATION_ID

.github/workflows/add-to-project.yml

@@ -0,0 +1,16 @@
+name: Add bugs to bugs project
+
+on:
+  issues:
+    types:
+      - opened
+
+jobs:
+  add-to-project:
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v0.0.3
+        with:
+          project-url: https://github.com/users/maxgoedjen/projects/1
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/codeql.yml

@@ -1,47 +0,0 @@
-name: "CodeQL Advanced"
-
-on:
-  push:
-    branches: [ "main" ]
-  pull_request:
-    branches: [ "main" ]
-  schedule:
-    - cron: '26 15 * * 3'
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-26') || 'ubuntu-latest' }}
-    permissions:
-      security-events: write
-      packages: read
-      actions: read
-      contents: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - language: actions
-          build-mode: none
-        # Disable this until CodeQL supports Xcode 26 builds.
-        # - language: swift
-        #   build-mode: manual
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: ${{ matrix.build-mode }}
-    - if: matrix.build-mode == 'manual'
-      name: "Select Xcode"
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.4.app
-    - if: matrix.build-mode == 'manual'
-      name: "Build"
-      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
-      with:
-        category: "/language:${{matrix.language}}"

.github/workflows/nightly.yml

@@ -3,18 +3,12 @@ name: Nightly
 on: 
   schedule: 
     - cron: "0 8 * * *"
-  
 jobs:
   build:
-    runs-on: macos-26
-    permissions:
-      id-token: write
-      contents: write
-      attestations: write
-      actions: read
+    runs-on: macOS-latest
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v2
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -25,41 +19,35 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.4.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
     - name: Update Build Number
       env:
         RUN_ID: ${{ github.run_id }}
       run: |
-            DATE=$(date "+%Y-%m-%d")
-            sed -i '' -e "s/GITHUB_CI_VERSION/0.0.0_nightly-$DATE/g" Sources/Config/Config.xcconfig
+            sed -i '' -e "s/GITHUB_CI_VERSION/0.0.0/g" Sources/Config/Config.xcconfig
             sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
+            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
     - name: Build
       run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Move to Artifact Folder
-      run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
-    - name: Upload App to Artifacts
-      id: upload
-      uses: actions/upload-artifact@v4
-      with:
-        name: Secretive
-        path: Artifact
-    - name: Download Zipped Artifact
-      id: download
-      env: 
-        ZIP_ID: ${{ steps.upload.outputs.artifact-id }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Create ZIPs
       run: |
-            curl -L -H "Authorization: Bearer $GITHUB_TOKEN" -L \
-            https://api.github.com/repos/maxgoedjen/secretive/actions/artifacts/$ZIP_ID/zip > Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
     - name: Notarize
       env: 
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
         APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
       run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
-    - name: Attest
-      id: attest
-      uses: actions/attest-build-provenance@v2
+    - name: Document SHAs
+      run: |
+            echo "sha-512:"
+            shasum -a 512 Secretive.zip
+            shasum -a 512 Archive.zip
+            echo "sha-256:"
+            shasum -a 256 Secretive.zip
+            shasum -a 256 Archive.zip
+    - name: Upload App to Artifacts
+      uses: actions/upload-artifact@v1
       with:
-        subject-name: "Secretive.zip"
-        subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}
+        name: Secretive.zip
+        path: Secretive.zip

.github/workflows/oneoff.yml

@@ -1,64 +0,0 @@
-name: One-Off Build
-
-on: 
-  workflow_dispatch:
-  
-jobs:
-  build:
-    runs-on: macos-26
-    permissions:
-      id-token: write
-      contents: write
-      attestations: write
-      actions: read
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v5
-    - name: Setup Signing
-      env: 
-        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
-        SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-        HOST_PROFILE_DATA: ${{ secrets.HOST_PROFILE_DATA }}
-        AGENT_PROFILE_DATA: ${{ secrets.AGENT_PROFILE_DATA }}
-        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
-        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-      run: ./.github/scripts/signing.sh
-    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.4.app
-    - name: Update Build Number
-      env:
-        RUN_ID: ${{ github.run_id }}
-      run: |
-            DATE=$(date "+%Y-%m-%d")
-            sed -i '' -e "s/GITHUB_CI_VERSION/0.0.0_oneoff-$DATE/g" Sources/Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
-    - name: Build
-      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Move to Artifact Folder
-      run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
-    - name: Upload App to Artifacts
-      id: upload
-      uses: actions/upload-artifact@v4
-      with:
-        name: Secretive
-        path: Artifact
-    - name: Download Zipped Artifact
-      id: download
-      env: 
-        ZIP_ID: ${{ steps.upload.outputs.artifact-id }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-            curl -L -H "Authorization: Bearer $GITHUB_TOKEN" -L \
-            https://api.github.com/repos/maxgoedjen/secretive/actions/artifacts/$ZIP_ID/zip > Secretive.zip
-    - name: Notarize
-      env: 
-        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
-    - name: Attest
-      id: attest
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-name: "Secretive.zip"
-        subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}

.github/workflows/release.yml

@@ -6,12 +6,10 @@ on:
       - '*'
 jobs:
   test:
-    permissions:
-        contents: read
-    runs-on: macos-26
+    runs-on: macOS-latest
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v1
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -22,21 +20,17 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.4.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
     - name: Test
-      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
-      # SPM doesn't seem to pick up on the tests currently?
-      # run: swift test --build-system swiftbuild --package-path Sources/Packages
+      run: |
+            pushd Sources/Packages
+            swift test
+            popd
   build:
-    permissions:
-      id-token: write
-      contents: write
-      attestations: write
-      actions: read
-    runs-on: macos-26
+    runs-on: macOS-latest
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v2
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -47,7 +41,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.4.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
     - name: Update Build Number
       env:
         TAG_NAME: ${{ github.ref }}
@@ -56,43 +50,67 @@ jobs:
             export CLEAN_TAG=$(echo $TAG_NAME | sed -e 's/refs\/tags\/v//')
             sed -i '' -e "s/GITHUB_CI_VERSION/$CLEAN_TAG/g" Sources/Config/Config.xcconfig
             sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_URL/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Config/Config.xcconfig
+            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
     - name: Build
       run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Move to Artifact Folder
-      run: mkdir Artifact; cp -r Archive.xcarchive/Products/Applications/Secretive.app Artifact
-    - name: Upload App to Artifacts
-      id: upload
-      uses: actions/upload-artifact@v4
-      with:
-        name: Secretive.zip
-        path: Artifact
-    - name: Download Zipped Artifact
-      id: download
-      env: 
-        ZIP_ID: ${{ steps.upload.outputs.artifact-id }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Create ZIPs
       run: |
-            curl -L -H "Authorization: Bearer $GITHUB_TOKEN" -L \
-            https://api.github.com/repos/maxgoedjen/secretive/actions/artifacts/$ZIP_ID/zip > Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
     - name: Notarize
       env: 
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
         APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
       run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
-    - name: Attest
-      id: attest
-      uses: actions/attest-build-provenance@v2
-      with:
-        subject-path: "Secretive.zip"
+    - name: Document SHAs
+      run: |
+            echo "sha-512:"
+            shasum -a 512 Secretive.zip
+            shasum -a 512 Archive.zip
+            echo "sha-256:"
+            shasum -a 256 Secretive.zip
+            shasum -a 256 Archive.zip
     - name: Create Release
+      id: create_release
+      uses: actions/create-release@v1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        TAG_NAME: ${{ github.ref }}
-        RUN_ID: ${{ github.run_id }}
-        ATTESTATION_ID: ${{ steps.attest.outputs.attestation-id }}
-      run: |
-            sed -i.tmp "s/RUN_ID/$RUN_ID/g" .github/templates/release.md
-            sed -i.tmp "s/ATTESTATION_ID/$ATTESTATION_ID/g" .github/templates/release.md
-            gh release create $TAG_NAME -d -F .github/templates/release.md
-            gh release upload $TAG_NAME Secretive.zip
+      with:
+        tag_name: ${{ github.ref }}
+        release_name: ${{ github.ref }}
+        body: |
+          Update description
+
+          ## Features
+
+
+          ## Fixes
+
+
+          ## Minimum macOS Version
+
+
+          ## Build
+          https://github.com/maxgoedjen/secretive/actions/runs/${{ github.run_id }}
+        draft: true
+        prerelease: false
+    - name: Upload App to Release
+      id: upload-release-asset-app
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.create_release.outputs.upload_url }}
+        asset_path: ./Secretive.zip
+        asset_name: Secretive.zip
+        asset_content_type: application/zip
+    - name: Upload App to Artifacts
+      uses: actions/upload-artifact@v1
+      with:
+        name: Secretive.zip
+        path: Secretive.zip
+    - name: Upload Archive to Artifacts
+      uses: actions/upload-artifact@v1
+      with:
+        name: Xcode_Archive.zip
+        path: Archive.zip

.github/workflows/test.yml

@@ -3,17 +3,14 @@ name: Test
 on: [push, pull_request]
 jobs:
   test:
-    permissions:
-        contents: read
-    runs-on: macos-26
+    runs-on: macOS-latest
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v2
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26.4.app
-    - name: Test Main Packages
-      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test
-      # SPM doesn't seem to pick up on the tests currently?
-      # run: swift test --build-system swiftbuild --package-path Sources/Packages
-    - name: Test SecretKit Packages
-      run: swift test --build-system swiftbuild
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
+    - name: Test
+      run: |
+            pushd Sources/Packages
+            swift test
+            popd

.gitignore

@@ -93,7 +93,3 @@ iOSInjectionProject/
 Archive.xcarchive
 .DS_Store
 contents.xcworkspacedata
-
-# Per-User Configs
-
-Sources/Config/OpenSource.xcconfig

APP_CONFIG.md

@@ -1,3 +1,116 @@
-# App Configuration
+# Setting up Third Party Apps FAQ
 
-Instructions for setting up apps and shells has moved to [secretive-config-instructions](https://github.com/maxgoedjen/secretive-config-instructions)!
+## Tower
+
+Tower provides [instructions](https://www.git-tower.com/help/mac/integration/environment).
+
+## GitHub Desktop
+
+Should just work, no configuration needed
+
+## Fork
+
+Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
+
+```
+Host *
+	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
+```
+
+## VS Code
+
+Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
+
+```
+Host *
+	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
+```
+
+## nushell
+
+Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
+
+```
+Host *
+	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
+```
+
+## Cyberduck
+
+Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
+
+```
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>link-ssh-auth-sock</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-c</string>
+    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+```
+
+Log out and log in again before launching Cyberduck.
+
+## Mountain Duck
+
+Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
+
+```
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>link-ssh-auth-sock</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-c</string>
+    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+```
+
+Log out and log in again before launching Mountain Duck.
+
+## GitKraken
+
+Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
+
+```
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>link-ssh-auth-sock</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-c</string>
+    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+```
+
+Log out and log in again before launching Gitkraken. Then enable "Use local SSH agent in GitKraken Preferences (Located under Preferences -> SSH)
+
+# The app I use isn't listed here!
+
+If you know how to get it set up, please open a PR for this page and add it! Contributions are very welcome.
+If you're not able to get it working, please file a [GitHub issue](https://github.com/maxgoedjen/secretive/issues/new) for it. No guarantees we'll be able to get it working, but chances are someone else in the community might be able to.

CONTRIBUTING.md

@@ -14,13 +14,9 @@ Secretive is designed to be easily auditable by people who are considering using
 
 All contributors must abide by the [Code of Conduct](CODE_OF_CONDUCT.md)
 
-## Localization
-
-If you'd like to contribute a translation, please see [Localizing](LOCALIZING.md) to get started.
-
 ## Credits
 
-If you make a material contribution to the app, please add yourself to the end of the [credits](https://github.com/maxgoedjen/secretive/blob/main/Sources/Secretive/Credits.rtf).
+If you make a material contribution to the app, please add yourself to the end of the [credits](https://github.com/maxgoedjen/secretive/blob/main/Secretive/Credits.rtf).
 
 ## Collaborator Status
 

FAQ.md

@@ -6,7 +6,7 @@ The secure enclave doesn't allow import or export of private keys. For any new c
 
 ### Secretive doesn't work with my git client/app
 
-Secretive relies on the `SSH_AUTH_SOCK` environment variable being respected. The `git` and `ssh` command line tools natively respect this, but third party apps may require some configuration to work. A non-exhaustive list of setup steps is provided in the [secretive-config-instructions](https://github.com/maxgoedjen/secretive-config-instructions) repo.
+Secretive relies on the `SSH_AUTH_SOCK` environment variable being respected. The `git` and `ssh` command line tools natively respect this, but third party apps may require some configuration to work. A non-exhaustive list of setup steps is provided in the [App Config FAQ](APP_CONFIG.md).
 
 ### Secretive isn't working for me
 
@@ -32,10 +32,6 @@ Try running the "Setup Secretive" process by clicking on "Help", then "Setup Sec
 
 Beginning with Secretive 2.2, every secret has an automatically generated public key file representation on disk, and the path to it is listed under "Public Key Path" in Secretive. You can specify that you want to use that key in your `~/.ssh/config`.  [This ServerFault answer](https://serverfault.com/a/295771) has more details on setting that up.
 
-### How can I generate an RSA key?
-
-The Mac's Secure Enclave only supports 256-bit EC keys, so inherently Secretive cannot support generating RSA keys.
-
 ### Can I use Secretive for SSH Agent Forwarding?
 
 Yes, you can! Once you've set up Secretive, just add `ForwardAgent yes` to the hosts you want to forward to in your SSH config file. Afterwards, any use of one of your SSH keys on the remote host must be authenticated through Secretive.

LOCALIZING.md

@@ -1,36 +0,0 @@
-# Localizing Secretive
-
-If you speak another language, and would like to help translate Secretive to support that language, we'd love your help!
-
-## Crowdin
-
-[Secretive uses Crowdin for localization](https://crowdin.com/project/secretive/). Open the link and select your language to translate!
-
-### Manual Translation
-
-Crowdin is the easiest way to translate Secretive, but I'm happy to accept Pull Requests directly as well.
-
-### Questions
-
-Please open an issue if you have a question about translating the app. I'm more than happy to clarify any terms that are ambiguous or confusing. Thanks for contributing!
-
-### Thank You
-
-Thanks to all the folks who have contributed localizations so far!
-
-- @mtardy for the French localization
-- @GravityRyu for the Chinese localization
-- @Saeger for the Portuguese (Brazil) localization
-- @moritzsternemann for the German localization
-- @RoboRich00A16 for the Italian localization
-- @akx for the Finnish localization
-- @mog422 for the Korean localization
-- @niw for the Japanese localization
-- @truita for the Catalan localization
-- @Adimac93 for the Polish localization
-- @alongotv for the Russian localization
-
-
-
-
-A special thanks to [Crowdin](https://crowdin.com) for their [generous support of open source projects](https://crowdin.com/page/open-source-project-setup-request).

Package.swift

@@ -1,85 +0,0 @@
-// swift-tools-version:6.2
-// The swift-tools-version declares the minimum version of Swift required to build this package.
-
-import PackageDescription
-
-// This is basically the same package as `Sources/Packages/Package.swift`, but thinned slightly.
-// Ideally this would be the same package, but SPM requires it to be at the root of the project,
-// and Xcode does _not_ like that, so they're separate.
-let package = Package(
-    name: "SecretKit",
-    defaultLocalization: "en",
-    platforms: [
-        .macOS(.v14)
-    ],
-    products: [
-        .library(
-            name: "SecretKit",
-            targets: ["SecretKit"]),
-        .library(
-            name: "SecureEnclaveSecretKit",
-            targets: ["SecureEnclaveSecretKit"]),
-        .library(
-            name: "SmartCardSecretKit",
-            targets: ["SmartCardSecretKit"]),
-        .library(
-            name: "SSHProtocolKit",
-            targets: ["SSHProtocolKit"]),
-    ],
-    dependencies: [
-    ],
-    targets: [
-        .target(
-            name: "SecretKit",
-            dependencies: [],
-            path: "Sources/Packages/Sources/SecretKit",
-            resources: [localization],
-            swiftSettings: swiftSettings
-        ),
-        .testTarget(
-            name: "SecretKitTests",
-            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
-            path: "Sources/Packages/Tests/SecretKitTests",
-            swiftSettings: swiftSettings
-        ),
-        .target(
-            name: "SecureEnclaveSecretKit",
-            dependencies: ["SecretKit"],
-            path: "Sources/Packages/Sources/SecureEnclaveSecretKit",
-            resources: [localization],
-            swiftSettings: swiftSettings
-        ),
-        .target(
-            name: "SmartCardSecretKit",
-            dependencies: ["SecretKit"],
-            path: "Sources/Packages/Sources/SmartCardSecretKit",
-            resources: [localization],
-            swiftSettings: swiftSettings
-        ),
-        .target(
-            name: "SSHProtocolKit",
-            dependencies: ["SecretKit"],
-            path: "Sources/Packages/Sources/SSHProtocolKit",
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .testTarget(
-            name: "SSHProtocolKitTests",
-            dependencies: ["SSHProtocolKit"],
-            path: "Sources/Packages/Tests/SSHProtocolKitTests",
-            swiftSettings: swiftSettings,
-        ),
-    ]
-)
-
-var localization: Resource {
-    .process("../../Resources/Localizable.xcstrings")
-}
-
-var swiftSettings: [PackageDescription.SwiftSetting] {
-    [
-        .swiftLanguageMode(.v6),
-        // This freaks out Xcode in a dependency context.
-        // .treatAllWarnings(as: .error),
-    ]
-}

README.md

@@ -1,23 +1,20 @@
-# Secretive [![Test](https://github.com/maxgoedjen/secretive/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/maxgoedjen/secretive/actions/workflows/test.yml) ![Release](https://github.com/maxgoedjen/secretive/workflows/Release/badge.svg)
+# Secretive ![Test](https://github.com/maxgoedjen/secretive/workflows/Test/badge.svg) ![Release](https://github.com/maxgoedjen/secretive/workflows/Release/badge.svg)
 
 
-Secretive is an app for protecting and managing SSH keys with the Secure Enclave.
-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="/.github/readme/app-dark.png">
-  <source media="(prefers-color-scheme: light)" srcset="/.github/readme/app-light.png">
-  <img src="/.github/readme/app-dark.png" alt="Screenshot of Secretive" width="600">
-</picture>
+Secretive is an app for storing and managing SSH keys in the Secure Enclave. It is inspired by the [sekey project](https://github.com/sekey/sekey), but rewritten in Swift with no external dependencies and with a handy native management app.
+
+<img src="/.github/readme/app.png" alt="Screenshot of Secretive" width="600">
 
 
 ## Why?
 
 ### Safer Storage
 
-The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy your private key. If you protect your keys with the Secure Enclave, it's impossible to export them, by design.
+The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy your private key. If you store your keys in the Secure Enclave, it's impossible to export them, by design.
 
 ### Access Control
 
-If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your keys so that they require Touch ID (or Watch) authentication before they're accessed.
+If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed.
 
 <img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID" width="400">
 
@@ -49,11 +46,11 @@ There's a [FAQ here](FAQ.md).
 
 ### Auditable Build Process
 
-Builds are produced by GitHub Actions with an auditable build and release generation process. Starting with Secretive 3.0, builds are attested using [GitHub Artifact Attestation](https://docs.github.com/en/actions/concepts/security/artifact-attestations). Attestations are viewable in the build log for a build, and also on the [main attestation page](https://github.com/maxgoedjen/secretive/attestations).
+Builds are produced by GitHub Actions with an auditable build and release generation process. Each build has a "Document SHAs" step, which will output SHA checksums for the build produced by the GitHub Action, so you can verify that the source code for a given build corresponds to any given release.
 
 ### A Note Around Code Signing and Keychains
 
-While Secretive uses the Secure Enclave to protect keys, it still relies on Keychain APIs to store and access them. Keychain restricts reads of keys to the app (and specifically, the bundle ID) that created them. If you build Secretive from source, make sure you are consistent in which bundle ID you use so that the Keychain is able to locate your keys.
+While Secretive uses the Secure Enclave for key storage, it still relies on Keychain APIs to access them. Keychain restricts reads of keys to the app (and specifically, the bundle ID) that created them. If you build Secretive from source, make sure you are consistent in which bundle ID you use so that the Keychain is able to locate your keys.
 
 ### Backups and Transfers to New Machines
 
@@ -61,12 +58,4 @@ Because secrets in the Secure Enclave are not exportable, they are not able to b
 
 ## Security
 
-Secretive's security policy is detailed in [SECURITY.md](SECURITY.md). To report security issues, please use [GitHub's private reporting feature.](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)
-
-## Acknowledgements
-
-### sekey
-Secretive was inspired by the [sekey project](https://github.com/sekey/sekey).
-
-### Localization
-Secretive is localized to many languages by a generous team of volunteers. To learn more, see [LOCALIZING.md](LOCALIZING.md). Secretive's localization workflow is generously provided by [Crowdin](https://crowdin.com).
+If you discover any vulnerabilities in this project, please notify [max.goedjen@gmail.com](mailto:max.goedjen@gmail.com) with the subject containing "SECRETIVE SECURITY."

SECURITY.md

@@ -1,27 +1,9 @@
 # Security Policy
 
-## Security Principles
-
-Secretive is designed with a few general tenets in mind:
-
-### It's Hard to Leak a Key Secretive Can't Read The Key Material
-
-Secretive only operates on hardware-backed keys. In general terms, this means that it should be _very_ hard for Secretive to have any sort of bug that causes a key to be shared, because Secretive can't access private key data even if it wants to.
-
-### Simplicity and Auditability
-
-Secretive won't expand to have every feature it could possibly have. Part of the goal of the app is that it is possible for consumers to reasonably audit the code, and that often means not implementing features that might be cool, but which would significantly inflate the size of the codebase.
-
-### Dependencies
-
-Both in support of the previous principle and to rule out supply chain attacks, Secretive does not rely on any third party dependencies. 
-
-There are limited exceptions to this, particularly in the build process, but the app itself does not depend on any third party code.
-
 ## Supported Versions
 
 The latest version on the [Releases page](https://github.com/maxgoedjen/secretive/releases) is the only currently supported version.
 
 ## Reporting a Vulnerability
 
-To report security issues, please use [GitHub's private reporting feature.](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)
+If you discover any vulnerabilities in this project, please notify max.goedjen@gmail.com with the subject containing "SECRETIVE SECURITY."

Sources/Config/Config.xcconfig

@@ -1,8 +1,2 @@
 CI_VERSION = GITHUB_CI_VERSION
 CI_BUILD_NUMBER = GITHUB_BUILD_NUMBER
-CI_BUILD_LINK = GITHUB_BUILD_URL
-
-#include? "OpenSource.xcconfig"
-
-SECRETIVE_BASE_BUNDLE_ID = $(SECRETIVE_BASE_BUNDLE_ID_OSS:default=com.maxgoedjen.Secretive)
-SECRETIVE_DEVELOPMENT_TEAM = $(SECRETIVE_DEVELOPMENT_TEAM_OSS:default=Z72PRUAWF6)

Sources/Config/Secretive.xctestplan

@@ -13,24 +13,12 @@
   },
   "testTargets" : [
     {
+      "enabled" : false,
+      "parallelizable" : true,
       "target" : {
-        "containerPath" : "container:Packages",
-        "identifier" : "BriefTests",
-        "name" : "BriefTests"
-      }
-    },
-    {
-      "target" : {
-        "containerPath" : "container:Packages",
-        "identifier" : "SecretKitTests",
-        "name" : "SecretKitTests"
-      }
-    },
-    {
-      "target" : {
-        "containerPath" : "container:Packages",
-        "identifier" : "SecretAgentKitTests",
-        "name" : "SecretAgentKitTests"
+        "containerPath" : "container:Secretive.xcodeproj",
+        "identifier" : "50617D9323FCE48E0099B055",
+        "name" : "SecretiveTests"
       }
     }
   ],

Sources/Packages/Package.swift

@@ -1,13 +1,12 @@
-// swift-tools-version:6.2
+// swift-tools-version:5.5
 // The swift-tools-version declares the minimum version of Swift required to build this package.
 
 import PackageDescription
 
 let package = Package(
     name: "SecretivePackages",
-    defaultLocalization: "en",
     platforms: [
-        .macOS(.v14)
+        .macOS(.v11)
     ],
     products: [
         .library(
@@ -23,96 +22,49 @@ let package = Package(
             name: "SecretAgentKit",
             targets: ["SecretAgentKit"]),
         .library(
-            name: "Common",
-            targets: ["Common"]),
+            name: "SecretAgentKitHeaders",
+            targets: ["SecretAgentKitHeaders"]),
         .library(
             name: "Brief",
             targets: ["Brief"]),
-        .library(
-            name: "XPCWrappers",
-            targets: ["XPCWrappers"]),
-        .library(
-            name: "SSHProtocolKit",
-            targets: ["SSHProtocolKit"]),
     ],
     dependencies: [
     ],
     targets: [
         .target(
             name: "SecretKit",
-            dependencies: [],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: []
         ),
         .testTarget(
             name: "SecretKitTests",
-            dependencies: ["SecretKit", "SecretAgentKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
-            swiftSettings: swiftSettings,
+            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"]
         ),
         .target(
             name: "SecureEnclaveSecretKit",
-            dependencies: ["SecretKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: ["SecretKit"]
         ),
         .target(
             name: "SmartCardSecretKit",
-            dependencies: ["SecretKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: ["SecretKit"]
         ),
         .target(
             name: "SecretAgentKit",
-            dependencies: ["SecretKit", "SSHProtocolKit", "Common"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: ["SecretKit", "SecretAgentKitHeaders"]
+        ),
+        .systemLibrary(
+            name: "SecretAgentKitHeaders"
         ),
         .testTarget(
             name: "SecretAgentKitTests",
-            dependencies: ["SecretAgentKit"],
-        ),
-        .target(
-            name: "SSHProtocolKit",
-            dependencies: ["SecretKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
-        .testTarget(
-            name: "SSHProtocolKitTests",
-            dependencies: ["SSHProtocolKit"],
-            swiftSettings: swiftSettings,
-        ),
-        .target(
-            name: "Common",
-            dependencies: ["SSHProtocolKit", "SecretKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
-        ),
+            dependencies: ["SecretAgentKit"])
+        ,
         .target(
             name: "Brief",
-            dependencies: ["XPCWrappers", "SSHProtocolKit"],
-            resources: [localization],
-            swiftSettings: swiftSettings,
+            dependencies: []
         ),
         .testTarget(
             name: "BriefTests",
-            dependencies: ["Brief"],
-        ),
-        .target(
-            name: "XPCWrappers",
-            swiftSettings: swiftSettings,
+            dependencies: ["Brief"]
         ),
     ]
 )
-
-var localization: Resource {
-    .process("../../Resources/Localizable.xcstrings")
-}
-
-var swiftSettings: [PackageDescription.SwiftSetting] {
-    [
-        .swiftLanguageMode(.v6),
-        .treatAllWarnings(as: .error),
-        .strictMemorySafety()
-    ]
-}

Sources/Packages/Sources/Brief/Release.swift

@@ -1,8 +1,7 @@
 import Foundation
-import SwiftUI
 
 /// A release is a representation of a downloadable update.
-public struct Release: Codable, Sendable, Hashable {
+public struct Release: Codable {
 
     /// The user-facing name of the release. Typically "Secretive 1.2.3"
     public let name: String
@@ -16,8 +15,6 @@ public struct Release: Codable, Sendable, Hashable {
     /// A user-facing description of the contents of the update.
     public let body: String
 
-    public let attributedBody: AttributedString
-
     /// Initializes a Release.
     /// - Parameters:
     ///   - name: The user-facing name of the release.
@@ -29,56 +26,6 @@ public struct Release: Codable, Sendable, Hashable {
         self.prerelease = prerelease
         self.html_url = html_url
         self.body = body
-        self.attributedBody = AttributedString(_markdown: body)
-    }
-
-    public init(_ release: GitHubRelease) {
-        self.name = release.name
-        self.prerelease = release.prerelease
-        self.html_url = release.html_url
-        self.body = release.body
-        self.attributedBody = AttributedString(_markdown: release.body)
-    }
-
-}
-
-public struct GitHubRelease: Codable, Sendable {
-    let name: String
-    let prerelease: Bool
-    let html_url: URL
-    let body: String
-}
-
-fileprivate extension AttributedString {
-
-    init(_markdown markdown: String) {
-        let split = markdown.split(whereSeparator: \.isNewline)
-        let lines = split
-            .compactMap {
-                try? AttributedString(markdown: String($0), options: .init(allowsExtendedAttributes: true, interpretedSyntax: .full))
-            }
-            .map { (string: AttributedString) in
-                guard case let .header(level) = string.runs.first?.presentationIntent?.components.first?.kind else { return string }
-                return AttributedString("\n") + string
-                    .transformingAttributes(\.font) { font in
-                        font.value = switch level {
-                        case 2: .headline.bold()
-                        case 3: .headline
-                        default: .subheadline
-                        }
-                    }
-                    .transformingAttributes(\.underlineStyle) { underline in
-                        underline.value = switch level {
-                        case 2: .single
-                        default: .none
-                        }
-                    }
-                + AttributedString("\n")
-            }
-        self = lines.reduce(into: AttributedString()) { partialResult, next in
-            partialResult.append(next)
-            partialResult.append(AttributedString("\n"))
-        }
     }
 
 }

Sources/Packages/Sources/Brief/SemVer.swift

@@ -1,24 +1,16 @@
 import Foundation
 
 /// A representation of a Semantic Version.
-public struct SemVer: Sendable {
+public struct SemVer {
 
     /// The SemVer broken into an array of integers.
     let versionNumbers: [Int]
-    public let previewDescription: String?
-
-    public var isTestBuild: Bool {
-        versionNumbers == [0, 0, 0]
-    }
 
     /// Initializes a SemVer from a string representation.
     /// - Parameter version: A string representation of the SemVer, formatted as "major.minor.patch".
     public init(_ version: String) {
         // Betas have the format 1.2.3_beta1
-        // Nightlies have the format 0.0.0_nightly-2025-09-03
-        let splitFull = version.split(separator: "_")
-        let strippedBeta = splitFull.first!
-        previewDescription = splitFull.count > 1 ? String(splitFull[1]) : nil
+        let strippedBeta = version.split(separator: "_").first!
         var split = strippedBeta.split(separator: ".").compactMap { Int($0) }
         while split.count < 3 {
             split.append(0)
@@ -30,7 +22,6 @@ public struct SemVer: Sendable {
     /// - Parameter version: An  `OperatingSystemVersion` representation of the SemVer.
     public init(_ version: OperatingSystemVersion) {
         versionNumbers = [version.majorVersion, version.minorVersion, version.patchVersion]
-        previewDescription = nil
     }
 
 }

Sources/Packages/Sources/Brief/Updater.swift

@@ -1,24 +1,16 @@
 import Foundation
-import Observation
-import XPCWrappers
+import Combine
 
 /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
-@Observable public final class Updater: UpdaterProtocol, Sendable {
+public class Updater: ObservableObject, UpdaterProtocol {
 
-    private let state = State()
-    @MainActor @Observable public final class State {
-        var update: Release? = nil
-        nonisolated init() {}
-    }
-    public var update: Release? {
-        state.update
-    }
-
-    /// The current version of the app that is running.
-    public let currentVersion: SemVer
+    @Published public var update: Release?
+    public let testBuild: Bool
 
     /// The current OS version.
     private let osVersion: SemVer
+    /// The current version of the app that is running.
+    private let currentVersion: SemVer
 
     /// Initializes an Updater.
     /// - Parameters:
@@ -26,40 +18,36 @@ import XPCWrappers
     ///   - checkFrequency: The interval at which the Updater should check for updates. Subject to a tolerance of 1 hour.
     ///   - osVersion: The current OS version.
     ///   - currentVersion: The current version of the app that is running.
-    public init(
-        checkOnLaunch: Bool,
-        checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value,
-        osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion),
-        currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")
-    ) {
+    public init(checkOnLaunch: Bool, checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value, osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion), currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")) {
         self.osVersion = osVersion
         self.currentVersion = currentVersion
-        Task {
-            if checkOnLaunch {
-                try await checkForUpdates()
-            }
-            while !Task.isCancelled {
-                try? await Task.sleep(for: .seconds(Int(checkFrequency)))
-                try await checkForUpdates()
-            }
+        testBuild = currentVersion == SemVer("0.0.0")
+        if checkOnLaunch {
+            // Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet.
+            checkForUpdates()
         }
+        let timer = Timer.scheduledTimer(withTimeInterval: checkFrequency, repeats: true) { _ in
+            self.checkForUpdates()
+        }
+        timer.tolerance = 60*60
     }
 
     /// Manually trigger an update check.
-    public func checkForUpdates() async throws {
-        let session = try await XPCTypedSession<[Release], Never>(serviceName: "com.maxgoedjen.Secretive.SecretiveUpdater")
-        await evaluate(releases: try await session.send())
-        session.complete()
+    public func checkForUpdates() {
+        URLSession.shared.dataTask(with: Constants.updateURL) { data, _, _ in
+            guard let data = data else { return }
+            guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
+            self.evaluate(releases: releases)
+        }.resume()
     }
 
-
     /// Ignores a specified release. `update` will be nil if the user has ignored the latest available release.
     /// - Parameter release: The release to ignore.
-    public func ignore(release: Release) async {
+    public func ignore(release: Release) {
         guard !release.critical else { return }
         defaults.set(true, forKey: release.name)
-        await MainActor.run {
-            state.update = nil
+        DispatchQueue.main.async {
+            self.update = nil
         }
     }
 
@@ -69,7 +57,7 @@ extension Updater {
 
     /// Evaluates the available downloadable releases, and selects the newest non-prerelease release that the user is able to run.
     /// - Parameter releases: An array of ``Release`` objects.
-    func evaluate(releases: [Release]) async {
+    func evaluate(releases: [Release]) {
         guard let release = releases
                 .sorted()
                 .reversed()
@@ -79,8 +67,8 @@ extension Updater {
         guard !release.prerelease else { return }
         let latestVersion = SemVer(release.name)
         if latestVersion > currentVersion {
-            await MainActor.run {
-                state.update = release
+            DispatchQueue.main.async {
+                self.update = release
             }
         }
     }
@@ -99,3 +87,11 @@ extension Updater {
     }
 
 }
+
+extension Updater {
+
+    enum Constants {
+        static let updateURL = URL(string: "https://api.github.com/repos/maxgoedjen/secretive/releases")!
+    }
+
+}

Sources/Packages/Sources/Brief/UpdaterProtocol.swift

@@ -1,13 +1,12 @@
 import Foundation
 
 /// A protocol for retreiving the latest available version of an app.
-public protocol UpdaterProtocol: Observable, Sendable {
+public protocol UpdaterProtocol: ObservableObject {
 
     /// The latest update
-    @MainActor var update: Release? { get }
+    var update: Release? { get }
+    /// A boolean describing whether or not the current build of the app is a "test" build (ie, a debug build or otherwise special build)
+    var testBuild: Bool { get }
 
-    var currentVersion: SemVer { get }
-
-    func ignore(release: Release) async
 }
 

Sources/Packages/Sources/Common/BundleIDs.swift

@@ -1,11 +0,0 @@
-import Foundation
-
-extension Bundle {
-    public static var agentBundleID: String {
-        Bundle.main.bundleIdentifier!.replacingOccurrences(of: "Host", with: "SecretAgent")
-    }
-
-    public static var hostBundleID: String {
-        Bundle.main.bundleIdentifier!.replacingOccurrences(of: "SecretAgent", with: "Host")
-    }
-}

Sources/Packages/Sources/Common/URLs.swift

@@ -1,46 +0,0 @@
-import Foundation
-import SSHProtocolKit
-import SecretKit
-
-extension URL {
-
-    public static var agentHomeURL: URL {
-        URL(fileURLWithPath: URL.homeDirectory.path().replacingOccurrences(of: Bundle.hostBundleID, with: Bundle.agentBundleID))
-    }
-
-    public static var socketPath: String {
-        #if DEBUG
-        URL.agentHomeURL.appendingPathComponent("socket-debug.ssh").path()
-        #else
-        URL.agentHomeURL.appendingPathComponent("socket.ssh").path()
-        #endif
-    }
-
-    public static var publicKeyDirectory: URL {
-        agentHomeURL.appending(component: "PublicKeys")
-    }
-
-    /// The path for a Secret's public key.
-    /// - Parameter secret: The Secret to return the path for.
-    /// - Returns: The path to the Secret's public key.
-    /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
-    public static func publicKeyPath<SecretType: Secret>(for secret: SecretType, in directory: URL) -> String {
-        let keyWriter = OpenSSHPublicKeyWriter()
-        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return directory.appending(component: "\(minimalHex).pub").path()
-    }
-
-}
-
-extension String {
-
-    public var normalizedPathAndFolder: (String, String) {
-        // All foundation-based normalization methods replace this with the container directly.
-        let processedPath = replacingOccurrences(of: "~", with: "/Users/\(NSUserName())")
-        let url = URL(filePath: processedPath)
-        let folder = url.deletingLastPathComponent().path()
-        return (processedPath, folder)
-    }
-
-}
-

Sources/Packages/Sources/SSHProtocolKit/Data+Hex.swift

@@ -1,37 +0,0 @@
-import Foundation
-import CryptoKit
-
-public struct HexDataStyle<SequenceType: Sequence>: Hashable, Codable {
-
-    let separator: String
-
-    public init(separator: String) {
-        self.separator = separator
-    }
-
-}
-
-extension HexDataStyle: FormatStyle where SequenceType.Element == UInt8 {
-
-    public func format(_ value: SequenceType) -> String {
-        value
-            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
-            .joined(separator: separator)
-    }
-
-}
-
-extension FormatStyle where Self == HexDataStyle<Data> {
-
-    public static func hex(separator: String = "") -> HexDataStyle<Data> {
-        HexDataStyle(separator: separator)
-    }
-
-}
-extension FormatStyle where Self == HexDataStyle<Insecure.MD5Digest> {
-
-    public static func hex(separator: String = ":") -> HexDataStyle<Insecure.MD5Digest> {
-        HexDataStyle(separator: separator)
-    }
-
-}

Sources/Packages/Sources/SSHProtocolKit/LengthAndData.swift

@@ -1,23 +0,0 @@
-import Foundation
-
-extension Data {
-
-    /// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
-    /// - Returns: OpenSSH data.
-    package var lengthAndData: Data {
-        let rawLength = UInt32(count)
-        var endian = rawLength.bigEndian
-        return unsafe Data(bytes: &endian, count: MemoryLayout<UInt32>.size) + self
-    }
-
-}
-
-extension String {
-
-    /// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
-    /// - Returns: OpenSSH data.
-    package var lengthAndData: Data {
-        Data(utf8).lengthAndData
-    }
-
-}

Sources/Packages/Sources/SSHProtocolKit/OpenSSHPublicKeyWriter.swift

@@ -1,113 +0,0 @@
-import Foundation
-import CryptoKit
-import SecretKit
-
-/// Generates OpenSSH representations of the public key sof secrets.
-public struct OpenSSHPublicKeyWriter: Sendable {
-
-    /// Initializes the writer.
-    public init() {
-    }
-
-    /// Generates an OpenSSH data payload identifying the secret.
-    /// - Returns: OpenSSH data payload identifying the secret.
-    public func data<SecretType: Secret>(secret: SecretType) -> Data {
-        switch secret.keyType.algorithm {
-        case .ecdsa:
-            // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
-            openSSHIdentifier(for: secret.keyType).lengthAndData +
-            ("nistp" + String(describing: secret.keyType.size)).lengthAndData +
-            secret.publicKey.lengthAndData
-        case .mldsa:
-            // https://www.ietf.org/archive/id/draft-sfluhrer-ssh-mldsa-04.txt
-            openSSHIdentifier(for: secret.keyType).lengthAndData +
-            secret.publicKey.lengthAndData
-        case .rsa:
-            // https://datatracker.ietf.org/doc/html/rfc4253#section-6.6
-            openSSHIdentifier(for: secret.keyType).lengthAndData +
-            rsaPublicKeyBlob(secret: secret)
-        }
-    }
-
-    /// Generates an OpenSSH string representation of the secret.
-    /// - Returns: OpenSSH string representation of the secret.
-    public func openSSHString<SecretType: Secret>(secret: SecretType) -> String {
-        return [openSSHIdentifier(for: secret.keyType), data(secret: secret).base64EncodedString(), comment(secret: secret)]
-            .compactMap { $0 }
-            .joined(separator: " ")
-    }
-
-    /// Generates an OpenSSH SHA256 fingerprint string.
-    /// - Returns: OpenSSH SHA256 fingerprint string.
-    public func openSSHSHA256Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
-        // OpenSSL format seems to strip the padding at the end.
-        let base64 = Data(SHA256.hash(data: data(secret: secret))).base64EncodedString()
-        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
-        let cleaned = base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
-        return "SHA256:\(cleaned)"
-    }
-
-    /// Generates an OpenSSH MD5 fingerprint string.
-    /// - Returns: OpenSSH MD5 fingerprint string.
-    public func openSSHMD5Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
-        Insecure.MD5.hash(data: data(secret: secret)).formatted(.hex(separator: ":"))
-    }
-
-    public func comment<SecretType: Secret>(secret: SecretType) -> String {
-        if let comment = secret.publicKeyAttribution {
-            return comment
-        } else {
-            let dashedKeyName = secret.name.replacingOccurrences(of: " ", with: "-")
-            let dashedHostName = ["secretive", Host.current().localizedName, "local"]
-                .compactMap { $0 }
-                .joined(separator: ".")
-                .replacingOccurrences(of: " ", with: "-")
-            return "\(dashedKeyName)@\(dashedHostName)"
-        }
-
-    }
-}
-
-extension OpenSSHPublicKeyWriter {
-
-    /// The fully qualified OpenSSH identifier for the algorithm.
-    /// - Parameters:
-    ///   - algorithm: The algorithm to identify.
-    ///   - length: The key length of the algorithm.
-    /// - Returns: The OpenSSH identifier for the algorithm.
-    public func openSSHIdentifier(for keyType: KeyType) -> String {
-        switch keyType {
-        case .ecdsa256:
-            "ecdsa-sha2-nistp256"
-        case .ecdsa384:
-            "ecdsa-sha2-nistp384"
-        case .mldsa65:
-            "ssh-mldsa-65"
-        case .mldsa87:
-            "ssh-mldsa-87"
-        case .rsa2048:
-            "ssh-rsa"
-        default:
-            "unknown"
-        }
-    }
-
-}
-
-extension OpenSSHPublicKeyWriter {
-
-    func rsaPublicKeyBlob<SecretType: Secret>(secret: SecretType) -> Data {
-        // Cheap way to pull out e and n as defined in https://datatracker.ietf.org/doc/html/rfc4253
-        // Keychain stores it as a thin ASN.1 wrapper with this format:
-        // [4 byte prefix][2 byte prefix][n][2 byte prefix][e]
-        // Rather than parse out the whole ASN.1 blob, we'll cheat and pull values directly since
-        // we only support one key type, and the keychain always gives it in a specific format.
-        guard secret.keyType == .rsa2048 else { fatalError() }
-        let length = secret.keyType.size/8
-        let data = secret.publicKey
-        let n = Data(data[8..<(9+length)])
-        let e = Data(data[(2+9+length)...])
-        return e.lengthAndData + n.lengthAndData
-    }
-
-}

Sources/Packages/Sources/SSHProtocolKit/OpenSSHReader.swift

@@ -1,54 +0,0 @@
-import Foundation
-
-/// Reads OpenSSH protocol data.
-public final class OpenSSHReader {
-
-    var remaining: Data
-    var done = false
-
-    /// Initialize the reader with an OpenSSH data payload.
-    /// - Parameter data: The data to read.
-    public init(data: Data) {
-        remaining = Data(data)
-    }
-
-    /// Reads the next chunk of data from the playload.
-    /// - Returns: The next chunk of data.
-    public func readNextChunk(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> Data {
-        let length = try readNextBytes(as: UInt32.self, convertEndianness: convertEndianness)
-        guard remaining.count >= length else { throw .beyondBounds }
-        let dataRange = 0..<Int(length)
-        let ret = Data(remaining[dataRange])
-        remaining.removeSubrange(dataRange)
-        if remaining.isEmpty {
-            done = true
-        }
-        return ret
-    }
-
-    public func readNextBytes<T: FixedWidthInteger>(as: T.Type, convertEndianness: Bool = true) throws(OpenSSHReaderError) -> T {
-        let size = MemoryLayout<T>.size
-        guard remaining.count >= size else { throw .beyondBounds }
-        let lengthRange = 0..<size
-        let lengthChunk = remaining[lengthRange]
-        remaining.removeSubrange(lengthRange)
-        if remaining.isEmpty {
-            done = true
-        }
-        let value = unsafe lengthChunk.bytes.unsafeLoad(as: T.self)
-        return convertEndianness ? T(value.bigEndian) : T(value)
-    }
-
-    public func readNextChunkAsString(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> String {
-        try String(decoding: readNextChunk(convertEndianness: convertEndianness), as: UTF8.self)
-    }
-
-    public func readNextChunkAsSubReader(convertEndianness: Bool = true) throws(OpenSSHReaderError) -> OpenSSHReader {
-        OpenSSHReader(data: try readNextChunk(convertEndianness: convertEndianness))
-    }
-
-}
-
-public enum OpenSSHReaderError: Error, Codable {
-    case beyondBounds
-}

Sources/Packages/Sources/SSHProtocolKit/OpenSSHSignatureWriter.swift

@@ -1,85 +0,0 @@
-import Foundation
-import CryptoKit
-import SecretKit
-
-/// Generates OpenSSH representations of Secrets.
-public struct OpenSSHSignatureWriter: Sendable {
-
-    /// Initializes the writer.
-    public init() {
-    }
-
-    /// Generates an OpenSSH data payload identifying the secret.
-    /// - Returns: OpenSSH data payload identifying the secret.
-    public func data<SecretType: Secret>(secret: SecretType, signature: Data) -> Data {
-        switch secret.keyType.algorithm {
-        case .ecdsa:
-            // https://datatracker.ietf.org/doc/html/rfc5656#section-3.1
-            ecdsaSignature(signature, keyType: secret.keyType)
-        case .mldsa:
-            // https://datatracker.ietf.org/doc/html/draft-sfluhrer-ssh-mldsa-00#name-public-key-algorithms
-            mldsaSignature(signature, keyType: secret.keyType)
-        case .rsa:
-            // https://datatracker.ietf.org/doc/html/rfc4253#section-6.6
-            rsaSignature(signature)
-        }
-    }
-
-}
-
-
-extension OpenSSHSignatureWriter {
-
-    /// Converts a fixed-width big-endian integer (e.g. r/s from CryptoKit rawRepresentation) into an SSH mpint.
-    /// Strips unnecessary leading zeros and prefixes `0x00` if needed to keep the value positive.
-    private func mpint(fromFixedWidthPositiveBytes bytes: Data) -> Data {
-        // mpint zero is encoded as a string with zero bytes of data.
-        guard let firstNonZeroIndex = bytes.firstIndex(where: { $0 != 0x00 }) else {
-            return Data()
-        }
-
-        let trimmed = Data(bytes[firstNonZeroIndex...])
-
-        if let first = trimmed.first, first >= 0x80 {
-            var prefixed = Data([0x00])
-            prefixed.append(trimmed)
-            return prefixed
-        }
-        return trimmed
-    }
-
-    func ecdsaSignature(_ rawRepresentation: Data, keyType: KeyType) -> Data {
-        let rawLength = rawRepresentation.count/2
-        let r = mpint(fromFixedWidthPositiveBytes: Data(rawRepresentation[0..<rawLength]))
-        let s = mpint(fromFixedWidthPositiveBytes: Data(rawRepresentation[rawLength...]))
-
-        var signatureChunk = Data()
-        signatureChunk.append(r.lengthAndData)
-        signatureChunk.append(s.lengthAndData)
-        var mutSignedData = Data()
-        var sub = Data()
-        sub.append(OpenSSHPublicKeyWriter().openSSHIdentifier(for: keyType).lengthAndData)
-        sub.append(signatureChunk.lengthAndData)
-        mutSignedData.append(sub.lengthAndData)
-        return mutSignedData
-    }
-
-    func mldsaSignature(_ rawRepresentation: Data, keyType: KeyType) -> Data {
-        var mutSignedData = Data()
-        var sub = Data()
-        sub.append(OpenSSHPublicKeyWriter().openSSHIdentifier(for: keyType).lengthAndData)
-        sub.append(rawRepresentation.lengthAndData)
-        mutSignedData.append(sub.lengthAndData)
-        return mutSignedData
-    }
-
-    func rsaSignature(_ rawRepresentation: Data) -> Data {
-        var mutSignedData = Data()
-        var sub = Data()
-        sub.append("rsa-sha2-512".lengthAndData)
-        sub.append(rawRepresentation.lengthAndData)
-        mutSignedData.append(sub.lengthAndData)
-        return mutSignedData
-    }
-
-}

Sources/Packages/Sources/SSHProtocolKit/SSHAgentProtocol.swift

@@ -1,99 +0,0 @@
-import Foundation
-
-/// A namespace for the SSH Agent Protocol, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
-public enum SSHAgent {}
-
-extension SSHAgent {
-
-    /// The type of the SSH Agent Request, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
-    public enum Request: CustomDebugStringConvertible, Codable, Sendable {
-
-        case requestIdentities
-        case signRequest(SignatureRequestContext)
-        case addIdentity
-        case removeIdentity
-        case removeAllIdentities
-        case addIDConstrained
-        case addSmartcardKey
-        case removeSmartcardKey
-        case lock
-        case unlock
-        case addSmartcardKeyConstrained
-        case protocolExtension
-        case unknown(UInt8)
-
-        public var protocolID: UInt8 {
-            switch self {
-            case .requestIdentities: 11
-            case .signRequest: 13
-            case .addIdentity: 17
-            case .removeIdentity: 18
-            case .removeAllIdentities: 19
-            case .addIDConstrained: 25
-            case .addSmartcardKey: 20
-            case .removeSmartcardKey: 21
-            case .lock: 22
-            case .unlock: 23
-            case .addSmartcardKeyConstrained: 26
-            case .protocolExtension: 27
-            case .unknown(let value): value
-            }
-        }
-
-        public var debugDescription: String {
-            switch self {
-            case .requestIdentities: "SSH_AGENTC_REQUEST_IDENTITIES"
-            case .signRequest: "SSH_AGENTC_SIGN_REQUEST"
-            case .addIdentity: "SSH_AGENTC_ADD_IDENTITY"
-            case .removeIdentity: "SSH_AGENTC_REMOVE_IDENTITY"
-            case .removeAllIdentities: "SSH_AGENTC_REMOVE_ALL_IDENTITIES"
-            case .addIDConstrained: "SSH_AGENTC_ADD_ID_CONSTRAINED"
-            case .addSmartcardKey: "SSH_AGENTC_ADD_SMARTCARD_KEY"
-            case .removeSmartcardKey: "SSH_AGENTC_REMOVE_SMARTCARD_KEY"
-            case .lock: "SSH_AGENTC_LOCK"
-            case .unlock: "SSH_AGENTC_UNLOCK"
-            case .addSmartcardKeyConstrained: "SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED"
-            case .protocolExtension: "SSH_AGENTC_EXTENSION"
-            case .unknown: "UNKNOWN_MESSAGE"
-            }
-        }
-
-        public struct SignatureRequestContext: Sendable, Codable {
-            public let keyBlob: Data
-            public let dataToSign: Data
-
-            public init(keyBlob: Data, dataToSign: Data) {
-                self.keyBlob = keyBlob
-                self.dataToSign = dataToSign
-            }
-
-            public static var empty: SignatureRequestContext {
-                SignatureRequestContext(keyBlob: Data(), dataToSign: Data())
-            }
-        }
-
-    }
-
-    /// The type of the SSH Agent Response, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
-    public enum Response: UInt8, CustomDebugStringConvertible {
-        
-        case agentFailure = 5
-        case agentSuccess = 6
-        case agentIdentitiesAnswer = 12
-        case agentSignResponse = 14
-        case agentExtensionFailure = 28
-        case agentExtensionResponse = 29
-
-        public var debugDescription: String {
-            switch self {
-            case .agentFailure: "SSH_AGENT_FAILURE"
-            case .agentSuccess: "SSH_AGENT_SUCCESS"
-            case .agentIdentitiesAnswer: "SSH_AGENT_IDENTITIES_ANSWER"
-            case .agentSignResponse: "SSH_AGENT_SIGN_RESPONSE"
-            case .agentExtensionFailure: "SSH_AGENT_EXTENSION_FAILURE"
-            case .agentExtensionResponse: "SSH_AGENT_EXTENSION_RESPONSE"
-            }
-        }
-    }
-    
-}

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -3,18 +3,35 @@ import CryptoKit
 import OSLog
 import SecretKit
 import AppKit
-import SSHProtocolKit
+
+enum OpenSSHCertificateError: Error {
+    case unsupportedType
+    case parsingFailed
+    case doesNotExist
+}
+
+extension OpenSSHCertificateError: CustomStringConvertible {
+    public var description: String {
+        switch self {
+        case .unsupportedType:
+            return "The key type was unsupported"
+        case .parsingFailed:
+            return "Failed to properly parse the SSH certificate"
+        case .doesNotExist:
+            return "Certificate does not exist"
+        }
+    }
+}
 
 /// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
-public final class Agent: Sendable {
+public class Agent {
 
     private let storeList: SecretStoreList
     private let witness: SigningWitness?
-    private let publicKeyWriter = OpenSSHPublicKeyWriter()
-    private let signatureWriter = OpenSSHSignatureWriter()
-    private let certificateHandler = OpenSSHCertificateHandler()
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Agent")
-    private let authorizationCoordinator = AuthorizationCoordinator()
+    private let writer = OpenSSHKeyWriter()
+    private let requestTracer = SigningRequestTracer()
+    private let certsPath = (NSHomeDirectory() as NSString).appendingPathComponent("PublicKeys") as String
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent.agent", category: "")
 
     /// Initializes an agent with a store list and a witness.
     /// - Parameters:
@@ -24,41 +41,58 @@ public final class Agent: Sendable {
         logger.debug("Agent is running")
         self.storeList = storeList
         self.witness = witness
-        Task { @MainActor in
-            await certificateHandler.reloadCertificates(for: storeList.allSecrets)
-        }
     }
     
 }
 
 extension Agent {
 
-    public func handle(request: SSHAgent.Request, provenance: SigningRequestProvenance) async -> Data {
+    /// Handles an incoming request.
+    /// - Parameters:
+    ///   - reader: A ``FileHandleReader`` to read the content of the request.
+    ///   - writer: A ``FileHandleWriter`` to write the response to.
+    /// - Return value: 
+    ///   - Boolean if data could be read
+    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) -> Bool {
+        logger.debug("Agent handling new data")
+        let data = Data(reader.availableData)
+        guard data.count > 4 else { return false}
+        let requestTypeInt = data[4]
+        guard let requestType = SSHAgent.RequestType(rawValue: requestTypeInt) else {
+            writer.write(OpenSSHKeyWriter().lengthAndData(of: SSHAgent.ResponseType.agentFailure.data))
+            logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
+            return true
+        }
+        logger.debug("Agent handling request of type \(requestType.debugDescription)")
+        let subData = Data(data[5...])
+        let response = handle(requestType: requestType, data: subData, reader: reader)
+        writer.write(response)
+        return true
+    }
+
+    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) -> Data {
         // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
-        await reloadSecretsIfNeccessary()
+        reloadSecretsIfNeccessary()
         var response = Data()
         do {
-            switch request {
+            switch requestType {
             case .requestIdentities:
-                response.append(SSHAgent.Response.agentIdentitiesAnswer.data)
-                response.append(await identities())
-                logger.debug("Agent returned \(SSHAgent.Response.agentIdentitiesAnswer.debugDescription)")
-            case .signRequest(let context):
-                response.append(SSHAgent.Response.agentSignResponse.data)
-                response.append(try await sign(data: context.dataToSign, keyBlob: context.keyBlob, provenance: provenance))
-                logger.debug("Agent returned \(SSHAgent.Response.agentSignResponse.debugDescription)")
-            case .unknown(let value):
-                logger.error("Agent received unknown request of type \(value).")
-                throw UnhandledRequestError()
-            default:
-                logger.debug("Agent received valid request of type \(request.debugDescription), but not currently supported.")
-                throw UnhandledRequestError()
+                response.append(SSHAgent.ResponseType.agentIdentitiesAnswer.data)
+                response.append(identities())
+                logger.debug("Agent returned \(SSHAgent.ResponseType.agentIdentitiesAnswer.debugDescription)")
+            case .signRequest:
+                let provenance = requestTracer.provenance(from: reader)
+                response.append(SSHAgent.ResponseType.agentSignResponse.data)
+                response.append(try sign(data: data, provenance: provenance))
+                logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
             }
         } catch {
-            response = SSHAgent.Response.agentFailure.data
-            logger.debug("Agent returned \(SSHAgent.Response.agentFailure.debugDescription)")
+            response.removeAll()
+            response.append(SSHAgent.ResponseType.agentFailure.data)
+            logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
         }
-        return response.lengthAndData
+        let full = OpenSSHKeyWriter().lengthAndData(of: response)
+        return full
     }
 
 }
@@ -67,27 +101,29 @@ extension Agent {
 
     /// Lists the identities available for signing operations
     /// - Returns: An OpenSSH formatted Data payload listing the identities available for signing operations.
-    func identities() async -> Data {
-        let secrets = await storeList.allSecrets
-        await certificateHandler.reloadCertificates(for: secrets)
-        var count = 0
+    func identities() -> Data {
+        let secrets = storeList.stores.flatMap(\.secrets)
+        var count = UInt32(secrets.count).bigEndian
+        let countData = Data(bytes: &count, count: UInt32.bitWidth/8)
         var keyData = Data()
 
         for secret in secrets {
-            let keyBlob = publicKeyWriter.data(secret: secret)
-            keyData.append(keyBlob.lengthAndData)
-            keyData.append(publicKeyWriter.comment(secret: secret).lengthAndData)
-            count += 1
-
-            if let (certificateData, name) = try? await certificateHandler.keyBlobAndName(for: secret) {
-                keyData.append(certificateData.lengthAndData)
-                keyData.append(name.lengthAndData)
-                count += 1
+            let keyBlob: Data
+            let curveData: Data
+            
+            if let (certBlob, certName) = try? checkForCert(secret: secret) {
+                keyBlob = certBlob
+                curveData = certName
+            } else {
+                keyBlob = writer.data(secret: secret)
+                curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
             }
+            
+            keyData.append(writer.lengthAndData(of: keyBlob))
+            keyData.append(writer.lengthAndData(of: curveData))
+            
         }
-        logger.log("Agent enumerated \(count) identities")
-        var countBigEndian = UInt32(count).bigEndian
-        let countData = unsafe Data(bytes: &countBigEndian, count: MemoryLayout<UInt32>.size)
+        logger.log("Agent enumerated \(secrets.count) identities")
         return countData + keyData
     }
 
@@ -96,47 +132,153 @@ extension Agent {
     ///   - data: The data to sign.
     ///   - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request.
     /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
-    func sign(data: Data, keyBlob: Data, provenance: SigningRequestProvenance) async throws -> Data {
-        guard let (secret, store) = await secret(matching: keyBlob) else {
-            let keyBlobHex = keyBlob.compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }.joined()
-            logger.debug("Agent did not have a key matching \(keyBlobHex)")
-            throw NoMatchingKeyError()
+    func sign(data: Data, provenance: SigningRequestProvenance) throws -> Data {
+        let reader = OpenSSHReader(data: data)
+        var hash = reader.readNextChunk()
+        
+        // Check if hash is actually an openssh certificate and reconstruct the public key if it is
+        if let certPublicKey = try? getPublicKeyFromCert(certBlob: hash) {
+            hash = certPublicKey
+        }
+        
+        guard let (store, secret) = secret(matching: hash) else {
+            logger.debug("Agent did not have a key matching \(hash as NSData)")
+            throw AgentError.noMatchingKey
         }
 
-        let decision = try await authorizationCoordinator.waitForAccessIfNeeded(to: secret, provenance: provenance)
-        switch decision {
-        case .proceed:
-            break
-        case .promptForSharedAuth:
-            do {
-                try await store.persistAuthentication(secret: secret, forProvenance: provenance)
-                await authorizationCoordinator.completedPersistence(secret: secret, forProvenance: provenance)
-            } catch {
-                await authorizationCoordinator.didNotCompletePersistence(secret: secret, forProvenance: provenance)
-            }
+        if let witness = witness {
+            try witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
         }
-        try await witness?.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
-        let rawRepresentation = try await store.sign(data: data, with: secret, for: provenance)
-        let signedData = signatureWriter.data(secret: secret, signature: rawRepresentation)
 
-        try await witness?.witness(accessTo: secret, from: store, by: provenance)
+        let dataToSign = reader.readNextChunk()
+        let signed = try store.sign(data: dataToSign, with: secret, for: provenance)
+        let derSignature = signed
+
+        let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
+
+        // Convert from DER formatted rep to raw (r||s)
+
+        let rawRepresentation: Data
+        switch (secret.algorithm, secret.keySize) {
+        case (.ellipticCurve, 256):
+            rawRepresentation = try CryptoKit.P256.Signing.ECDSASignature(derRepresentation: derSignature).rawRepresentation
+        case (.ellipticCurve, 384):
+            rawRepresentation = try CryptoKit.P384.Signing.ECDSASignature(derRepresentation: derSignature).rawRepresentation
+        default:
+            throw AgentError.unsupportedKeyType
+        }
+
+
+        let rawLength = rawRepresentation.count/2
+        // Check if we need to pad with 0x00 to prevent certain
+        // ssh servers from thinking r or s is negative
+        let paddingRange: ClosedRange<UInt8> = 0x80...0xFF
+        var r = Data(rawRepresentation[0..<rawLength])
+        if paddingRange ~= r.first! {
+            r.insert(0x00, at: 0)
+        }
+        var s = Data(rawRepresentation[rawLength...])
+        if paddingRange ~= s.first! {
+            s.insert(0x00, at: 0)
+        }
+
+        var signatureChunk = Data()
+        signatureChunk.append(writer.lengthAndData(of: r))
+        signatureChunk.append(writer.lengthAndData(of: s))
+
+        var signedData = Data()
+        var sub = Data()
+        sub.append(writer.lengthAndData(of: curveData))
+        sub.append(writer.lengthAndData(of: signatureChunk))
+        signedData.append(writer.lengthAndData(of: sub))
+
+        if let witness = witness {
+            try witness.witness(accessTo: secret, from: store, by: provenance)
+        }
 
         logger.debug("Agent signed request")
 
         return signedData
     }
+    
+    /// Reconstructs a public key from a ``Data`` object that contains an OpenSSH certificate. Currently only ecdsa certificates are supported
+    /// - Parameter certBlock: The openssh certificate to extract the public key from
+    /// - Returns: A ``Data`` object containing the public key in OpenSSH wire format
+    func getPublicKeyFromCert(certBlob: Data) throws -> Data {
+        let reader = OpenSSHReader(data: certBlob)
+        let certType = String(decoding: reader.readNextChunk(), as: UTF8.self)
+                
+        switch certType {
+        case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
+            "ecdsa-sha2-nistp384-cert-v01@openssh.com",
+            "ecdsa-sha2-nistp521-cert-v01@openssh.com":
+            
+            _ = reader.readNextChunk() // nonce
+            let curveIdentifier = reader.readNextChunk()
+            let publicKey = reader.readNextChunk()
+            
+            if let curveType = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "").data(using: .utf8) {
+                return writer.lengthAndData(of: curveType) +
+                       writer.lengthAndData(of: curveIdentifier) +
+                       writer.lengthAndData(of: publicKey)
+            } else {
+                throw OpenSSHCertificateError.parsingFailed
+            }
+        default:
+            throw OpenSSHCertificateError.unsupportedType
+        }
+    }
+    
+    
+    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
+    /// - Parameter secret: The secret to search for a certificate with
+    /// - Returns: Two ``Data`` objects containing the certificate and certificate name respectively
+    func checkForCert(secret: AnySecret) throws -> (Data, Data) {
+        let minimalHex = writer.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        let certificatePath = certsPath.appending("/").appending("\(minimalHex)-cert.pub")
+        
+        if FileManager.default.fileExists(atPath: certificatePath) {
+            logger.debug("Found certificate for \(secret.name)")
+            do {
+                let certContent = try String(contentsOfFile:certificatePath, encoding: .utf8)
+                let certElements = certContent.trimmingCharacters(in: .whitespacesAndNewlines).components(separatedBy: " ")
+                
+                if certElements.count >= 2 {
+                    if let certDecoded = Data(base64Encoded: certElements[1] as String) {
+                        if certElements.count >= 3 {
+                            if let certName = certElements[2].data(using: .utf8) {
+                                return (certDecoded, certName)
+                            } else if let certName = secret.name.data(using: .utf8) {
+                                logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
+                                return (certDecoded, certName)
+                            } else {
+                                throw OpenSSHCertificateError.parsingFailed
+                            }
+                        }
+                    } else {
+                        logger.warning("Certificate found for \(secret.name) but failed to decode base64 key")
+                        throw OpenSSHCertificateError.parsingFailed
+                    }
+                }
+            } catch {
+                logger.warning("Certificate found for \(secret.name) but failed to load")
+                throw OpenSSHCertificateError.parsingFailed
+            }
+        }
+        
+        throw OpenSSHCertificateError.doesNotExist
+    }
 
 }
 
 extension Agent {
 
     /// Gives any store with no loaded secrets a chance to reload.
-    func reloadSecretsIfNeccessary() async {
-        for store in await storeList.stores {
-            if await store.secrets.isEmpty {
-                let name = await store.name
-                logger.debug("Store \(name, privacy: .public) has no loaded secrets. Reloading.")
-                await store.reloadSecrets()
+    func reloadSecretsIfNeccessary() {
+        for store in storeList.stores {
+            if store.secrets.isEmpty {
+                logger.debug("Store \(store.name, privacy: .public) has no loaded secrets. Reloading.")
+                store.reloadSecrets()
             }
         }
     }
@@ -144,10 +286,16 @@ extension Agent {
     /// Finds a ``Secret`` matching a specified hash whos signature was requested.
     /// - Parameter hash: The hash to match against.
     /// - Returns: A ``Secret`` and the ``SecretStore`` containing it, if a match is found.
-    func secret(matching hash: Data) async -> (AnySecret, AnySecretStore)? {
-        await storeList.allSecretsWithStores.first {
-            hash == publicKeyWriter.data(secret: $0.0)
-        }
+    func secret(matching hash: Data) -> (AnySecretStore, AnySecret)? {
+        storeList.stores.compactMap { store -> (AnySecretStore, AnySecret)? in
+            let allMatching = store.secrets.filter { secret in
+                hash == writer.data(secret: secret)
+            }
+            if let matching = allMatching.first {
+                return (store, matching)
+            }
+            return nil
+        }.first
     }
 
 }
@@ -155,16 +303,20 @@ extension Agent {
 
 extension Agent {
 
-    struct NoMatchingKeyError: Error {}
-    struct UnhandledRequestError: Error {}
-
-}
-
-extension SSHAgent.Response {
-
-    var data: Data {
-        var raw = self.rawValue
-        return unsafe Data(bytes: &raw, count: MemoryLayout<UInt8>.size)
+    /// An error involving agent operations..
+    enum AgentError: Error {
+        case unhandledType
+        case noMatchingKey
+        case unsupportedKeyType
+    }
+
+}
+
+extension SSHAgent.ResponseType {
+
+    var data: Data {
+        var raw = self.rawValue
+        return  Data(bytes: &raw, count: UInt8.bitWidth/8)
     }
 
 }

Sources/Packages/Sources/SecretAgentKit/AuthorizationCoordinator.swift

@@ -1,105 +0,0 @@
-import Foundation
-import SecretKit
-import os
-import LocalAuthentication
-
-struct PendingRequest: Identifiable, Hashable, CustomStringConvertible {
-    let id: UUID = UUID()
-    let secret: AnySecret
-    let provenance: SigningRequestProvenance
-
-    var description: String {
-        "\(id.uuidString) - \(secret.name) \(provenance.origin.displayName)"
-    }
-
-    func batchable(with request: PendingRequest) -> Bool {
-        secret == request.secret &&
-        provenance.isSameProvenance(as: request.provenance)
-    }
-}
-
-enum Decision {
-    case proceed
-    case promptForSharedAuth
-}
-
-actor RequestHolder {
-
-    var pending: [PendingRequest] = []
-    var authorizing: PendingRequest?
-    var preauthorized: PendingRequest?
-
-    func addPending(_ request: PendingRequest) {
-        pending.append(request)
-    }
-
-    func advanceIfIdle() {
-
-    }
-
-    func shouldBlock(_ request: PendingRequest) -> Bool {
-        guard request != authorizing else { return false }
-        if let preauthorized, preauthorized.batchable(with: request) {
-            print("Batching: \(request)")
-            pending.removeAll(where: { $0 == request })
-            return false
-        }
-        return authorizing == nil && authorizing.
-    }
-
-    func clear() {
-        if let preauthorized, allBatchable(with: preauthorized).isEmpty {
-            self.preauthorized = nil
-        }
-    }
-
-    func allBatchable(with request: PendingRequest) -> [PendingRequest] {
-        pending.filter { $0.batchable(with: request) }
-    }
-
-    func completedPersistence(secret: AnySecret, forProvenance provenance: SigningRequestProvenance) {
-        self.preauthorized = PendingRequest(secret: secret, provenance: provenance)
-    }
-
-    func didNotCompletePersistence(secret: AnySecret, forProvenance provenance: SigningRequestProvenance) {
-        self.preauthorized = nil
-    }
-}
-
-final class AuthorizationCoordinator: Sendable {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "AuthorizationCoordinator")
-    private let holder = RequestHolder()
-
-    public func waitForAccessIfNeeded(to secret: AnySecret, provenance: SigningRequestProvenance) async throws -> Decision {
-        // Block on unknown, since we don't really have any way to check.
-        if secret.authenticationRequirement == .unknown {
-            logger.warning("\(secret.name) has unknown authentication requirement.")
-        }
-        guard secret.authenticationRequirement != .notRequired else {
-            logger.debug("\(secret.name) does not require authentication, continuing.")
-            return .proceed
-        }
-        logger.debug("\(secret.name) requires authentication.")
-        let pending = PendingRequest(secret: secret, provenance: provenance)
-        await holder.addPending(pending)
-        while await holder.shouldBlock(pending) {
-            logger.debug("\(pending) waiting.")
-            try await Task.sleep(for: .milliseconds(100))
-        }
-        if await holder.preauthorized == nil, await holder.allBatchable(with: pending).count > 0 {
-            logger.debug("\(pending) batch suggestion.")
-            return .promptForSharedAuth
-        }
-        logger.debug("\(pending) continuing")
-        return .proceed
-    }
-
-    func completedPersistence(secret: AnySecret, forProvenance provenance: SigningRequestProvenance) async {
-        await holder.completedPersistence(secret: secret, forProvenance: provenance)
-    }
-
-    func didNotCompletePersistence(secret: AnySecret, forProvenance provenance: SigningRequestProvenance) async {
-        await holder.didNotCompletePersistence(secret: secret, forProvenance: provenance)
-    }
-}

Sources/Packages/Sources/SecretAgentKit/FileHandleProtocols.swift

@@ -1,12 +1,32 @@
 import Foundation
 
-extension FileHandle {
+/// Protocol abstraction of the reading aspects of FileHandle.
+public protocol FileHandleReader {
+
+    /// Gets data that is available for reading.
+    var availableData: Data { get }
+    /// A file descriptor of the handle.
+    var fileDescriptor: Int32 { get }
+    /// The  process ID of the process coonnected to the other end of the FileHandle.
+    var pidOfConnectedProcess: Int32 { get }
+
+}
+
+/// Protocol abstraction of the writing aspects of FileHandle.
+public protocol FileHandleWriter {
+
+    /// Writes data to the handle.
+    func write(_ data: Data)
+
+}
+
+extension FileHandle: FileHandleReader, FileHandleWriter {
 
     public var pidOfConnectedProcess: Int32 {
-        let pidPointer = UnsafeMutableRawPointer.allocate(byteCount: MemoryLayout<Int32>.size, alignment: 1)
+        let pidPointer = UnsafeMutableRawPointer.allocate(byteCount: 4, alignment: 1)
         var len = socklen_t(MemoryLayout<Int32>.size)
-        unsafe getsockopt(fileDescriptor, SOCK_STREAM, LOCAL_PEERPID, pidPointer, &len)
-        return unsafe pidPointer.load(as: Int32.self)
+        getsockopt(fileDescriptor, SOCK_STREAM, LOCAL_PEERPID, pidPointer, &len)
+        return pidPointer.load(as: Int32.self)
     }
 
 }

Sources/Packages/Sources/SecretAgentKit/OpenSSHCertificateHandler.swift

@@ -1,89 +0,0 @@
-import Foundation
-import OSLog
-import SecretKit
-import SSHProtocolKit
-
-/// Manages storage and lookup for OpenSSH certificates.
-public actor OpenSSHCertificateHandler: Sendable {
-
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(directory: URL.publicKeyDirectory)
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler")
-    private let writer = OpenSSHPublicKeyWriter()
-    private var keyBlobsAndNames: [AnySecret: (Data, Data)] = [:]
-
-    /// Initializes an OpenSSHCertificateHandler.
-    public init() {
-    }
-
-    /// Reloads any certificates in the PublicKeys folder.
-    /// - Parameter secrets: the secrets to look up corresponding certificates for.
-    public func reloadCertificates(for secrets: [AnySecret]) {
-        guard publicKeyFileStoreController.hasAnyCertificates else {
-            logger.log("No certificates, short circuiting")
-            return
-        }
-        keyBlobsAndNames = secrets.reduce(into: [:]) { partialResult, next in
-            partialResult[next] = try? loadKeyblobAndName(for: next)
-        }
-    }
-
-    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
-    /// - Parameter secret: The secret to search for a certificate with
-    /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
-    public func keyBlobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
-        keyBlobsAndNames[AnySecret(secret)]
-    }
-    
-    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
-    /// - Parameter secret: The secret to search for a certificate with
-    /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
-    private func loadKeyblobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
-        let certificatePath = publicKeyFileStoreController.sshCertificatePath(for: secret)
-        guard FileManager.default.fileExists(atPath: certificatePath) else {
-            return nil
-        }
-
-        logger.debug("Found certificate for \(secret.name)")
-        let certContent = try String(contentsOfFile:certificatePath, encoding: .utf8)
-        let certElements = certContent.trimmingCharacters(in: .whitespacesAndNewlines).components(separatedBy: " ")
-
-        guard certElements.count >= 2 else {
-            logger.warning("Certificate found for \(secret.name) but failed to load")
-            throw OpenSSHCertificateError.parsingFailed
-        }
-        guard let certDecoded = Data(base64Encoded: certElements[1] as String)  else {
-            logger.warning("Certificate found for \(secret.name) but failed to decode base64 key")
-            throw OpenSSHCertificateError.parsingFailed
-        }
-
-        if certElements.count >= 3 {
-            let certName = Data(certElements[2].utf8)
-            return (certDecoded, certName)
-        }
-        let certName = Data(secret.name.utf8)
-        logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
-        return (certDecoded, certName)
-    }
-
-}
-
-extension OpenSSHCertificateHandler {
-
-    enum OpenSSHCertificateError: LocalizedError {
-        case unsupportedType
-        case parsingFailed
-        case doesNotExist
-
-        public var errorDescription: String? {
-            switch self {
-            case .unsupportedType:
-                return "The key type was unsupported"
-            case .parsingFailed:
-                return "Failed to properly parse the SSH certificate"
-            case .doesNotExist:
-                return "Certificate does not exist"
-            }
-        }
-    }
-
-}

Sources/Packages/Sources/SecretAgentKit/PublicKeyStandinFileController.swift

@@ -1,68 +0,0 @@
-import Foundation
-import OSLog
-import SecretKit
-import SSHProtocolKit
-import Common
-
-/// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
-public final class PublicKeyFileStoreController: Sendable {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
-    private let directory: URL
-    private let keyWriter = OpenSSHPublicKeyWriter()
-
-    /// Initializes a PublicKeyFileStoreController.
-    public init(directory: URL) {
-        self.directory = directory
-    }
-
-    /// Writes out the keys specified to disk.
-    /// - Parameter secrets: The Secrets to generate keys for.
-    /// - Parameter clear: Whether or not any untracked files in the directory should be removed.
-    public func generatePublicKeys(for secrets: [AnySecret], clear: Bool = false) throws {
-        logger.log("Writing public keys to disk")
-        if clear {
-            let validPaths = Set(secrets.map { URL.publicKeyPath(for: $0, in: directory) })
-                .union(Set(secrets.map { sshCertificatePath(for: $0) }))
-            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory.path())) ?? []
-            let fullPathContents = contentsOfDirectory.map { directory.appending(path: $0).path() }
-
-            let untracked = Set(fullPathContents)
-                .subtracting(validPaths)
-            for path in untracked {
-                // string instead of fileURLWithPath since we're already using fileURL format.
-                try? FileManager.default.removeItem(at: URL(string: path)!)
-            }
-        }
-        try? FileManager.default.createDirectory(at: directory, withIntermediateDirectories: false, attributes: nil)
-        for secret in secrets {
-            let path = URL.publicKeyPath(for: secret, in: directory)
-            let data = Data(keyWriter.openSSHString(secret: secret).utf8)
-            FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
-        }
-        logger.log("Finished writing public keys")
-    }
-
-
-    /// Short-circuit check to ship enumerating a bunch of paths if there's nothing in the cert directory.
-    public var hasAnyCertificates: Bool {
-        do {
-            return try FileManager.default
-                .contentsOfDirectory(atPath: directory.path())
-                .filter { $0.hasSuffix("-cert.pub") }
-                .isEmpty == false
-        } catch {
-            return false
-        }
-    }
-
-    /// The path for a Secret's SSH Certificate public key.
-    /// - Parameter secret: The Secret to return the path for.
-    /// - Returns: The path to the SSH Certificate public key.
-    /// - Warning: This method returning a path does not imply that a key has a SSH certificates. This method only describes where it will be.
-    public func sshCertificatePath<SecretType: Secret>(for secret: SecretType) -> String {
-        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
-        return directory.appending(component: "\(minimalHex)-cert.pub").path()
-    }
-
-}

Sources/Packages/Sources/SecretAgentKit/SSHAgentInputParser.swift

@@ -1,110 +0,0 @@
-import Foundation
-import OSLog
-import SecretKit
-import SSHProtocolKit
-
-public protocol SSHAgentInputParserProtocol {
-
-    func parse(data: Data) async throws -> SSHAgent.Request
-
-}
-
-public struct SSHAgentInputParser: SSHAgentInputParserProtocol {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "InputParser")
-
-    public init() {
-
-    }
-
-    public func parse(data: Data) throws(AgentParsingError) -> SSHAgent.Request {
-        logger.debug("Parsing new data")
-        guard data.count > 4 else {
-            throw .invalidData
-        }
-        let specifiedLength = unsafe (data[0..<4].bytes.unsafeLoad(as: UInt32.self).bigEndian) + 4
-        let rawRequestInt = data[4]
-        let remainingDataRange = 5..<min(Int(specifiedLength), data.count)
-        lazy var body: Data = { Data(data[remainingDataRange]) }()
-        switch rawRequestInt {
-        case SSHAgent.Request.requestIdentities.protocolID:
-            return .requestIdentities
-        case SSHAgent.Request.signRequest(.empty).protocolID:
-            do {
-                return .signRequest(try signatureRequestContext(from: body))
-            } catch {
-                throw .openSSHReader(error)
-            }
-        case SSHAgent.Request.addIdentity.protocolID:
-            return .addIdentity
-        case SSHAgent.Request.removeIdentity.protocolID:
-            return .removeIdentity
-        case SSHAgent.Request.removeAllIdentities.protocolID:
-            return .removeAllIdentities
-        case SSHAgent.Request.addIDConstrained.protocolID:
-            return .addIDConstrained
-        case SSHAgent.Request.addSmartcardKey.protocolID:
-            return .addSmartcardKey
-        case SSHAgent.Request.removeSmartcardKey.protocolID:
-            return .removeSmartcardKey
-        case SSHAgent.Request.lock.protocolID:
-            return .lock
-        case SSHAgent.Request.unlock.protocolID:
-            return .unlock
-        case SSHAgent.Request.addSmartcardKeyConstrained.protocolID:
-            return .addSmartcardKeyConstrained
-        case SSHAgent.Request.protocolExtension.protocolID:
-            return .protocolExtension
-        default:
-            return .unknown(rawRequestInt)
-        }
-    }
-
-}
-
-extension SSHAgentInputParser {
-
-    func signatureRequestContext(from data: Data) throws(OpenSSHReaderError) -> SSHAgent.Request.SignatureRequestContext {
-        let reader = OpenSSHReader(data: data)
-        let rawKeyBlob = try reader.readNextChunk()
-        let keyBlob = certificatePublicKeyBlob(from: rawKeyBlob) ?? rawKeyBlob
-        let dataToSign = try reader.readNextChunk()
-        return SSHAgent.Request.SignatureRequestContext(keyBlob: keyBlob, dataToSign: dataToSign)
-    }
-
-    func certificatePublicKeyBlob(from hash: Data) -> Data? {
-        let reader = OpenSSHReader(data: hash)
-        do {
-            let certType = String(decoding: try reader.readNextChunk(), as: UTF8.self)
-            switch certType {
-            case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
-                "ecdsa-sha2-nistp384-cert-v01@openssh.com",
-                "ecdsa-sha2-nistp521-cert-v01@openssh.com":
-                _ = try reader.readNextChunk() // nonce
-                let curveIdentifier = try reader.readNextChunk()
-                let publicKey = try reader.readNextChunk()
-                let openSSHIdentifier = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "")
-                return openSSHIdentifier.lengthAndData +
-                curveIdentifier.lengthAndData +
-                publicKey.lengthAndData
-            default:
-                return nil
-            }
-        } catch {
-            return nil
-        }
-    }
-
-}
-
-
-extension SSHAgentInputParser {
-
-    public enum AgentParsingError: Error, Codable {
-        case unknownRequest
-        case unhandledRequest
-        case invalidData
-        case openSSHReader(OpenSSHReaderError)
-    }
-
-}

Sources/Packages/Sources/SecretAgentKit/SSHAgentProtocol.swift

@@ -0,0 +1,43 @@
+import Foundation
+
+/// A namespace for the SSH Agent Protocol, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html
+public enum SSHAgent {}
+
+extension SSHAgent {
+
+    /// The type of the SSH Agent Request, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html#rfc.section.5.1
+    public enum RequestType: UInt8, CustomDebugStringConvertible {
+
+        case requestIdentities = 11
+        case signRequest = 13
+
+        public var debugDescription: String {
+            switch self {
+            case .requestIdentities:
+                return "RequestIdentities"
+            case .signRequest:
+                return "SignRequest"
+            }
+        }
+    }
+
+    /// The type of the SSH Agent Response, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html#rfc.section.5.1
+    public enum ResponseType: UInt8, CustomDebugStringConvertible {
+        
+        case agentFailure = 5
+        case agentIdentitiesAnswer = 12
+        case agentSignResponse = 14
+
+        public var debugDescription: String {
+            switch self {
+            case .agentFailure:
+                return "AgentFailure"
+            case .agentIdentitiesAnswer:
+                return "AgentIdentitiesAnswer"
+            case .agentSignResponse:
+                return "AgentSignResponse"
+            }
+        }
+    }
+    
+}

Sources/Packages/Sources/SecretAgentKit/SigningRequestTracer.swift

@@ -2,6 +2,7 @@ import Foundation
 import AppKit
 import Security
 import SecretKit
+import SecretAgentKitHeaders
 
 /// An object responsible for generating ``SecretKit.SigningRequestProvenance`` objects.
 struct SigningRequestTracer {
@@ -9,11 +10,12 @@ struct SigningRequestTracer {
 
 extension SigningRequestTracer {
 
-    /// Generates a ``SecretKit.SigningRequestProvenance`` from a ``FileHandle``.
-    /// - Parameter fileHandle: The reader involved in processing the request.
+    /// Generates a ``SecretKit.SigningRequestProvenance`` from a ``FileHandleReader``.
+    /// - Parameter fileHandleReader: The reader involved in processing the request.
     /// - Returns: A ``SecretKit.SigningRequestProvenance`` describing the origin of the request.
-    func provenance(from fileHandle: FileHandle) -> SigningRequestProvenance {
-        let firstInfo = process(from: fileHandle.pidOfConnectedProcess)
+    func provenance(from fileHandleReader: FileHandleReader) -> SigningRequestProvenance {
+        let firstInfo = process(from: fileHandleReader.pidOfConnectedProcess)
+
         var provenance = SigningRequestProvenance(root: firstInfo)
         while NSRunningApplication(processIdentifier: provenance.origin.pid) == nil && provenance.origin.parentPID != nil {
             provenance.chain.append(process(from: provenance.origin.parentPID!))
@@ -25,30 +27,30 @@ extension SigningRequestTracer {
     /// - Parameter pid: The process ID to look up.
     /// - Returns: a `kinfo_proc` struct describing the process ID.
     func pidAndNameInfo(from pid: Int32) -> kinfo_proc {
-        var len = unsafe MemoryLayout<kinfo_proc>.size
+        var len = MemoryLayout<kinfo_proc>.size
         let infoPointer = UnsafeMutableRawPointer.allocate(byteCount: len, alignment: 1)
         var name: [Int32] = [CTL_KERN, KERN_PROC, KERN_PROC_PID, pid]
-        unsafe sysctl(&name, UInt32(name.count), infoPointer, &len, nil, 0)
-        return unsafe infoPointer.load(as: kinfo_proc.self)
+        sysctl(&name, UInt32(name.count), infoPointer, &len, nil, 0)
+        return infoPointer.load(as: kinfo_proc.self)
     }
 
     /// Generates a ``SecretKit.SigningRequestProvenance.Process`` from a provided process ID.
     /// - Parameter pid: The process ID to look up.
     /// - Returns: A ``SecretKit.SigningRequestProvenance.Process`` describing the process.
     func process(from pid: Int32) -> SigningRequestProvenance.Process {
-        var pidAndNameInfo = unsafe self.pidAndNameInfo(from: pid)
-        let ppid = unsafe pidAndNameInfo.kp_eproc.e_ppid != 0 ? pidAndNameInfo.kp_eproc.e_ppid : nil
-        let procName = unsafe withUnsafeMutablePointer(to: &pidAndNameInfo.kp_proc.p_comm.0) { pointer in
-            unsafe String(cString: pointer)
+        var pidAndNameInfo = self.pidAndNameInfo(from: pid)
+        let ppid = pidAndNameInfo.kp_eproc.e_ppid != 0 ? pidAndNameInfo.kp_eproc.e_ppid : nil
+        let procName = withUnsafeMutablePointer(to: &pidAndNameInfo.kp_proc.p_comm.0) { pointer in
+            String(cString: pointer)
         }
 
         let pathPointer = UnsafeMutablePointer<UInt8>.allocate(capacity: Int(MAXPATHLEN))
-        _ = unsafe proc_pidpath(pid, pathPointer, UInt32(MAXPATHLEN))
-        let path = unsafe String(cString: pathPointer)
+        _ = proc_pidpath(pid, pathPointer, UInt32(MAXPATHLEN))
+        let path = String(cString: pathPointer)
         var secCode: Unmanaged<SecCode>!
         let flags: SecCSFlags = [.considerExpiration, .enforceRevocationChecks]
-        unsafe SecCodeCreateWithPID(pid, SecCSFlags(), &secCode)
-        let valid = unsafe SecCodeCheckValidity(secCode.takeRetainedValue(), flags, nil) == errSecSuccess
+        SecCodeCreateWithPID(pid, SecCSFlags(), &secCode)
+        let valid = SecCodeCheckValidity(secCode.takeRetainedValue(), flags, nil) == errSecSuccess
         return SigningRequestProvenance.Process(pid: pid, processName: procName, appName: appName(for: pid), iconURL: iconURL(for: pid), path: path, validSignature: valid, parentPID: ppid)
     }
 
@@ -58,10 +60,7 @@ extension SigningRequestTracer {
     func iconURL(for pid: Int32) -> URL? {
         do {
             if let app = NSRunningApplication(processIdentifier: pid), let icon = app.icon?.tiffRepresentation {
-                let temporaryURL = URL(fileURLWithPath: (NSTemporaryDirectory() as NSString).appendingPathComponent("\(app.bundleIdentifier ?? UUID().uuidString).png"))
-                if FileManager.default.fileExists(atPath: temporaryURL.path) {
-                    return temporaryURL
-                }
+                let temporaryURL = URL(fileURLWithPath: (NSTemporaryDirectory() as NSString).appendingPathComponent("\(UUID().uuidString).png"))
                 let bitmap = NSBitmapImageRep(data: icon)
                 try bitmap?.representation(using: .png, properties: [:])?.write(to: temporaryURL)
                 return temporaryURL
@@ -79,11 +78,3 @@ extension SigningRequestTracer {
     }
 
 }
-
-// from libproc.h
-@_silgen_name("proc_pidpath")
-@discardableResult func proc_pidpath(_ pid: Int32, _ buffer: UnsafeMutableRawPointer!, _ buffersize: UInt32) -> Int32
-
-//// from SecTask.h
-@_silgen_name("SecCodeCreateWithPID")
-@discardableResult func SecCodeCreateWithPID(_: Int32, _: SecCSFlags, _: UnsafeMutablePointer<Unmanaged<SecCode>?>!) -> OSStatus

Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift

@@ -2,7 +2,7 @@ import Foundation
 import SecretKit
 
 /// A protocol that allows conformers to be notified of access to secrets, and optionally prevent access.
-public protocol SigningWitness: Sendable {
+public protocol SigningWitness {
 
     /// A ridiculously named method that notifies the callee that a signing operation is about to be performed using a secret. The callee may `throw` an `Error` to prevent access from occurring.
     /// - Parameters:
@@ -10,13 +10,13 @@ public protocol SigningWitness: Sendable {
     ///   - store: The `Store` being asked to sign the request..
     ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
     ///   - Note: This method being called does not imply that the requst has been authorized. If a secret requires authentication, authentication will still need to be performed by the user before the request will be performed. If the user declines or fails to authenticate, the request will fail.
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws
 
     /// Notifies the callee that a signing operation has been performed for a given secret.
     /// - Parameters:
     ///   - secret: The `Secret` that will was used to sign the request.
     ///   - store: The `Store` that signed the request..
     ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws
 
 }

Sources/Packages/Sources/SecretAgentKit/SocketController.swift

@@ -1,146 +1,89 @@
 import Foundation
 import OSLog
-import SecretKit
 
 /// A controller that manages socket configuration and request dispatching.
-public struct SocketController {
+public class SocketController {
 
-    /// A stream of Sessions. Each session represents one connection to a class communicating with the socket. Multiple Sessions may be active simultaneously.
-    public let sessions: AsyncStream<Session>
+    /// The active FileHandle.
+    private var fileHandle: FileHandle?
+    /// The active SocketPort.
+    private var port: SocketPort?
+    /// A handler that will be notified when a new read/write handle is available.
+    /// False if no data could be read
+    public var handler: ((FileHandleReader, FileHandleWriter) -> Bool)?
 
-    /// A continuation to create new sessions.
-    private let sessionsContinuation: AsyncStream<Session>.Continuation
-
-    /// The active SocketPort. Must be retained to be kept valid.
-    private let port: SocketPort
-
-    /// The FileHandle for the main socket.
-    private let fileHandle: FileHandle
-    
-    /// Logger for the socket controller.
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "SocketController")
-
-    /// Tracer which determines who originates a socket connection.
-    private let requestTracer = SigningRequestTracer()
 
     /// Initializes a socket controller with a specified path.
     /// - Parameter path: The path to use as a socket.
     public init(path: String) {
-        (sessions, sessionsContinuation) = AsyncStream<Session>.makeStream()
-        logger.debug("Socket controller setting up at \(path)")
+        Logger().debug("Socket controller setting up at \(path)")
         if let _ = try? FileManager.default.removeItem(atPath: path) {
-            logger.debug("Socket controller removed existing socket")
+            Logger().debug("Socket controller removed existing socket")
         }
         let exists = FileManager.default.fileExists(atPath: path)
         assert(!exists)
-        logger.debug("Socket controller path is clear")
-        port = SocketPort(path: path)
+        Logger().debug("Socket controller path is clear")
+        port = socketPort(at: path)
+        configureSocket(at: path)
+        Logger().debug("Socket listening at \(path)")
+    }
+
+    /// Configures the socket and a corresponding FileHandle.
+    /// - Parameter path: The path to use as a socket.
+    func configureSocket(at path: String) {
+        guard let port = port else { return }
         fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
-        Task { @MainActor [fileHandle, sessionsContinuation, logger] in
-            // Create the sequence before triggering the notification to
-            // ensure it will not be missed.
-            let connectionAcceptedNotifications = NotificationCenter.default.notifications(named: .NSFileHandleConnectionAccepted)
-
-            fileHandle.acceptConnectionInBackgroundAndNotify()
-
-            for await notification in connectionAcceptedNotifications {
-                logger.debug("Socket controller accepted connection")
-                guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { continue }
-                let session = Session(fileHandle: new)
-                sessionsContinuation.yield(session)
-                fileHandle.acceptConnectionInBackgroundAndNotify()
-            }
-        }
-        logger.debug("Socket listening at \(path)")
+        NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionAccept(notification:)), name: .NSFileHandleConnectionAccepted, object: nil)
+        NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionDataAvailable(notification:)), name: .NSFileHandleDataAvailable, object: nil)
+        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
     }
 
-}
-
-extension SocketController {
-    
-    /// A session represents a connection that has been established between the two ends of the socket.
-    public struct Session: Sendable {
-        
-        /// Data received by the socket.
-        public let messages: AsyncStream<Data>
-
-        /// The provenance of the process that established the session.
-        public let provenance: SigningRequestProvenance
-        
-        /// A FileHandle used to communicate with the socket.
-        private let fileHandle: FileHandle
-
-        /// A continuation for issuing new messages.
-        private let messagesContinuation: AsyncStream<Data>.Continuation
-
-        /// A logger for the session.
-        private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Session")
-        
-        /// Initializes a new Session.
-        /// - Parameter fileHandle: The FileHandle used to communicate with the socket.
-        init(fileHandle: FileHandle) {
-            self.fileHandle = fileHandle
-            provenance = SigningRequestTracer().provenance(from: fileHandle)
-            (messages, messagesContinuation) = AsyncStream.makeStream()
-            Task { @MainActor [messagesContinuation, logger] in
-                // Create the sequence before triggering the notification to
-                // ensure it will not be missed.
-                let dataAvailableNotifications = NotificationCenter.default.notifications(named: .NSFileHandleDataAvailable, object: fileHandle)
-
-                fileHandle.waitForDataInBackgroundAndNotify()
-
-                for await _ in dataAvailableNotifications {
-                    let data = fileHandle.availableData
-                    guard !data.isEmpty else {
-                        logger.debug("Socket controller received empty data, ending continuation.")
-                        messagesContinuation.finish()
-                        try fileHandle.close()
-                        return
-                    }
-                    messagesContinuation.yield(data)
-                    logger.debug("Socket controller yielded data.")
-                }
-            }
-        }
-        
-        /// Writes new data to the socket.
-        /// - Parameter data: The data to write.
-        @MainActor public func write(_ data: Data) throws {
-          try fileHandle.write(contentsOf: data)
-          fileHandle.waitForDataInBackgroundAndNotify()
-        }
-        
-        /// Closes the socket and cleans up resources.
-        public func close() throws {
-            logger.debug("Session closed.")
-            messagesContinuation.finish()
-            try fileHandle.close()
-        }
-
-    }
-
-}
-
-private extension SocketPort {
-
-    convenience init(path: String) {
+    /// Creates a SocketPort for a path.
+    /// - Parameter path: The path to use as a socket.
+    /// - Returns: A configured SocketPort.
+    func socketPort(at path: String) -> SocketPort {
         var addr = sockaddr_un()
+        addr.sun_family = sa_family_t(AF_UNIX)
 
-        let length = unsafe withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in
-            unsafe path.withCString { cstring in
-                let len = unsafe strlen(cstring)
-                unsafe strncpy(pointer, cstring, len)
-                return len
+        var len: Int = 0
+        withUnsafeMutablePointer(to: &addr.sun_path.0) { pointer in
+            path.withCString { cstring in
+                len = strlen(cstring)
+                strncpy(pointer, cstring, len)
             }
         }
-        // This doesn't seem to be _strictly_ neccessary with SocketPort.
-        // but just for good form.
-        addr.sun_family = sa_family_t(AF_UNIX)
-        // This mirrors the SUN_LEN macro format.
-        addr.sun_len = UInt8(MemoryLayout<sockaddr_un>.size - MemoryLayout.size(ofValue: addr.sun_path) + length)
+        addr.sun_len = UInt8(len+2)
 
-        let data = unsafe Data(bytes: &addr, count: MemoryLayout<sockaddr_un>.size)
-        self.init(protocolFamily: AF_UNIX, socketType: SOCK_STREAM, protocol: 0, address: data)!
+        var data: Data!
+        withUnsafePointer(to: &addr) { pointer in
+            data = Data(bytes: pointer, count: MemoryLayout<sockaddr_un>.size)
+        }
+
+        return SocketPort(protocolFamily: AF_UNIX, socketType: SOCK_STREAM, protocol: 0, address: data)!
+    }
+
+    /// Handles a new connection being accepted, invokes the handler, and prepares to accept new connections.
+    /// - Parameter notification: A `Notification` that triggered the call.
+    @objc func handleConnectionAccept(notification: Notification) {
+        Logger().debug("Socket controller accepted connection")
+        guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { return }
+        _ = handler?(new, new)
+        new.waitForDataInBackgroundAndNotify()
+        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
+    }
+
+    /// Handles a new connection providing data and invokes the handler callback.
+    /// - Parameter notification: A `Notification` that triggered the call.
+    @objc func handleConnectionDataAvailable(notification: Notification) {
+        Logger().debug("Socket controller has new data available")
+        guard let new = notification.object as? FileHandle else { return }
+        Logger().debug("Socket controller received new file handle")
+        if((handler?(new, new)) == true) {
+            Logger().debug("Socket controller handled data, wait for more data")
+            new.waitForDataInBackgroundAndNotify()
+        } else {
+            Logger().debug("Socket controller called with empty data, socked closed")
+        }
     }
 
 }

Sources/Packages/Sources/SecretAgentKitHeaders/Stub.swift

@@ -0,0 +1 @@
+

Sources/Packages/Sources/SecretAgentKitHeaders/include/SecretAgentKit.h

@@ -0,0 +1,19 @@
+#import <Foundation/Foundation.h>
+#import <Security/Security.h>
+
+
+// Forward declarations
+
+// from libproc.h
+int proc_pidpath(int pid, void * buffer, uint32_t  buffersize);
+
+// from SecTask.h
+OSStatus SecCodeCreateWithPID(int32_t, SecCSFlags, SecCodeRef *);
+
+//! Project version number for SecretAgentKit.
+FOUNDATION_EXPORT double SecretAgentKitVersionNumber;
+
+//! Project version string for SecretAgentKit.
+FOUNDATION_EXPORT const unsigned char SecretAgentKitVersionString[];
+
+

Sources/Packages/Sources/SecretAgentKitHeaders/module.modulemap

@@ -0,0 +1,4 @@
+module SecretAgentKitHeaders [system] {
+    header "include/SecretAgentKit.h"
+    export *
+}

Sources/Packages/Sources/SecretKit/Convenience/PersistentAuthenticationHandler.swift

@@ -1,95 +0,0 @@
-import LocalAuthentication
-
-/// A context describing a persisted authentication.
-package struct PersistentAuthenticationContext<SecretType: Secret>: PersistedAuthenticationContext {
-
-    /// The Secret to persist authentication for.
-    let secret: SecretType
-    /// The LAContext used to authorize the persistent context.
-    package nonisolated(unsafe) let context: LAContext
-    /// An expiration date for the context.
-    /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
-    let monotonicExpiration: UInt64
-
-    /// Initializes a context.
-    /// - Parameters:
-    ///   - secret: The Secret to persist authentication for.
-    ///   - context: The LAContext used to authorize the persistent context.
-    ///   - duration: The duration of the authorization context, in seconds.
-    init(secret: SecretType, context: LAContext, duration: TimeInterval) {
-        self.secret = secret
-        unsafe self.context = context
-        let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
-        self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
-    }
-
-    /// A boolean describing whether or not the context is still valid.
-    package var valid: Bool {
-        clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
-    }
-
-    package var expiration: Date {
-        let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
-        let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
-        return Date(timeIntervalSinceNow: remainingInSeconds)
-    }
-}
-
-struct ScopedPersistentAuthenticationContext<SecretType: Secret>: Hashable {
-    let provenance: SigningRequestProvenance
-    let secret: SecretType
-}
-
-package actor PersistentAuthenticationHandler<SecretType: Secret>: Sendable {
-
-    private var unscopedPersistedAuthenticationContexts: [SecretType: PersistentAuthenticationContext<SecretType>] = [:]
-    private var scopedPersistedAuthenticationContexts: [ScopedPersistentAuthenticationContext<SecretType>: PersistentAuthenticationContext<SecretType>] = [:]
-
-    package init() {
-    }
-
-    package func existingPersistedAuthenticationContext(secret: SecretType, provenance: SigningRequestProvenance) -> PersistentAuthenticationContext<SecretType>? {
-        if let unscopedPersistence = unscopedPersistedAuthenticationContexts[secret], unscopedPersistence.valid {
-            return unscopedPersistence
-        }
-        if let scopedPersistence = scopedPersistedAuthenticationContexts[.init(provenance: provenance, secret: secret)], scopedPersistence.valid {
-            return scopedPersistence
-        }
-        return nil
-    }
-
-    package func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) async throws {
-        let newContext = LAContext()
-        newContext.touchIDAuthenticationAllowableReuseDuration = duration
-        newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-
-        let formatter = DateComponentsFormatter()
-        formatter.unitsStyle = .spellOut
-        formatter.allowedUnits = [.hour, .minute, .day]
-
-
-        let durationString = formatter.string(from: duration)!
-        newContext.localizedReason = String(localized: .authContextPersistForDuration(secretName: secret.name, duration: durationString))
-        let success = try await newContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: newContext.localizedReason)
-        guard success else { return }
-        let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
-        unscopedPersistedAuthenticationContexts[secret] = context
-    }
-
-    package func persistAuthentication(secret: SecretType, provenance: SigningRequestProvenance) async throws {
-        let newContext = LAContext()
-
-        // FIXME: TEMPORARY
-        let duration: TimeInterval = 10000
-        newContext.touchIDAuthenticationAllowableReuseDuration = duration
-        newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-
-        newContext.localizedReason = "Batch requests"
-        let success = try await newContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: newContext.localizedReason)
-        guard success else { return }
-        let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
-        scopedPersistedAuthenticationContexts[.init(provenance: provenance, secret: secret)] = context
-    }
-
-}
-

Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md

@@ -22,7 +22,7 @@ SecretKit is a collection of protocols describing secrets and stores.
 
 ### OpenSSH 
 
-- ``OpenSSHPublicKeyWriter``
+- ``OpenSSHKeyWriter``
 - ``OpenSSHReader``
 
 ### Signing Process
@@ -32,9 +32,3 @@ SecretKit is a collection of protocols describing secrets and stores.
 ### Authentication Persistence
 
 - ``PersistedAuthenticationContext``
-
-### Errors
-
-- ``KeychainError``
-- ``SigningError``
-- ``SecurityError``

Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift

@@ -1,30 +1,36 @@
 import Foundation
 
 /// Type eraser for Secret.
-public struct AnySecret: Secret, @unchecked Sendable {
+public struct AnySecret: Secret {
 
-    public let base: any Secret
+    let base: Any
+    private let hashable: AnyHashable
     private let _id: () -> AnyHashable
     private let _name: () -> String
+    private let _algorithm: () -> Algorithm
+    private let _keySize: () -> Int
+    private let _requiresAuthentication: () -> Bool
     private let _publicKey: () -> Data
-    private let _attributes: () -> Attributes
-    private let _eq: (AnySecret) -> Bool
 
     public init<T>(_ secret: T) where T: Secret {
         if let secret = secret as? AnySecret {
             base = secret.base
+            hashable = secret.hashable
             _id = secret._id
             _name = secret._name
+            _algorithm = secret._algorithm
+            _keySize = secret._keySize
+            _requiresAuthentication = secret._requiresAuthentication
             _publicKey = secret._publicKey
-            _attributes = secret._attributes
-            _eq = secret._eq
         } else {
-            base = secret
+            base = secret as Any
+            self.hashable = secret
             _id = { secret.id as AnyHashable }
             _name = { secret.name }
+            _algorithm = { secret.algorithm }
+            _keySize = { secret.keySize }
+            _requiresAuthentication = { secret.requiresAuthentication }
             _publicKey = { secret.publicKey }
-            _attributes = { secret.attributes }
-            _eq = { secret == $0.base as? T }
         }
     }
 
@@ -36,20 +42,28 @@ public struct AnySecret: Secret, @unchecked Sendable {
         _name()
     }
 
+    public var algorithm: Algorithm {
+        _algorithm()
+    }
+
+    public var keySize: Int {
+        _keySize()
+    }
+
+    public var requiresAuthentication: Bool {
+        _requiresAuthentication()
+    }
+
     public var publicKey: Data {
         _publicKey()
     }
-    
-    public var attributes: Attributes {
-        _attributes()
-    }
 
     public static func == (lhs: AnySecret, rhs: AnySecret) -> Bool {
-        lhs._eq(rhs)
+        lhs.hashable == rhs.hashable
     }
 
     public func hash(into hasher: inout Hasher) {
-        id.hash(into: &hasher)
+        hashable.hash(into: &hasher)
     }
 
 }

Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift

@@ -1,18 +1,20 @@
 import Foundation
+import Combine
 
 /// Type eraser for SecretStore.
-open class AnySecretStore: SecretStore, @unchecked Sendable {
+public class AnySecretStore: SecretStore {
 
-    let base: any SecretStore
-    private let _isAvailable: @MainActor @Sendable () -> Bool
-    private let _id: @Sendable () -> UUID
-    private let _name: @MainActor @Sendable () -> String
-    private let _secrets: @MainActor @Sendable () -> [AnySecret]
-    private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance) async throws -> Data
-    private let _existingPersistedAuthenticationContext: @Sendable (AnySecret, SigningRequestProvenance) async -> PersistedAuthenticationContext?
-    private let _persistAuthenticationForDuration: @Sendable (AnySecret, TimeInterval) async throws -> Void
-    private let _persistAuthenticationForProvenance: @Sendable (AnySecret, SigningRequestProvenance) async throws -> Void
-    private let _reloadSecrets: @Sendable () async -> Void
+    let base: Any
+    private let _isAvailable: () -> Bool
+    private let _id: () -> UUID
+    private let _name: () -> String
+    private let _secrets: () -> [AnySecret]
+    private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data
+    private let _existingPersistedAuthenticationContext: (AnySecret) -> PersistedAuthenticationContext?
+    private let _persistAuthentication: (AnySecret, TimeInterval) throws -> Void
+    private let _reloadSecrets: () -> Void
+
+    private var sink: AnyCancellable?
 
     public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore {
         base = secretStore
@@ -20,14 +22,16 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
         _name = { secretStore.name }
         _id = { secretStore.id }
         _secrets = { secretStore.secrets.map { AnySecret($0) } }
-        _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
-        _existingPersistedAuthenticationContext = { await secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType, provenance: $1) }
-        _persistAuthenticationForDuration = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
-        _persistAuthenticationForProvenance = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forProvenance: $1) }
-        _reloadSecrets = { await secretStore.reloadSecrets() }
+        _sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
+        _existingPersistedAuthenticationContext = { secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
+        _persistAuthentication = { try secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
+        _reloadSecrets = { secretStore.reloadSecrets() }
+        sink = secretStore.objectWillChange.sink { _ in
+            self.objectWillChange.send()
+        }
     }
 
-    @MainActor public var isAvailable: Bool {
+    public var isAvailable: Bool {
         return _isAvailable()
     }
 
@@ -35,66 +39,55 @@ open class AnySecretStore: SecretStore, @unchecked Sendable {
         return _id()
     }
 
-    @MainActor public var name: String {
+    public var name: String {
         return _name()
     }
 
-    @MainActor public var secrets: [AnySecret] {
+    public var secrets: [AnySecret] {
         return _secrets()
     }
 
-    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) async throws -> Data {
-        try await _sign(data, secret, provenance)
+    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> Data {
+        try _sign(data, secret, provenance)
     }
 
-    public func existingPersistedAuthenticationContext(secret: AnySecret, provenance: SigningRequestProvenance) async -> PersistedAuthenticationContext? {
-        await _existingPersistedAuthenticationContext(secret, provenance)
+    public func existingPersistedAuthenticationContext(secret: AnySecret) -> PersistedAuthenticationContext? {
+        _existingPersistedAuthenticationContext(secret)
     }
 
-    public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) async throws {
-        try await _persistAuthenticationForDuration(secret, duration)
+    public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) throws {
+        try _persistAuthentication(secret, duration)
     }
 
-    public func persistAuthentication(secret: AnySecret, forProvenance provenance: SigningRequestProvenance) async throws {
-        try await _persistAuthenticationForProvenance(secret, provenance)
-    }
-
-    public func reloadSecrets() async {
-        await _reloadSecrets()
+    public func reloadSecrets() {
+        _reloadSecrets()
     }
 
 }
 
-public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable, @unchecked Sendable {
+public class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable {
 
-    private let _create: @Sendable (String, Attributes) async throws -> AnySecret
-    private let _delete: @Sendable (AnySecret) async throws -> Void
-    private let _update: @Sendable (AnySecret, String, Attributes) async throws -> Void
-    private let _supportedKeyTypes: @Sendable () -> KeyAvailability
+    private let _create: (String, Bool) throws -> Void
+    private let _delete: (AnySecret) throws -> Void
+    private let _update: (AnySecret, String) throws -> Void
 
-    public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
-        _create = { AnySecret(try await secretStore.create(name: $0, attributes: $1)) }
-        _delete = { try await secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
-        _update = { try await secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1, attributes: $2) }
-        _supportedKeyTypes = { secretStore.supportedKeyTypes }
+    public init<SecretStoreType>(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
+        _create = { try secretStore.create(name: $0, requiresAuthentication: $1) }
+        _delete = { try secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
+        _update = { try secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) }
         super.init(secretStore)
     }
 
-    @discardableResult
-    public func create(name: String, attributes: Attributes) async throws -> SecretType {
-        try await _create(name, attributes)
+    public func create(name: String, requiresAuthentication: Bool) throws {
+        try _create(name, requiresAuthentication)
     }
 
-    public func delete(secret: AnySecret) async throws {
-        try await _delete(secret)
+    public func delete(secret: AnySecret) throws {
+        try _delete(secret)
     }
 
-    public func update(secret: AnySecret, name: String, attributes: Attributes) async throws {
-        try await _update(secret, name, attributes)
-    }
-
-    public var supportedKeyTypes: KeyAvailability {
-        _supportedKeyTypes()
+    public func update(secret: AnySecret, name: String) throws {
+        try _update(secret, name)
     }
 
 }

Sources/Packages/Sources/SecretKit/KeychainTypes.swift

@@ -1,69 +0,0 @@
-import Foundation
-
-public typealias SecurityError = Unmanaged<CFError>
-
-/// Wraps a Swift dictionary in a CFDictionary.
-/// - Parameter dictionary: The Swift dictionary to wrap.
-/// - Returns: A CFDictionary containing the keys and values.
-public func KeychainDictionary(_ dictionary: [CFString: Any]) -> CFDictionary {
-    dictionary as CFDictionary
-}
-
-public extension CFError {
-
-    /// The CFError returned when a verification operation fails.
-    static let verifyError = CFErrorCreate(nil, NSOSStatusErrorDomain as CFErrorDomain, CFIndex(errSecVerifyFailed), nil)!
-
-    /// Equality operation that only considers domain and code.
-    static func ~=(lhs: CFError, rhs: CFError) -> Bool {
-        CFErrorGetDomain(lhs) == CFErrorGetDomain(rhs) && CFErrorGetCode(lhs) == CFErrorGetCode(rhs)
-    }
-
-}
-
-/// A wrapper around an error code reported by a Keychain API.
-public struct KeychainError: Error {
-    /// The status code involved, if one was reported.
-    public let statusCode: OSStatus?
-
-    /// Initializes a KeychainError with an optional error code.
-    /// - Parameter statusCode: The status code returned by the keychain operation, if one is applicable.
-    public init(statusCode: OSStatus?) {
-        self.statusCode = statusCode
-    }
-}
-
-/// A signing-related error.
-public struct SigningError: Error {
-    /// The underlying error reported by the API, if one was returned.
-    public let error: CFError?
-
-    /// Initializes a SigningError with an optional SecurityError.
-    /// - Parameter statusCode: The SecurityError, if one is applicable.
-    public init(error: SecurityError?) {
-        self.error = unsafe error?.takeRetainedValue()
-    }
-
-}
-
-public extension SecretStore {
-
-    /// Returns the appropriate keychian signature algorithm to use for a given secret.
-    /// - Parameters:
-    ///   - secret: The secret which will be used for signing.
-    /// - Returns: The appropriate algorithm.
-    func signatureAlgorithm(for secret: SecretType) -> SecKeyAlgorithm? {
-        switch secret.keyType {
-        case .ecdsa256:
-            .ecdsaSignatureMessageX962SHA256
-        case .ecdsa384:
-            .ecdsaSignatureMessageX962SHA384
-        case .rsa2048:
-            .rsaSignatureMessagePKCS1v15SHA512
-        default:
-            nil
-        }
-
-    }
-
-}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift

@@ -0,0 +1,82 @@
+import Foundation
+import CryptoKit
+
+/// Generates OpenSSH representations of Secrets.
+public struct OpenSSHKeyWriter {
+
+    /// Initializes the writer.
+    public init() {
+    }
+
+    /// Generates an OpenSSH data payload identifying the secret.
+    /// - Returns: OpenSSH data payload identifying the secret.
+    public func data<SecretType: Secret>(secret: SecretType) -> Data {
+        lengthAndData(of: curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
+            lengthAndData(of: curveIdentifier(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!) +
+            lengthAndData(of: secret.publicKey)
+    }
+
+    /// Generates an OpenSSH string representation of the secret.
+    /// - Returns: OpenSSH string representation of the secret.
+    public func openSSHString<SecretType: Secret>(secret: SecretType, comment: String? = nil) -> String {
+        [curveType(for: secret.algorithm, length: secret.keySize), data(secret: secret).base64EncodedString(), comment]
+            .compactMap { $0 }
+            .joined(separator: " ")
+    }
+
+    /// Generates an OpenSSH SHA256 fingerprint string.
+    /// - Returns: OpenSSH SHA256 fingerprint string.
+    public func openSSHSHA256Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
+        // OpenSSL format seems to strip the padding at the end.
+        let base64 = Data(SHA256.hash(data: data(secret: secret))).base64EncodedString()
+        let paddingRange = base64.index(base64.endIndex, offsetBy: -2)..<base64.endIndex
+        let cleaned = base64.replacingOccurrences(of: "=", with: "", range: paddingRange)
+        return "SHA256:\(cleaned)"
+    }
+
+    /// Generates an OpenSSH MD5 fingerprint string.
+    /// - Returns: OpenSSH MD5 fingerprint string.
+    public func openSSHMD5Fingerprint<SecretType: Secret>(secret: SecretType) -> String {
+        Insecure.MD5.hash(data: data(secret: secret))
+            .compactMap { ("0" + String($0, radix: 16, uppercase: false)).suffix(2) }
+            .joined(separator: ":")
+    }
+
+}
+
+extension OpenSSHKeyWriter {
+
+    /// Creates an OpenSSH protocol style data object, which has a length header, followed by the data payload.
+    /// - Parameter data: The data payload.
+    /// - Returns: OpenSSH data.
+    public func lengthAndData(of data: Data) -> Data {
+        let rawLength = UInt32(data.count)
+        var endian = rawLength.bigEndian
+        return Data(bytes: &endian, count: UInt32.bitWidth/8) + data
+    }
+
+    /// The fully qualified OpenSSH identifier for the algorithm.
+    /// - Parameters:
+    ///   - algorithm: The algorithm to identify.
+    ///   - length: The key length of the algorithm.
+    /// - Returns: The OpenSSH identifier for the algorithm.
+    public func curveType(for algorithm: Algorithm, length: Int) -> String {
+        switch algorithm {
+        case .ellipticCurve:
+            return "ecdsa-sha2-nistp" + String(describing: length)
+        }
+    }
+
+    /// The OpenSSH identifier for an algorithm.
+    /// - Parameters:
+    ///   - algorithm: The algorithm to identify.
+    ///   - length: The key length of the algorithm.
+    /// - Returns: The OpenSSH identifier for the algorithm.
+    private func curveIdentifier(for algorithm: Algorithm, length: Int) -> String {
+        switch algorithm {
+        case .ellipticCurve:
+            return "nistp" + String(describing: length)
+        }
+    }
+
+}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHReader.swift

@@ -0,0 +1,30 @@
+import Foundation
+
+/// Reads OpenSSH protocol data.
+public class OpenSSHReader {
+
+    var remaining: Data
+
+    /// Initialize the reader with an OpenSSH data payload.
+    /// - Parameter data: The data to read.
+    public init(data: Data) {
+        remaining = Data(data)
+    }
+
+    /// Reads the next chunk of data from the playload.
+    /// - Returns: The next chunk of data.
+    public func readNextChunk() -> Data {
+        let lengthRange = 0..<(UInt32.bitWidth/8)
+        let lengthChunk = remaining[lengthRange]
+        remaining.removeSubrange(lengthRange)
+        let littleEndianLength = lengthChunk.withUnsafeBytes { pointer in
+            return pointer.load(as: UInt32.self)
+        }
+        let length = Int(littleEndianLength.bigEndian)
+        let dataRange = 0..<length
+        let ret = Data(remaining[dataRange])
+        remaining.removeSubrange(dataRange)
+        return ret
+    }
+
+}

Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift

@@ -0,0 +1,57 @@
+import Foundation
+import OSLog
+
+/// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
+public class PublicKeyFileStoreController {
+
+    private let logger = Logger()
+    private let directory: String
+    private let keyWriter = OpenSSHKeyWriter()
+
+    /// Initializes a PublicKeyFileStoreController.
+    public init(homeDirectory: String) {
+        directory = homeDirectory.appending("/PublicKeys")
+    }
+
+    /// Writes out the keys specified to disk.
+    /// - Parameter secrets: The Secrets to generate keys for.
+    /// - Parameter clear: Whether or not any untracked files in the directory should be removed.
+    public func generatePublicKeys(for secrets: [AnySecret], clear: Bool = false) throws {
+        logger.log("Writing public keys to disk")
+        if clear {
+            let validPaths = Set(secrets.map { publicKeyPath(for: $0) }).union(Set(secrets.map { sshCertificatePath(for: $0) }))
+            let untracked = Set(try FileManager.default.contentsOfDirectory(atPath: directory)
+                .map { "\(directory)/\($0)" })
+                .subtracting(validPaths)
+            for path in untracked {
+                try? FileManager.default.removeItem(at: URL(fileURLWithPath: path))
+            }
+        }
+        try? FileManager.default.createDirectory(at: URL(fileURLWithPath: directory), withIntermediateDirectories: false, attributes: nil)
+        for secret in secrets {
+            let path = publicKeyPath(for: secret)
+            guard let data = keyWriter.openSSHString(secret: secret).data(using: .utf8) else { continue }
+            FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
+        }
+        logger.log("Finished writing public keys")
+    }
+
+    /// The path for a Secret's public key.
+    /// - Parameter secret: The Secret to return the path for.
+    /// - Returns: The path to the Secret's public key.
+    /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
+    public func publicKeyPath<SecretType: Secret>(for secret: SecretType) -> String {
+        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        return directory.appending("/").appending("\(minimalHex).pub")
+    }
+
+    /// The path for a Secret's SSH Certificate public key.
+    /// - Parameter secret: The Secret to return the path for.
+    /// - Returns: The path to the SSH Certificate public key.
+    /// - Warning: This method returning a path does not imply that a key has a SSH certificates. This method only describes where it will be.
+    public func sshCertificatePath<SecretType: Secret>(for secret: SecretType) -> String {
+        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        return directory.appending("/").appending("\(minimalHex)-cert.pub")
+    }
+
+}

Sources/Packages/Sources/SecretKit/SecretStoreList.swift

@@ -1,47 +1,46 @@
 import Foundation
-import Observation
+import Combine
 
 /// A "Store Store," which holds a list of type-erased stores.
-@Observable @MainActor public final class SecretStoreList: Sendable {
+public class SecretStoreList: ObservableObject {
 
     /// The Stores managed by the SecretStoreList.
-    public var stores: [AnySecretStore] = []
+    @Published public var stores: [AnySecretStore] = []
     /// A modifiable store, if one is available.
-    public var modifiableStore: AnySecretStoreModifiable? = nil
+    @Published public var modifiableStore: AnySecretStoreModifiable?
+    private var sinks: [AnyCancellable] = []
 
     /// Initializes a SecretStoreList.
-    public nonisolated init() {
+    public init() {
     }
 
     /// Adds a non-type-erased SecretStore to the list.
     public func add<SecretStoreType: SecretStore>(store: SecretStoreType) {
-        stores.append(AnySecretStore(store))
+        addInternal(store: AnySecretStore(store))
     }
 
     /// Adds a non-type-erased modifiable SecretStore.
     public func add<SecretStoreType: SecretStoreModifiable>(store: SecretStoreType) {
-        let modifiable = AnySecretStoreModifiable(store)
-        if modifiableStore == nil {
-            modifiableStore = modifiable
-        }
-        stores.append(modifiable)
+        let modifiable = AnySecretStoreModifiable(modifiable: store)
+        modifiableStore = modifiable
+        addInternal(store: modifiable)
     }
 
     /// A boolean describing whether there are any Stores available.
     public var anyAvailable: Bool {
-        stores.contains(where: \.isAvailable)
-    }
-
-    public var allSecrets: [AnySecret] {
-        stores.flatMap(\.secrets)
-    }
-
-    public var allSecretsWithStores: [(AnySecret, AnySecretStore)] {
-        stores.flatMap { store in
-            store.secrets.map { secret in
-                (secret, store)
-            }
-        }
+        stores.reduce(false, { $0 || $1.isAvailable })
+    }
+
+}
+
+extension SecretStoreList {
+
+    private func addInternal(store: AnySecretStore) {
+        stores.append(store)
+        let sink = store.objectWillChange.sink {
+            self.objectWillChange.send()
+        }
+        sinks.append(sink)
     }
 
 }

Sources/Packages/Sources/SecretKit/Types/CreationOptions.swift

@@ -1,55 +0,0 @@
-import Foundation
-
-public struct Attributes: Sendable, Codable, Hashable {
-    
-    /// The type of key involved.
-    public let keyType: KeyType
-
-    /// The authentication requirements for the key. This is simply a description of the option recorded at creation – modifying it doers not modify the key's authentication requirements.
-    public let authentication: AuthenticationRequirement
-    
-    /// The string appended to the end of the SSH Public Key.
-    /// If nil, a default value will be used.
-    public var publicKeyAttribution: String?
-
-    public init(
-        keyType: KeyType,
-        authentication: AuthenticationRequirement,
-        publicKeyAttribution: String? = nil
-    ) {
-        self.keyType = keyType
-        self.authentication = authentication
-        self.publicKeyAttribution = publicKeyAttribution
-    }
-
-    public struct UnsupportedOptionError: Error {
-        package init() {}
-    }
-    
-}
-
-/// The option specified
-public enum AuthenticationRequirement: String, Hashable, Sendable, Codable, Identifiable {
-
-    /// Authentication is not required for usage.
-    case notRequired
-    
-    /// The user needs to authenticate, using either a biometric option, a connected authorized watch, or password entry..
-    case presenceRequired
-    
-    /// ONLY the current set of biometric data, as matching at time of creation, is accepted.
-    /// - Warning: This is a dangerous option prone to data loss. The user should be warned before configuring this key that if they modify their enrolled biometry INCLUDING by simply adding a new entry (ie, adding another fingeprting), the key will no longer be able to be accessed. This cannot be overridden with a password.
-    case biometryCurrent
-    
-    /// The authentication requirement was not recorded at creation, and is unknown.
-    case unknown
-    
-    /// Whether or not the key is known to require authentication.
-    public var required: Bool {
-        self == .presenceRequired || self == .biometryCurrent
-    }
-
-    public var id: AuthenticationRequirement {
-        self
-    }
-}

Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// Protocol describing a persisted authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time.
-public protocol PersistedAuthenticationContext: Sendable {
+public protocol PersistedAuthenticationContext {
     /// Whether the context remains valid.
     var valid: Bool { get }
     /// The date at which the authorization expires and the context becomes invalid.

Sources/Packages/Sources/SecretKit/Types/Secret.swift

@@ -1,85 +1,35 @@
 import Foundation
 
 /// The base protocol for describing a Secret
-public protocol Secret: Identifiable, Hashable, Sendable {
+public protocol Secret: Identifiable, Hashable {
 
     /// A user-facing string identifying the Secret.
     var name: String { get }
+    /// The algorithm this secret uses.
+    var algorithm: Algorithm { get }
+    /// The key size for the secret.
+    var keySize: Int { get }
+    /// Whether the secret requires authentication before use.
+    var requiresAuthentication: Bool { get }
     /// The public key data for the secret.
     var publicKey: Data { get }
-    /// The attributes of the key.
-    var attributes: Attributes { get }
 
 }
 
-public extension Secret {
+/// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported.
+public enum Algorithm: Hashable {
 
-    /// The algorithm and key size this secret uses.
-    var keyType: KeyType {
-        attributes.keyType
-    }
-
-    /// Whether the secret requires authentication before use.
-    var authenticationRequirement: AuthenticationRequirement {
-        attributes.authentication
-    }
-    /// An attribution string to apply to the generated public key.
-    var publicKeyAttribution: String? {
-        attributes.publicKeyAttribution
-    }
-
-}
-
-/// The type of algorithm the Secret uses.
-public struct KeyType: Hashable, Sendable, Codable, CustomStringConvertible {
-
-    public static let ecdsa256 = KeyType(algorithm: .ecdsa, size: 256)
-    public static let ecdsa384 = KeyType(algorithm: .ecdsa, size: 384)
-    public static let mldsa65 = KeyType(algorithm: .mldsa, size: 65)
-    public static let mldsa87 = KeyType(algorithm: .mldsa, size: 87)
-    public static let rsa2048 = KeyType(algorithm: .rsa, size: 2048)
-
-    public enum Algorithm: Hashable, Sendable, Codable {
-        case ecdsa
-        case mldsa
-        case rsa
-    }
-
-    public var algorithm: Algorithm
-    public var size: Int
-
-    public init(algorithm: Algorithm, size: Int) {
-        self.algorithm = algorithm
-        self.size = size
-    }
+    case ellipticCurve
 
     /// Initializes the Algorithm with a secAttr representation of an algorithm.
     /// - Parameter secAttr: the secAttr, represented as an NSNumber.
-    public init?(secAttr: NSNumber, size: Int) {
+    public init(secAttr: NSNumber) {
         let secAttrString = secAttr.stringValue as CFString
         switch secAttrString {
         case kSecAttrKeyTypeEC:
-            algorithm = .ecdsa
-        case kSecAttrKeyTypeRSA:
-            algorithm = .rsa
+            self = .ellipticCurve
         default:
-            return nil
+            fatalError()
         }
-        self.size = size
-    }
-    
-    public var secAttrKeyType: CFString? {
-        switch algorithm {
-        case .ecdsa:
-            kSecAttrKeyTypeEC
-        case .rsa:
-            kSecAttrKeyTypeRSA
-        case .mldsa:
-            nil
-        }
-    }
-    
-    public var description: String {
-        "\(algorithm)-\(size)"
     }
 }

Sources/Packages/Sources/SecretKit/Types/SecretStore.swift

@@ -1,18 +1,19 @@
 import Foundation
+import Combine
 
 /// Manages access to Secrets, and performs signature operations on data using those Secrets.
-public protocol SecretStore<SecretType>: Identifiable, Sendable {
+public protocol SecretStore: ObservableObject, Identifiable {
 
     associatedtype SecretType: Secret
 
     /// A boolean indicating whether or not the store is available.
-    @MainActor var isAvailable: Bool { get }
+    var isAvailable: Bool { get }
     /// A unique identifier for the store.
     var id: UUID { get }
     /// A user-facing name for the store.
-    @MainActor var name: String { get }
+    var name: String { get }
     /// The secrets the store manages.
-    @MainActor var secrets: [SecretType] { get }
+    var secrets: [SecretType] { get }
 
     /// Signs a data payload with a specified Secret.
     /// - Parameters:
@@ -20,81 +21,48 @@ public protocol SecretStore<SecretType>: Identifiable, Sendable {
     ///   - secret: The ``Secret`` to sign with.
     ///   - provenance: A ``SigningRequestProvenance`` describing where the request came from.
     /// - Returns: The signed data.
-    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) async throws -> Data
+    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data
 
     /// Checks to see if there is currently a valid persisted authentication for a given secret.
     /// - Parameters:
     ///   - secret: The ``Secret`` to check if there is a persisted authentication for.
     /// - Returns: A persisted authentication context, if a valid one exists.
-    func existingPersistedAuthenticationContext(secret: SecretType, provenance: SigningRequestProvenance) async -> PersistedAuthenticationContext?
+    func existingPersistedAuthenticationContext(secret: SecretType) -> PersistedAuthenticationContext?
 
     /// Persists user authorization for access to a secret.
     /// - Parameters:
     ///   - secret: The ``Secret`` to persist the authorization for.
     ///   - duration: The duration that the authorization should persist for.
     ///  - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret.
-    func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) async throws
-
-    func persistAuthentication(secret: SecretType, forProvenance provenance: SigningRequestProvenance) async throws
+    func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) throws
 
     /// Requests that the store reload secrets from any backing store, if neccessary.
-    func reloadSecrets() async
+    func reloadSecrets()
 
 }
 
 /// A SecretStore that the Secretive admin app can modify.
-public protocol SecretStoreModifiable<SecretType>: SecretStore {
+public protocol SecretStoreModifiable: SecretStore {
 
     /// Creates a new ``Secret`` in the store.
     /// - Parameters:
     ///   - name: The user-facing name for the ``Secret``.
-    ///   - attributes: A struct describing the options for creating the key.'
-    @discardableResult
-    func create(name: String, attributes: Attributes) async throws -> SecretType
+    ///   - requiresAuthentication: A boolean indicating whether or not the user will be required to authenticate before performing signature operations with the secret.
+    func create(name: String, requiresAuthentication: Bool) throws
 
     /// Deletes a Secret in the store.
     /// - Parameters:
     ///   - secret: The ``Secret`` to delete.
-    func delete(secret: SecretType) async throws
+    func delete(secret: SecretType) throws
 
     /// Updates the name of a Secret in the store.
     /// - Parameters:
     ///   - secret: The ``Secret`` to update.
     ///   - name: The new name for the Secret.
-    ///   - attributes: The new attributes for the secret.
-    func update(secret: SecretType, name: String, attributes: Attributes) async throws
-
-    var supportedKeyTypes: KeyAvailability { get }
+    func update(secret: SecretType, name: String) throws
 
 }
 
-public struct KeyAvailability: Sendable {
-
-    public let available: [KeyType]
-    public let unavailable: [UnavailableKeyType]
-
-    public init(available: [KeyType], unavailable: [UnavailableKeyType]) {
-        self.available = available
-        self.unavailable = unavailable
-    }
-
-    public struct UnavailableKeyType: Sendable {
-        public let keyType: KeyType
-        public let reason: Reason
-
-        public init(keyType: KeyType, reason: Reason) {
-            self.keyType = keyType
-            self.reason = reason
-        }
-
-        public enum Reason: Sendable {
-            case macOSUpdateRequired
-        }
-    }
-
-}
-
-
 extension NSNotification.Name {
 
     // Distributed notification that keys were modified out of process (ie, that the management tool added/removed secrets)

Sources/Packages/Sources/SecretKit/Types/SigningRequestProvenance.swift

@@ -2,7 +2,7 @@ import Foundation
 import AppKit
 
 /// Describes the chain of applications that requested a signature operation.
-public struct SigningRequestProvenance: Equatable, Sendable, Hashable {
+public struct SigningRequestProvenance: Equatable {
 
     /// A list of processes involved in the request.
     /// - Note: A chain will typically consist of many elements even for a simple request. For example, running `git fetch` in Terminal.app would generate a request chain of `ssh` -> `git` -> `zsh` -> `login` -> `Terminal.app`
@@ -25,16 +25,12 @@ extension SigningRequestProvenance {
         chain.allSatisfy { $0.validSignature }
     }
 
-    public func isSameProvenance(as other: SigningRequestProvenance) -> Bool {
-        zip(chain, other.chain).allSatisfy { $0.isSameProcess(as: $1) }
-    }
-
 }
 
 extension SigningRequestProvenance {
 
     /// Describes a process in a `SigningRequestProvenance` chain.
-    public struct Process: Equatable, Sendable, Hashable {
+    public struct Process: Equatable {
 
         /// The pid of the process.
         public let pid: Int32
@@ -75,15 +71,6 @@ extension SigningRequestProvenance {
             appName ?? processName
         }
 
-        // Whether the
-        public func isSameProcess(as other: Process) -> Bool {
-            processName == other.processName &&
-            appName == other.appName &&
-            iconURL == other.iconURL &&
-            path == other.path &&
-            validSignature == other.validSignature
-        }
-
     }
 
 }

Sources/Packages/Sources/SecureEnclaveSecretKit/CryptoKitMigrator.swift

@@ -1,103 +0,0 @@
-import Foundation
-import Security
-import CryptoTokenKit
-import CryptoKit
-import SecretKit
-import os
-
-extension SecureEnclave {
-
-    public struct CryptoKitMigrator {
-
-        private let logger = Logger(subsystem: "com.maxgoedjen.secretive.migration", category: "CryptoKitMigrator")
-
-        public init() {
-        }
-        
-        /// Keys prior to 3.0 were created and stored directly using the keychain as kSecClassKey items. CryptoKit operates a little differently, in that it creates a key on your behalf which you can persist using an opaque data blob to a generic keychain item. Keychain created keys _also_ use this blob under the hood, but it's stored in the "toid" attribute. This migrates the old keys from kSecClassKey to generic items, copying the "toid" to be the main stored data. If the key is migrated successfully, the old key's identifier is renamed to indicate it's been migrated.
-        /// - Note: Migration is non-destructive – users can still see and use their keys in older versions of Secretive.
-        @MainActor public func migrate(to store: Store) throws {
-            let privateAttributes = KeychainDictionary([
-                kSecClass: kSecClassKey,
-                kSecAttrKeyType: Constants.oldKeyType,
-                kSecAttrApplicationTag: SecureEnclave.Store.Constants.keyTag,
-                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                kSecReturnRef: true,
-                kSecMatchLimit: kSecMatchLimitAll,
-                kSecReturnAttributes: true
-            ])
-            var privateUntyped: CFTypeRef?
-            unsafe SecItemCopyMatching(privateAttributes, &privateUntyped)
-            guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
-            let migratedPublicKeys = Set(store.secrets.map(\.publicKey))
-            var migratedAny = false
-            for key in privateTyped {
-                let name = key[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
-                let id = key[kSecAttrApplicationLabel] as! Data
-                guard !id.contains(Constants.migrationMagicNumber) else {
-                    logger.log("Skipping \(name), already migrated.")
-                    continue
-                }
-                let ref = key[kSecValueRef] as! SecKey
-                let attributes = SecKeyCopyAttributes(ref) as! [CFString: Any]
-                let tokenObjectID = unsafe attributes[Constants.tokenObjectID] as! Data
-                let accessControl = attributes[kSecAttrAccessControl] as! SecAccessControl
-                // Best guess.
-                let auth: AuthenticationRequirement = String(describing: accessControl)
-                    .contains("DeviceOwnerAuthentication") ? .presenceRequired : .unknown
-                do {
-                    let parsed = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: tokenObjectID)
-                    let secret = Secret(id: UUID().uuidString, name: name, publicKey: parsed.publicKey.x963Representation, attributes: Attributes(keyType: .init(algorithm: .ecdsa, size: 256), authentication: auth))
-                    guard !migratedPublicKeys.contains(parsed.publicKey.x963Representation) else {
-                        logger.log("Skipping \(name), public key already present. Marking as migrated.")
-                        markMigrated(secret: secret, oldID: id)
-                        continue
-                    }
-                    logger.log("Migrating \(name).")
-                    try store.saveKey(tokenObjectID, name: name, attributes: secret.attributes)
-                    logger.log("Migrated \(name).")
-                    markMigrated(secret: secret, oldID: id)
-                    migratedAny = true
-                } catch {
-                    logger.error("Failed to migrate \(name): \(error.localizedDescription).")
-                }
-            }
-            if migratedAny {
-                store.reloadSecrets()
-            }
-        }
-
-
-
-        public func markMigrated(secret: Secret, oldID: Data) {
-            let updateQuery = KeychainDictionary([
-                kSecClass: kSecClassKey,
-                kSecAttrApplicationLabel: oldID
-            ])
-
-            let newID = oldID + Constants.migrationMagicNumber
-            let updatedAttributes = KeychainDictionary([
-                kSecAttrApplicationLabel: newID as CFData
-            ])
-
-            let status = SecItemUpdate(updateQuery, updatedAttributes)
-            if status != errSecSuccess {
-                logger.warning("Failed to mark \(secret.name) as migrated: \(status).")
-            }
-        }
-
-
-    }
-
-}
-
-extension SecureEnclave.CryptoKitMigrator {
-
-    enum Constants {
-        public static let oldKeyType = kSecAttrKeyTypeECSECPrimeRandom as String
-        public static let migrationMagicNumber = Data("_cryptokit_1".utf8)
-        // https://github.com/apple-opensource/Security/blob/5e9101b3bd1fb096bae4f40e79d50426ba1db8e9/OSX/sec/Security/SecItemConstants.c#L111
-        public static nonisolated(unsafe) let tokenObjectID = "toid" as CFString
-    }
-
-}

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveSecret.swift

@@ -1,4 +1,5 @@
 import Foundation
+import Combine
 import SecretKit
 
 extension SecureEnclave {
@@ -6,26 +7,12 @@ extension SecureEnclave {
     /// An implementation of Secret backed by the Secure Enclave.
     public struct Secret: SecretKit.Secret {
 
-        public let id: String
+        public let id: Data
         public let name: String
+        public let algorithm = Algorithm.ellipticCurve
+        public let keySize = 256
+        public let requiresAuthentication: Bool
         public let publicKey: Data
-        public let attributes: Attributes
-
-        init(
-            id: String,
-            name: String,
-            publicKey: Data,
-            attributes: Attributes
-        ) {
-            self.id = id
-            self.name = name
-            self.publicKey = publicKey
-            self.attributes = attributes
-        }
-
-        public static func ==(lhs: Self, rhs: Self) -> Bool {
-            lhs.id == rhs.id
-        }
 
     }
 

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift

@@ -1,301 +1,337 @@
 import Foundation
-import Observation
 import Security
-import CryptoKit
+import CryptoTokenKit
 import LocalAuthentication
 import SecretKit
-import os
 
 extension SecureEnclave {
 
-    /// An implementation of Store backed by the Secure Enclave using CryptoKit API.
-    @Observable public final class Store: SecretStoreModifiable {
+    /// An implementation of Store backed by the Secure Enclave.
+    public class Store: SecretStoreModifiable {
 
-        @MainActor public var secrets: [Secret] = []
         public var isAvailable: Bool {
-            CryptoKit.SecureEnclave.isAvailable
+            // For some reason, as of build time, CryptoKit.SecureEnclave.isAvailable always returns false
+            // error msg "Received error sending GET UNIQUE DEVICE command"
+            // Verify it with TKTokenWatcher manually.
+            TKTokenWatcher().tokenIDs.contains("com.apple.setoken")
         }
         public let id = UUID()
-        public let name = String(localized: .secureEnclave)
-        private let persistentAuthenticationHandler = PersistentAuthenticationHandler<Secret>()
+        public let name = NSLocalizedString("Secure Enclave", comment: "Secure Enclave")
+        @Published public private(set) var secrets: [Secret] = []
+
+        private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:]
 
         /// Initializes a Store.
-        @MainActor public init() {
+        public init() {
+            DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { _ in
+                self.reloadSecretsInternal(notifyAgent: false)
+            }
             loadSecrets()
-            Task {
-                for await note in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) {
-                    guard Constants.notificationToken != (note.object as? String) else {
-                        // Don't reload if we're the ones triggering this by reloading.
-                        continue
-                    }
-                    reloadSecrets()
-                }
-            }
         }
 
-        // MARK: - Public API
-        
-        // MARK: SecretStore
-        
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
-            var context: LAContext
-            if let existing = await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret, provenance: provenance) {
-                context = unsafe existing.context
-            } else {
-                let newContext = LAContext()
-                newContext.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
-                newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-                context = newContext
-            }
+        // MARK: Public API
 
-            let queryAttributes = KeychainDictionary([
-                kSecClass: Constants.keyClass,
-                kSecAttrService: Constants.keyTag,
-                kSecUseDataProtectionKeychain: true,
-                kSecAttrAccount: secret.id,
-                kSecReturnAttributes: true,
-                kSecReturnData: true,
-            ])
-            var untyped: CFTypeRef?
-            let status = unsafe SecItemCopyMatching(queryAttributes, &untyped)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-            guard let untypedSafe = untyped as? [CFString: Any] else {
-                throw KeychainError(statusCode: errSecSuccess)
-            }
-            guard let attributesData = untypedSafe[kSecAttrGeneric] as? Data,
-                  let keyData = untypedSafe[kSecValueData] as? Data else {
-                throw MissingAttributesError()
-            }
-            let attributes = try JSONDecoder().decode(Attributes.self, from: attributesData)
-
-            switch attributes.keyType {
-            case .ecdsa256:
-                let key = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: keyData, authenticationContext: context)
-                return try key.signature(for: data).rawRepresentation
-            case .mldsa65:
-                guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-                let key = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(dataRepresentation: keyData, authenticationContext: context)
-                return try key.signature(for: data)
-            case .mldsa87:
-                guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-                let key = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(dataRepresentation: keyData, authenticationContext: context)
-                return try key.signature(for: data)
-            default:
-                throw UnsupportedAlgorithmError()
-            }
-
-        }
-
-        public func existingPersistedAuthenticationContext(secret: Secret, provenance: SigningRequestProvenance) async -> PersistedAuthenticationContext? {
-            await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret, provenance: provenance)
-        }
-
-        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
-            try await persistentAuthenticationHandler.persistAuthentication(secret: secret, forDuration: duration)
-        }
-
-        public func persistAuthentication(secret: SecureEnclave.Secret, forProvenance provenance: SigningRequestProvenance) async throws {
-            try await persistentAuthenticationHandler.persistAuthentication(secret: secret, provenance: provenance)
-        }
-
-        @MainActor public func reloadSecrets() {
-            let before = secrets
-            secrets.removeAll()
-            loadSecrets()
-            if secrets != before {
-                NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
-                DistributedNotificationCenter.default().postNotificationName(.secretStoreUpdated, object: Constants.notificationToken, deliverImmediately: true)
-            }
-        }
-
-        // MARK: SecretStoreModifiable
-        
-        public func create(name: String, attributes: Attributes) async throws -> Secret {
+        public func create(name: String, requiresAuthentication: Bool) throws {
             var accessError: SecurityError?
-            let flags: SecAccessControlCreateFlags = switch attributes.authentication {
-            case .notRequired:
-                [.privateKeyUsage]
-            case .presenceRequired:
-                [.userPresence, .privateKeyUsage]
-            case .biometryCurrent:
-                [.biometryCurrentSet, .privateKeyUsage]
-            case .unknown:
-                fatalError()
+            let flags: SecAccessControlCreateFlags
+            if requiresAuthentication {
+                flags = [.privateKeyUsage, .userPresence]
+            } else {
+                flags = .privateKeyUsage
             }
             let access =
-            unsafe SecAccessControlCreateWithFlags(kCFAllocatorDefault,
+                SecAccessControlCreateWithFlags(kCFAllocatorDefault,
                                                 kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
                                                 flags,
-                                                &accessError)
-            if let error = unsafe accessError {
-                throw unsafe error.takeRetainedValue() as Error
+                                                &accessError) as Any
+            if let error = accessError {
+                throw error.takeRetainedValue() as Error
             }
-            let dataRep: Data
-            let publicKey: Data
-            switch attributes.keyType {
-            case .ecdsa256:
-                let created = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(accessControl: access!)
-                dataRep = created.dataRepresentation
-                publicKey = created.publicKey.x963Representation
-            case .mldsa65:
-                guard #available(macOS 26.0, *) else { throw Attributes.UnsupportedOptionError() }
-                let created = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(accessControl: access!)
-                dataRep = created.dataRepresentation
-                publicKey = created.publicKey.rawRepresentation
-            case .mldsa87:
-                guard #available(macOS 26.0, *) else { throw Attributes.UnsupportedOptionError() }
-                let created = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(accessControl: access!)
-                dataRep = created.dataRepresentation
-                publicKey = created.publicKey.rawRepresentation
-            default:
-                throw Attributes.UnsupportedOptionError()
+
+            let attributes = [
+                kSecAttrLabel: name,
+                kSecAttrKeyType: Constants.keyType,
+                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
+                kSecAttrApplicationTag: Constants.keyTag,
+                kSecPrivateKeyAttrs: [
+                    kSecAttrIsPermanent: true,
+                    kSecAttrAccessControl: access
+                ]
+            ] as CFDictionary
+
+            var createKeyError: SecurityError?
+            let keypair = SecKeyCreateRandomKey(attributes, &createKeyError)
+            if let error = createKeyError {
+                throw error.takeRetainedValue() as Error
             }
-            let id = try saveKey(dataRep, name: name, attributes: attributes)
-            await reloadSecrets()
-            return Secret(id: id, name: name, publicKey: publicKey, attributes: attributes)
+            guard let keypair = keypair, let publicKey = SecKeyCopyPublicKey(keypair) else {
+                throw KeychainError(statusCode: nil)
+            }
+            try savePublicKey(publicKey, name: name)
+            reloadSecretsInternal()
         }
 
-        public func delete(secret: Secret) async throws {
-            let deleteAttributes = KeychainDictionary([
-                kSecClass: Constants.keyClass,
-                kSecAttrService: Constants.keyTag,
-                kSecUseDataProtectionKeychain: true,
-                kSecAttrAccount: secret.id,
-            ])
+        public func delete(secret: Secret) throws {
+            let deleteAttributes = [
+                kSecClass: kSecClassKey,
+                kSecAttrApplicationLabel: secret.id as CFData
+            ] as CFDictionary
             let status = SecItemDelete(deleteAttributes)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
-            await reloadSecrets()
+            reloadSecretsInternal()
         }
 
-        public func update(secret: Secret, name: String, attributes: Attributes) async throws {
-            let updateQuery = KeychainDictionary([
-                kSecClass: Constants.keyClass,
-                kSecAttrAccount: secret.id,
-            ])
+        public func update(secret: Secret, name: String) throws {
+            let updateQuery = [
+                kSecClass: kSecClassKey,
+                kSecAttrApplicationLabel: secret.id as CFData
+            ] as CFDictionary
 
-            let attributes = try JSONEncoder().encode(attributes)
-            let updatedAttributes = KeychainDictionary([
+            let updatedAttributes = [
                 kSecAttrLabel: name,
-                kSecAttrGeneric: attributes,
-            ])
+            ] as CFDictionary
 
             let status = SecItemUpdate(updateQuery, updatedAttributes)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
-            await reloadSecrets()
+            reloadSecretsInternal()
         }
         
-        public let supportedKeyTypes: KeyAvailability = {
-            let macOS26Keys: [KeyType] = [.mldsa65, .mldsa87]
-            let isAtLeastMacOS26 = if #available(macOS 26, *) {
-                true
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
+            let context: LAContext
+            if let existing = persistedAuthenticationContexts[secret], existing.valid {
+                context = existing.context
             } else {
-                false
+                let newContext = LAContext()
+                newContext.localizedCancelTitle = "Deny"
+                context = newContext
             }
-            return KeyAvailability(
-                available: [
-                    .ecdsa256,
-                ] + (isAtLeastMacOS26 ? macOS26Keys : []),
-                unavailable: (isAtLeastMacOS26 ? [] : macOS26Keys).map {
-                    KeyAvailability.UnavailableKeyType(keyType: $0, reason: .macOSUpdateRequired)
-                }
-            )
-        }()
+            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
+            let attributes = [
+                kSecClass: kSecClassKey,
+                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+                kSecAttrApplicationLabel: secret.id as CFData,
+                kSecAttrKeyType: Constants.keyType,
+                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
+                kSecAttrApplicationTag: Constants.keyTag,
+                kSecUseAuthenticationContext: context,
+                kSecReturnRef: true
+                ] as CFDictionary
+            var untyped: CFTypeRef?
+            let status = SecItemCopyMatching(attributes, &untyped)
+            if status != errSecSuccess {
+                throw KeychainError(statusCode: status)
+            }
+            guard let untypedSafe = untyped else {
+                throw KeychainError(statusCode: errSecSuccess)
+            }
+            let key = untypedSafe as! SecKey
+            var signError: SecurityError?
+
+            guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
+                throw SigningError(error: signError)
+            }
+            return signature as Data
+        }
+
+        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
+            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
+            return persisted
+        }
+
+        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) throws {
+            let newContext = LAContext()
+            newContext.touchIDAuthenticationAllowableReuseDuration = duration
+            newContext.localizedCancelTitle = "Deny"
+
+            let formatter = DateComponentsFormatter()
+            formatter.unitsStyle = .spellOut
+            formatter.allowedUnits = [.hour, .minute, .day]
+
+            if let durationString = formatter.string(from: duration) {
+                newContext.localizedReason = "unlock secret \"\(secret.name)\" for \(durationString)"
+            } else {
+                newContext.localizedReason = "unlock secret \"\(secret.name)\""
+            }
+            newContext.evaluatePolicy(LAPolicy.deviceOwnerAuthentication, localizedReason: newContext.localizedReason) { [weak self] success, _ in
+                guard success else { return }
+                let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
+                self?.persistedAuthenticationContexts[secret] = context
+            }
+        }
+
+        public func reloadSecrets() {
+            reloadSecretsInternal(notifyAgent: false)
+        }
+
     }
 
 }
 
 extension SecureEnclave.Store {
 
+    /// Reloads all secrets from the store.
+    /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
+    private func reloadSecretsInternal(notifyAgent: Bool = true) {
+        let before = secrets
+        secrets.removeAll()
+        loadSecrets()
+        if secrets != before {
+            NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
+            if notifyAgent {
+                DistributedNotificationCenter.default().postNotificationName(.secretStoreUpdated, object: nil, deliverImmediately: true)
+            }
+        }
+    }
+
     /// Loads all secrets from the store.
-    @MainActor private func loadSecrets() {
-        let queryAttributes = KeychainDictionary([
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecUseDataProtectionKeychain: true,
-            kSecReturnData: true,
+    private func loadSecrets() {
+        let publicAttributes = [
+            kSecClass: kSecClassKey,
+            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
-            ])
-        var untyped: CFTypeRef?
-        unsafe SecItemCopyMatching(queryAttributes, &untyped)
-        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped: [SecureEnclave.Secret] = typed.compactMap {
-            do {
-                let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
-                guard let attributesData = $0[kSecAttrGeneric] as? Data,
-                let id = $0[kSecAttrAccount] as? String else {
-                    throw MissingAttributesError()
-                }
-                let attributes = try JSONDecoder().decode(Attributes.self, from: attributesData)
-                let keyData = $0[kSecValueData] as! Data
-                let publicKey: Data
-                switch attributes.keyType {
-                case .ecdsa256:
-                    let key = try CryptoKit.SecureEnclave.P256.Signing.PrivateKey(dataRepresentation: keyData)
-                    publicKey = key.publicKey.x963Representation
-                case .mldsa65:
-                    guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-                    let key = try CryptoKit.SecureEnclave.MLDSA65.PrivateKey(dataRepresentation: keyData)
-                    publicKey = key.publicKey.rawRepresentation
-                case .mldsa87:
-                    guard #available(macOS 26.0, *)  else { throw UnsupportedAlgorithmError() }
-                    let key = try CryptoKit.SecureEnclave.MLDSA87.PrivateKey(dataRepresentation: keyData)
-                    publicKey = key.publicKey.rawRepresentation
-                default:
-                    throw UnsupportedAlgorithmError()
-                }
-                return SecureEnclave.Secret(id: id, name: name, publicKey: publicKey, attributes: attributes)
-            } catch {
-                return nil
+            ] as CFDictionary
+        var publicUntyped: CFTypeRef?
+        SecItemCopyMatching(publicAttributes, &publicUntyped)
+        guard let publicTyped = publicUntyped as? [[CFString: Any]] else { return }
+        let privateAttributes = [
+            kSecClass: kSecClassKey,
+            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+            kSecReturnRef: true,
+            kSecMatchLimit: kSecMatchLimitAll,
+            kSecReturnAttributes: true
+            ] as CFDictionary
+        var privateUntyped: CFTypeRef?
+        SecItemCopyMatching(privateAttributes, &privateUntyped)
+        guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
+        let privateMapped = privateTyped.reduce(into: [:] as [Data: [CFString: Any]]) { partialResult, next in
+            let id = next[kSecAttrApplicationLabel] as! Data
+            partialResult[id] = next
+        }
+        let authNotRequiredAccessControl: SecAccessControl =
+            SecAccessControlCreateWithFlags(kCFAllocatorDefault,
+                                            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+                                            [.privateKeyUsage],
+                                            nil)!
+
+        let wrapped: [SecureEnclave.Secret] = publicTyped.map {
+            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
+            let id = $0[kSecAttrApplicationLabel] as! Data
+            let publicKeyRef = $0[kSecValueRef] as! SecKey
+            let publicKeyAttributes = SecKeyCopyAttributes(publicKeyRef) as! [CFString: Any]
+            let publicKey = publicKeyAttributes[kSecValueData] as! Data
+            let privateKey = privateMapped[id]
+            let requiresAuth: Bool
+            if let authRequirements = privateKey?[kSecAttrAccessControl] {
+                // Unfortunately we can't inspect the access control object directly, but it does behave predicatable with equality.
+                requiresAuth = authRequirements as! SecAccessControl != authNotRequiredAccessControl
+            } else {
+                requiresAuth = false
             }
+            return SecureEnclave.Secret(id: id, name: name, requiresAuthentication: requiresAuth, publicKey: publicKey)
         }
         secrets.append(contentsOf: wrapped)
     }
 
     /// Saves a public key.
     /// - Parameters:
-    ///   - key: The data representation key to save.
+    ///   - publicKey: The public key to save.
     ///   - name: A user-facing name for the key.
-    ///   - attributes: Attributes of the key.
-    /// - Note: Despite the name, the "Data" of the key is _not_ actual key material. This is an opaque data representation that the SEP can manipulate.
-    @discardableResult
-    func saveKey(_ key: Data, name: String, attributes: Attributes) throws -> String {
-        let attributes = try JSONEncoder().encode(attributes)
-        let id = UUID().uuidString
-        let keychainAttributes = KeychainDictionary([
-            kSecClass: Constants.keyClass,
-            kSecAttrService: Constants.keyTag,
-            kSecUseDataProtectionKeychain: true,
-            kSecAttrAccessible: kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-            kSecAttrAccount: id,
-            kSecValueData: key,
-            kSecAttrLabel: name,
-            kSecAttrGeneric: attributes
-        ])
-        let status = SecItemAdd(keychainAttributes, nil)
+    private func savePublicKey(_ publicKey: SecKey, name: String) throws {
+        let attributes = [
+            kSecClass: kSecClassKey,
+            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+            kSecValueRef: publicKey,
+            kSecAttrIsPermanent: true,
+            kSecReturnData: true,
+            kSecAttrLabel: name
+            ] as CFDictionary
+        let status = SecItemAdd(attributes, nil)
         if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
+            throw SecureEnclave.KeychainError(statusCode: status)
         }
-        return id
     }
-    
+
 }
 
-extension SecureEnclave.Store {
+extension SecureEnclave {
+
+    /// A wrapper around an error code reported by a Keychain API.
+    public struct KeychainError: Error {
+        /// The status code involved, if one was reported.
+        public let statusCode: OSStatus?
+    }
+
+    /// A signing-related error.
+    public struct SigningError: Error {
+        /// The underlying error reported by the API, if one was returned.
+        public let error: SecurityError?
+    }
+
+}
+
+extension SecureEnclave {
+
+    public typealias SecurityError = Unmanaged<CFError>
+
+}
+
+extension SecureEnclave {
 
     enum Constants {
-        static let keyClass = kSecClassGenericPassword as String
-        static let keyTag = Data("com.maxgoedjen.secretive.secureenclave.key".utf8)
-        static let notificationToken = UUID().uuidString
+        static let keyTag = "com.maxgoedjen.secretive.secureenclave.key".data(using: .utf8)! as CFData
+        static let keyType = kSecAttrKeyTypeECSECPrimeRandom
+        static let unauthenticatedThreshold: TimeInterval = 0.05
+    }
+
+}
+
+extension SecureEnclave {
+
+    /// A context describing a persisted authentication.
+    private struct PersistentAuthenticationContext: PersistedAuthenticationContext {
+
+        /// The Secret to persist authentication for.
+        let secret: Secret
+        /// The LAContext used to authorize the persistent context.
+        let context: LAContext
+        /// An expiration date for the context.
+        /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
+        let monotonicExpiration: UInt64
+
+        /// Initializes a context.
+        /// - Parameters:
+        ///   - secret: The Secret to persist authentication for.
+        ///   - context: The LAContext used to authorize the persistent context.
+        ///   - duration: The duration of the authorization context, in seconds.
+        init(secret: Secret, context: LAContext, duration: TimeInterval) {
+            self.secret = secret
+            self.context = context
+            let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
+            self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
+        }
+
+        /// A boolean describing whether or not the context is still valid.
+        var valid: Bool {
+            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
+        }
+
+        var expiration: Date {
+            let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
+            let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
+            return Date(timeIntervalSinceNow: remainingInSeconds)
+        }
     }
-    
-    struct UnsupportedAlgorithmError: Error {}
-    struct MissingAttributesError: Error {}
 
 }

Sources/Packages/Sources/SmartCardSecretKit/Documentation.docc/SmartCard.md

@@ -6,3 +6,9 @@
 
 - ``Secret``
 - ``Store``
+
+### Errors
+
+- ``KeychainError``
+- ``SigningError``
+- ``SecurityError``

Sources/Packages/Sources/SmartCardSecretKit/SmartCardSecret.swift

@@ -1,4 +1,5 @@
 import Foundation
+import Combine
 import SecretKit
 
 extension SmartCard {
@@ -8,8 +9,10 @@ extension SmartCard {
 
         public let id: Data
         public let name: String
+        public let algorithm: Algorithm
+        public let keySize: Int
+        public let requiresAuthentication: Bool = false
         public let publicKey: Data
-        public var attributes: Attributes
 
     }
 

Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift

@@ -1,83 +1,64 @@
 import Foundation
-import Observation
 import Security
-@unsafe @preconcurrency import CryptoTokenKit
+import CryptoTokenKit
 import LocalAuthentication
 import SecretKit
 
 extension SmartCard {
-    
-    @MainActor @Observable fileprivate final class State {
-        var isAvailable = false
-        var name = String(localized: .smartCard)
-        var secrets: [Secret] = []
-        let watcher = TKTokenWatcher()
-        var tokenID: String? = nil
-        nonisolated init() {}
-    }
 
     /// An implementation of Store backed by a Smart Card.
-    @Observable public final class Store: SecretStore {
-
-        private let state = State()
-        public var isAvailable: Bool {
-            state.isAvailable
-        }
-        @MainActor public var smartcardTokenID: String? {
-            state.tokenID
-        }
+    public class Store: SecretStore {
 
+        @Published public var isAvailable: Bool = false
         public let id = UUID()
-        @MainActor public var name: String {
-            state.name
-        }
-        public var secrets: [Secret] {
-            state.secrets
-        }
-        private let persistentAuthenticationHandler = PersistentAuthenticationHandler<Secret>()
+        public private(set) var name = NSLocalizedString("Smart Card", comment: "Smart Card")
+        @Published public private(set) var secrets: [Secret] = []
+        private let watcher = TKTokenWatcher()
+        private var tokenID: String?
 
         /// Initializes a Store.
         public init() {
-            Task {
-                await MainActor.run {
-                    if let tokenID = smartcardTokenID {
-                        state.isAvailable = true
-                        state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
-                    }
-                    loadSecrets()
-                }
-                // Doing this inside a regular mainactor handler casues thread assertions in CryptoTokenKit to blow up when the handler executes.
-                await state.watcher.setInsertionHandler { id in
-                    Task {
-                        await self.smartcardInserted(for: id)
-                    }
-                }
+            tokenID = watcher.nonSecureEnclaveTokens.first
+            watcher.setInsertionHandler { string in
+                guard self.tokenID == nil else { return }
+                guard !string.contains("setoken") else { return }
+
+                self.tokenID = string
+                self.reloadSecrets()
+                self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
             }
+            if let tokenID = tokenID {
+                self.isAvailable = true
+                self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
+            }
+            loadSecrets()
         }
 
         // MARK: Public API
 
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
-            guard let tokenID = await state.tokenID else { fatalError() }
-            var context: LAContext
-            if let existing = await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret, provenance: provenance) {
-                context = unsafe existing.context
-            } else {
-                let newContext = LAContext()
-                newContext.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
-                newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
-                context = newContext
-            }
-            let attributes = KeychainDictionary([
+        public func create(name: String) throws {
+            fatalError("Keys must be created on the smart card.")
+        }
+
+        public func delete(secret: Secret) throws {
+            fatalError("Keys must be deleted on the smart card.")
+        }
+
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
+            guard let tokenID = tokenID else { fatalError() }
+            let context = LAContext()
+            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
+            context.localizedCancelTitle = "Deny"
+            let attributes = [
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
                 kSecAttrApplicationLabel: secret.id as CFData,
                 kSecAttrTokenID: tokenID,
                 kSecUseAuthenticationContext: context,
                 kSecReturnRef: true
-            ])
+            ] as CFDictionary
             var untyped: CFTypeRef?
-            let status = unsafe SecItemCopyMatching(attributes, &untyped)
+            let status = SecItemCopyMatching(attributes, &untyped)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
@@ -86,28 +67,39 @@ extension SmartCard {
             }
             let key = untypedSafe as! SecKey
             var signError: SecurityError?
-            guard let algorithm = signatureAlgorithm(for: secret) else { throw UnsupportKeyType() }
-            guard let signature = unsafe SecKeyCreateSignature(key, algorithm, data as CFData, &signError) else {
-                throw unsafe SigningError(error: signError)
+            let signatureAlgorithm: SecKeyAlgorithm
+            switch (secret.algorithm, secret.keySize) {
+            case (.ellipticCurve, 256):
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA256
+            case (.ellipticCurve, 384):
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA384
+            default:
+                fatalError()
+            }
+            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm, data as CFData, &signError) else {
+                throw SigningError(error: signError)
             }
             return signature as Data
         }
-        
-        public func existingPersistedAuthenticationContext(secret: Secret, provenance: SigningRequestProvenance) async -> PersistedAuthenticationContext? {
-            await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret, provenance: provenance)
+
+        public func existingPersistedAuthenticationContext(secret: SmartCard.Secret) -> PersistedAuthenticationContext? {
+            nil
         }
 
-        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
-            try await persistentAuthenticationHandler.persistAuthentication(secret: secret, forDuration: duration)
-        }
-
-        public func persistAuthentication(secret: Secret, forProvenance provenance: SigningRequestProvenance) async throws {
-            try await persistentAuthenticationHandler.persistAuthentication(secret: secret, provenance: provenance)
+        public func persistAuthentication(secret: SmartCard.Secret, forDuration: TimeInterval) throws {
         }
 
         /// Reloads all secrets from the store.
-        @MainActor public func reloadSecrets() {
-            reloadSecretsInternal()
+        public func reloadSecrets() {
+            DispatchQueue.main.async {
+                self.isAvailable = self.tokenID != nil
+                let before = self.secrets
+                self.secrets.removeAll()
+                self.loadSecrets()
+                if self.secrets != before {
+                    NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
+                }
+            }
         }
 
     }
@@ -116,71 +108,57 @@ extension SmartCard {
 
 extension SmartCard.Store {
 
-    @MainActor private func reloadSecretsInternal() {
-        let before = state.secrets
-        state.isAvailable = state.tokenID != nil
-        state.secrets.removeAll()
-        loadSecrets()
-        if self.secrets != before {
-            NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
-        }
-    }
-
-    /// Resets the token ID and reloads secrets.
-    /// - Parameter tokenID: The ID of the token that was inserted.
-    @MainActor private func smartcardInserted(for tokenID: String? = nil) {
-        guard let string = state.watcher.nonSecureEnclaveTokens.first else { return }
-        guard state.tokenID == nil else { return }
-        guard !string.contains("setoken") else { return }
-        state.tokenID = string
-        state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
-        state.tokenID = string
-        reloadSecretsInternal()
-    }
-
     /// Resets the token ID and reloads secrets.
     /// - Parameter tokenID: The ID of the token that was removed.
-    @MainActor private func smartcardRemoved(for tokenID: String? = nil) {
-        state.tokenID = nil
+    private func smartcardRemoved(for tokenID: String? = nil) {
+        self.tokenID = nil
         reloadSecrets()
     }
 
     /// Loads all secrets from the store.
-    @MainActor private func loadSecrets() {
-        guard let tokenID = state.tokenID  else { return }
+    private func loadSecrets() {
+        guard let tokenID = tokenID else { return }
 
-        let fallbackName = String(localized: .smartCard)
-        if let driverName = state.watcher.tokenInfo(forTokenID: tokenID)?.driverName  {
-            state.name = driverName
+        let fallbackName = NSLocalizedString("Smart Card", comment: "Smart Card")
+        if #available(macOS 12.0, *) {
+            if let driverName = watcher.tokenInfo(forTokenID: tokenID)?.driverName {
+                name = driverName
+            } else {
+                name = fallbackName
+            }
         } else {
-            state.name = fallbackName
+            // Hack to read name if there's only one smart card
+            let slotNames = TKSmartCardSlotManager().slotNames
+            if watcher.nonSecureEnclaveTokens.count == 1 && slotNames.count == 1 {
+                name = slotNames.first!
+            } else {
+                name = fallbackName
+            }
         }
 
-        let attributes = KeychainDictionary([
+        let attributes = [
             kSecClass: kSecClassKey,
             kSecAttrTokenID: tokenID,
+            kSecAttrKeyType: kSecAttrKeyTypeEC, // Restrict to EC
             kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
-        ])
+        ] as CFDictionary
         var untyped: CFTypeRef?
-        unsafe SecItemCopyMatching(attributes, &untyped)
+        SecItemCopyMatching(attributes, &untyped)
         guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped: [SecretType] = typed.compactMap {
-            let name = $0[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
+        let wrapped: [SmartCard.Secret] = typed.map {
+            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
             let tokenID = $0[kSecAttrApplicationLabel] as! Data
-            let algorithmSecAttr = $0[kSecAttrKeyType] as! NSNumber
+            let algorithm = Algorithm(secAttr: $0[kSecAttrKeyType] as! NSNumber)
             let keySize = $0[kSecAttrKeySizeInBits] as! Int
             let publicKeyRef = $0[kSecValueRef] as! SecKey
             let publicKeySecRef = SecKeyCopyPublicKey(publicKeyRef)!
             let publicKeyAttributes = SecKeyCopyAttributes(publicKeySecRef) as! [CFString: Any]
             let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            let attributes = Attributes(keyType: KeyType(secAttr: algorithmSecAttr, size: keySize)!, authentication: .presenceRequired)
-            let secret = SmartCard.Secret(id: tokenID, name: name, publicKey: publicKey, attributes: attributes)
-            guard signatureAlgorithm(for: secret) != nil else { return nil }
-            return secret
+            return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey)
         }
-        state.secrets.append(contentsOf: wrapped)
+        secrets.append(contentsOf: wrapped)
     }
 
 }
@@ -196,6 +174,22 @@ extension TKTokenWatcher {
 
 extension SmartCard {
 
-    public struct UnsupportKeyType: Error {}
+    /// A wrapper around an error code reported by a Keychain API.
+    public struct KeychainError: Error {
+        /// The status code involved.
+        public let statusCode: OSStatus
+    }
+
+    /// A signing-related error.
+    public struct SigningError: Error {
+        /// The underlying error reported by the API, if one was returned.
+        public let error: SecurityError?
+    }
+
+}
+
+extension SmartCard {
+
+    public typealias SecurityError = Unmanaged<CFError>
 
 }

Sources/Packages/Sources/XPCWrappers/TeamID.swift

@@ -1,26 +0,0 @@
-import Foundation
-
-extension ProcessInfo {
-    private static let fallbackTeamID = "Z72PRUAWF6"
-
-    private static let teamID: String = {
-        #if DEBUG
-        guard let task = SecTaskCreateFromSelf(nil) else {
-            assertionFailure("SecTaskCreateFromSelf failed")
-            return fallbackTeamID
-        }
-
-        guard let value = SecTaskCopyValueForEntitlement(task, "com.apple.developer.team-identifier" as CFString, nil) as? String else {
-//            assertionFailure("SecTaskCopyValueForEntitlement(com.apple.developer.team-identifier) failed")
-            return fallbackTeamID
-        }
-
-        return value
-        #else
-        /// Always use hardcoded team ID for release builds, just in case.
-        return fallbackTeamID
-        #endif
-    }()
-
-    public var teamID: String { Self.teamID }
-}

Sources/Packages/Sources/XPCWrappers/XPCProtocol.swift

@@ -1,14 +0,0 @@
-import Foundation
-
-@objc protocol _XPCProtocol: Sendable {
-    func process(_ data: Data, with reply: @Sendable @escaping (Data?, Error?) -> Void)
-}
-
-public protocol XPCProtocol<Input, Output>: Sendable {
-
-    associatedtype Input: Codable
-    associatedtype Output: Codable
-
-    func process(_ data: Input) async throws -> Output
-
-}

Sources/Packages/Sources/XPCWrappers/XPCServiceDelegate.swift

@@ -1,72 +0,0 @@
-import Foundation
-
-public final class XPCServiceDelegate: NSObject, NSXPCListenerDelegate {
-
-    private let exportedObject: ErasedXPCProtocol
-
-    public init<XPCProtocolType: XPCProtocol>(exportedObject: XPCProtocolType) {
-        self.exportedObject = ErasedXPCProtocol(exportedObject)
-    }
-
-    public func listener(_ listener: NSXPCListener, shouldAcceptNewConnection newConnection: NSXPCConnection) -> Bool {
-        newConnection.exportedInterface = NSXPCInterface(with: (any _XPCProtocol).self)
-        let exportedObject = exportedObject
-        newConnection.exportedObject = exportedObject
-        newConnection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = \"\(ProcessInfo.processInfo.teamID)\"")
-        newConnection.resume()
-        return true
-    }
-}
-
-@objc private final class ErasedXPCProtocol: NSObject, _XPCProtocol {
-
-    let _process: @Sendable (Data, @Sendable @escaping (Data?, (any Error)?) -> Void) -> Void
-
-    public init<XPCProtocolType: XPCProtocol>(_ exportedObject: XPCProtocolType) {
-        _process = { data, reply in
-            Task { [reply] in
-                do {
-                    let decoded = try JSONDecoder().decode(XPCProtocolType.Input.self, from: data)
-                    let result = try await exportedObject.process(decoded)
-                    let encoded = try JSONEncoder().encode(result)
-                    reply(encoded, nil)
-                } catch {
-                    if let error = error as? Codable & Error {
-                        reply(nil, NSError(error))
-                    } else {
-                        // Sending cast directly tries to serialize it and crashes XPCEncoder.
-                        let cast = error as NSError
-                        reply(nil, NSError(domain: cast.domain, code: cast.code, userInfo: [NSLocalizedDescriptionKey: error.localizedDescription]))
-                    }
-                }
-            }
-        }
-    }
-
-    func process(_ data: Data, with reply: @Sendable @escaping (Data?, (any Error)?) -> Void) {
-        _process(data, reply)
-    }
-
-
-}
-
-extension NSError {
-
-    private enum Constants {
-        static let domain = "com.maxgoedjen.secretive.xpcwrappers"
-        static let code = -1
-        static let dataKey = "underlying"
-    }
-
-    @nonobjc convenience init<ErrorType: Codable & Error>(_ error: ErrorType) {
-        let encoded = try? JSONEncoder().encode(error)
-        self.init(domain: Constants.domain, code: Constants.code, userInfo: [Constants.dataKey: encoded as Any])
-    }
-
-    @nonobjc public func underlying<ErrorType: Codable & Error>(as errorType: ErrorType.Type) -> ErrorType? {
-        guard domain == Constants.domain && code == Constants.code, let data = userInfo[Constants.dataKey] as? Data else { return nil }
-        return try? JSONDecoder().decode(ErrorType.self, from: data)
-    }
-
-}
-

Sources/Packages/Sources/XPCWrappers/XPCTypedSession.swift

@@ -1,53 +0,0 @@
-import Foundation
-
-public struct XPCTypedSession<ResponseType: Codable & Sendable, ErrorType: Error & Codable>: ~Copyable {
-
-    private let connection: NSXPCConnection
-    private let proxy: _XPCProtocol
-
-    public init(serviceName: String, warmup: Bool = false) async throws {
-        let connection = NSXPCConnection(serviceName: serviceName)
-        connection.remoteObjectInterface = NSXPCInterface(with: (any _XPCProtocol).self)
-        connection.setCodeSigningRequirement("anchor apple generic and certificate leaf[subject.OU] = \"\(ProcessInfo.processInfo.teamID)\"")
-        connection.resume()
-        guard let proxy = connection.remoteObjectProxy as? _XPCProtocol else { fatalError() }
-        self.connection = connection
-        self.proxy = proxy
-        if warmup {
-            _ = try? await send()
-        }
-    }
-
-    public func send(_ message: some Encodable = Data()) async throws -> ResponseType {
-        let encoded = try JSONEncoder().encode(message)
-        return try await withCheckedThrowingContinuation { continuation in
-            proxy.process(encoded) { data, error in
-                do {
-                    if let error {
-                        throw error
-                    }
-                    guard let data else {
-                        throw NoDataError()
-                    }
-                    let decoded = try JSONDecoder().decode(ResponseType.self, from: data)
-                    continuation.resume(returning: decoded)
-                } catch {
-                    if let typed = (error as NSError).underlying(as: ErrorType.self) {
-                        continuation.resume(throwing: typed)
-                    } else {
-                        continuation.resume(throwing: error)
-                    }
-                }
-            }
-        }
-    }
-
-
-    public func complete() {
-        connection.invalidate()
-    }
-
-    public struct NoDataError: Error {}
-
-}
-

Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift

@@ -1,65 +1,54 @@
-import Testing
-import Foundation
+import XCTest
 @testable import Brief
 
-@Suite struct ReleaseParsingTests {
+class ReleaseParsingTests: XCTestCase {
 
-    @Test
-    func nonCritical() {
+    func testNonCritical() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release")
-        #expect(release.critical == false)
+        XCTAssert(release.critical == false)
     }
 
-    @Test
-    func critical() {
+    func testCritical() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
-        #expect(release.critical == true)
+        XCTAssert(release.critical == true)
     }
 
-    @Test
-    func osMissing() {
+    func testOSMissing() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
-        #expect(release.minimumOSVersion == SemVer("11.0.0"))
+        XCTAssert(release.minimumOSVersion == SemVer("11.0.0"))
     }
 
-    @Test
-    func osPresentWithContentBelow() {
+    func testOSPresentWithContentBelow() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update ##Minimum macOS Version\n1.2.3\nBuild info")
-        #expect(release.minimumOSVersion == SemVer("1.2.3"))
+        XCTAssert(release.minimumOSVersion == SemVer("1.2.3"))
     }
 
-    @Test
-    func osPresentAtEnd() {
+    func testOSPresentAtEnd() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
-        #expect(release.minimumOSVersion == SemVer("1.2.3"))
+        XCTAssert(release.minimumOSVersion == SemVer("1.2.3"))
     }
 
-    @Test
-    func osWithMacOSPrefix() {
+    func testOSWithMacOSPrefix() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: macOS 1.2.3")
-        #expect(release.minimumOSVersion == SemVer("1.2.3"))
+        XCTAssert(release.minimumOSVersion == SemVer("1.2.3"))
     }
 
-    @Test
-    func osGreaterThanMinimum() {
+    func testOSGreaterThanMinimum() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
-        #expect(release.minimumOSVersion < SemVer("11.0.0"))
+        XCTAssert(release.minimumOSVersion < SemVer("11.0.0"))
     }
 
-    @Test
-    func osEqualToMinimum() {
+    func testOSEqualToMinimum() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 11.2.3")
-        #expect(release.minimumOSVersion <= SemVer("11.2.3"))
+        XCTAssert(release.minimumOSVersion <= SemVer("11.2.3"))
     }
 
-    @Test
-    func osLessThanMinimum() {
+    func testOSLessThanMinimum() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
-        #expect(release.minimumOSVersion > SemVer("1.0.0"))
+        XCTAssert(release.minimumOSVersion > SemVer("1.0.0"))
     }
 
-    @Test
-    @MainActor func greatestSelectedIfOldPatchIsPublishedLater() async throws {
+    func testGreatestSelectedIfOldPatchIsPublishedLater() {
         // If 2.x.x series has been published, and a patch for 1.x.x is issued
         // 2.x.x should still be selected if user can run it.
         let updater = Updater(checkOnLaunch: false, osVersion: SemVer("2.2.3"), currentVersion: SemVer("1.0.0"))
@@ -71,13 +60,16 @@ import Foundation
             Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"),
         ]
 
-        await updater.evaluate(releases: releases)
-        try await Task.sleep(nanoseconds: 1)
-        #expect(updater.update == two)
+        let expectation = XCTestExpectation()
+        updater.evaluate(releases: releases)
+        DispatchQueue.main.async {
+            XCTAssert(updater.update == two)
+            expectation.fulfill()
+        }
+        wait(for: [expectation], timeout: 1)
     }
 
-    @Test
-    @MainActor func latestVersionIsRunnable() async throws {
+    func testLatestVersionIsRunnable() {
         // If the 2.x.x series has been published but the user can't run it
         // the last version the user can run should be selected.
         let updater = Updater(checkOnLaunch: false, osVersion: SemVer("1.2.3"), currentVersion: SemVer("1.0.0"))
@@ -88,13 +80,16 @@ import Foundation
             Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available! Minimum macOS Version: 2.2.3"),
             Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"),
         ]
-        await updater.evaluate(releases: releases)
-        try await Task.sleep(nanoseconds: 1)
-        #expect(updater.update == oneOhTwo)
+        let expectation = XCTestExpectation()
+        updater.evaluate(releases: releases)
+        DispatchQueue.main.async {
+            XCTAssert(updater.update == oneOhTwo)
+            expectation.fulfill()
+        }
+        wait(for: [expectation], timeout: 1)
     }
 
-    @Test
-    func sorting() {
+    func testSorting() {
         let two = Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available!")
         let releases = [
             Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release"),
@@ -103,7 +98,7 @@ import Foundation
             Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch!"),
         ]
         let sorted = releases.sorted().reversed().first
-        #expect(sorted == two)
+        XCTAssert(sorted == two)
     }
 
 }

Sources/Packages/Tests/BriefTests/SemVerTests.swift

@@ -1,52 +1,51 @@
-import Testing
-import Foundation
+import XCTest
 @testable import Brief
 
-@Suite struct SemVerTests {
+class SemVerTests: XCTestCase {
 
-    @Test func equal() {
+    func testEqual() {
         let current = SemVer("1.0.2")
         let old = SemVer("1.0.2")
-        #expect(!(current > old))
+        XCTAssert(!(current > old))
     }
 
-    @Test func patchGreaterButMinorLess() {
+    func testPatchGreaterButMinorLess() {
         let current = SemVer("1.1.0")
         let old = SemVer("1.0.2")
-        #expect(current > old)
+        XCTAssert(current > old)
     }
 
-    @Test func majorSameMinorGreater() {
+    func testMajorSameMinorGreater() {
         let current = SemVer("1.0.2")
         let new = SemVer("1.0.3")
-        #expect(current < new)
+        XCTAssert(current < new)
     }
 
-    @Test func majorGreaterMinorLesser() {
+    func testMajorGreaterMinorLesser() {
         let current = SemVer("1.0.2")
         let new = SemVer("2.0.0")
-        #expect(current < new)
+        XCTAssert(current < new)
     }
 
-    @Test func regularParsing() {
+    func testRegularParsing() {
         let current = SemVer("1.0.2")
-        #expect(current.versionNumbers == [1, 0, 2])
+        XCTAssert(current.versionNumbers == [1, 0, 2])
     }
 
-    @Test func noPatch() {
+    func testNoPatch() {
         let current = SemVer("1.1")
-        #expect(current.versionNumbers == [1, 1, 0])
+        XCTAssert(current.versionNumbers == [1, 1, 0])
     }
 
-    @Test func garbage() {
+    func testGarbage() {
         let current = SemVer("Test")
-        #expect(current.versionNumbers == [0, 0, 0])
+        XCTAssert(current.versionNumbers == [0, 0, 0])
     }
 
-    @Test func beta() {
+    func testBeta() {
         let current = SemVer("1.0.2")
         let new = SemVer("1.1.0_beta1")
-        #expect(current < new)
+        XCTAssert(current < new)
     }
 
 }

Sources/Packages/Tests/SSHProtocolKitTests/OpenSSHPublicKeyWriterTests.swift

@@ -1,54 +0,0 @@
-import Foundation
-import Testing
-@testable import SecretKit
-import SSHProtocolKit
-
-@Suite struct OpenSSHPublicKeyWriterTests {
-
-    let writer = OpenSSHPublicKeyWriter()
-
-    @Test func ecdsa256MD5Fingerprint() {
-        #expect(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa256Secret) == "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
-    }
-
-    @Test func ecdsa256SHA256Fingerprint() {
-        #expect(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa256Secret) == "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650")
-    }
-
-    @Test func ecdsa256PublicKey() {
-        #expect(writer.openSSHString(secret:  Constants.ecdsa256Secret) ==
-        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo= test@example.com")
-    }
-
-    @Test func ecdsa256Hash() {
-    #expect(writer.data(secret: Constants.ecdsa256Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo="))
-    }
-
-    @Test func ecdsa384MD5Fingerprint() {
-        #expect(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa384Secret) == "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e")
-    }
-
-    @Test func ecdsa384SHA256Fingerprint() {
-        #expect(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa384Secret) == "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I")
-    }
-
-    @Test func ecdsa384PublicKey() {
-        #expect(writer.openSSHString(secret:  Constants.ecdsa384Secret) ==
-                       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ== test@example.com")
-    }
-
-    @Test func ecdsa384Hash() {
-        #expect(writer.data(secret: Constants.ecdsa384Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ=="))
-    }
-
-}
-
-extension OpenSSHPublicKeyWriterTests {
-
-    enum Constants {
-        static let ecdsa256Secret =  TestSecret(id: Data(), name: "Test Key (ECDSA 256)", publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
-        static let ecdsa384Secret = TestSecret(id: Data(), name: "Test Key (ECDSA 384)", publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 384), authentication: .notRequired, publicKeyAttribution: "test@example.com"))
-
-    }
-
-}

Sources/Packages/Tests/SSHProtocolKitTests/OpenSSHReaderTests.swift

@@ -1,25 +0,0 @@
-import Foundation
-import Testing
-import SSHProtocolKit
-
-@Suite struct OpenSSHReaderTests {
-
-    @Test func signatureRequest() throws {
-        let reader = OpenSSHReader(data: Constants.signatureRequest)
-        let hash = try reader.readNextChunk()
-        #expect(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ=="))
-        let dataToSign = try reader.readNextChunk()
-        #expect(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU="))
-        let empty = try reader.readNextChunk()
-        #expect(empty.isEmpty)
-    }
-
-}
-
-extension OpenSSHReaderTests {
-
-    enum Constants {
-        static let signatureRequest = Data(base64Encoded: "AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QUAAADvAAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QUAAAAA")!
-    }
-
-}

Sources/Packages/Tests/SSHProtocolKitTests/OpenSSHSignatureWriterTests.swift

@@ -1,83 +0,0 @@
-import Foundation
-import Testing
-import SSHProtocolKit
-@testable import SecretKit
-
-@Suite struct OpenSSHSignatureWriterTests {
-
-    private let writer = OpenSSHSignatureWriter()
-
-    @Test func ecdsaMpintStripsUnnecessaryLeadingZeros() throws {
-        let secret = Constants.ecdsa256Secret
-
-        // r has a leading 0x00 followed by 0x01 (< 0x80): the mpint must not keep the leading zero.
-        let rBytes: [UInt8] = [0x00] + (1...31).map { UInt8($0) }
-        let r = Data(rBytes)
-        // s has two leading 0x00 bytes followed by 0x7f (< 0x80): the mpint must not keep the leading zeros.
-        let sBytes: [UInt8] = [0x00, 0x00, 0x7f] + Array(repeating: UInt8(0x01), count: 29)
-        let s = Data(sBytes)
-        let rawRepresentation = r + s
-
-        let response = writer.data(secret: secret, signature: rawRepresentation)
-        let (parsedR, parsedS) = try parseEcdsaSignatureMpints(from: response)
-
-        #expect(parsedR == Data((1...31).map { UInt8($0) }))
-        #expect(parsedS == Data([0x7f] + Array(repeating: UInt8(0x01), count: 29)))
-    }
-
-    @Test func ecdsaMpintPrefixesZeroWhenHighBitSet() throws {
-        let secret = Constants.ecdsa256Secret
-
-        // r starts with 0x80 (high bit set): mpint must be prefixed with 0x00.
-        let r = Data([UInt8(0x80)] + Array(repeating: UInt8(0x01), count: 31))
-        let s = Data([UInt8(0x01)] + Array(repeating: UInt8(0x02), count: 31))
-        let rawRepresentation = r + s
-
-        let response = writer.data(secret: secret, signature: rawRepresentation)
-        let (parsedR, parsedS) = try parseEcdsaSignatureMpints(from: response)
-
-        #expect(parsedR == Data([0x00, 0x80] + Array(repeating: UInt8(0x01), count: 31)))
-        #expect(parsedS == Data([0x01] + Array(repeating: UInt8(0x02), count: 31)))
-    }
-
-}
-
-private extension OpenSSHSignatureWriterTests {
-
-    enum Constants {
-        static let ecdsa256Secret = TestSecret(
-            id: Data(),
-            name: "Test Key (ECDSA 256)",
-            publicKey: Data(repeating: 0x01, count: 65),
-            attributes: Attributes(
-                keyType: KeyType(algorithm: .ecdsa, size: 256),
-                authentication: .notRequired,
-                publicKeyAttribution: "test@example.com"
-            )
-        )
-    }
-
-    enum ParseError: Error {
-        case eof
-        case invalidAlgorithm
-    }
-
-    func parseEcdsaSignatureMpints(from openSSHSignedData: Data) throws -> (r: Data, s: Data) {
-        let reader = OpenSSHReader(data: openSSHSignedData)
-
-        // Prefix
-        _ = try reader.readNextBytes(as: UInt32.self)
-
-        let algorithm = try reader.readNextChunkAsString()
-        guard algorithm == "ecdsa-sha2-nistp256" else {
-            throw ParseError.invalidAlgorithm
-        }
-
-        let sigReader = try reader.readNextChunkAsSubReader()
-        let r = try sigReader.readNextChunk()
-        let s = try sigReader.readNextChunk()
-        return (r, s)
-    }
-
-}
-

Sources/Packages/Tests/SSHProtocolKitTests/TestSecret.swift

@@ -1,11 +0,0 @@
-import Foundation
-import SecretKit
-
-public struct TestSecret: SecretKit.Secret {
-    
-    public let id: Data
-    public let name: String
-    public let publicKey: Data
-    public var attributes: Attributes
-    
-}

Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift

@@ -1,60 +1,56 @@
 import Foundation
-import Testing
+import XCTest
 import CryptoKit
-@testable import SSHProtocolKit
 @testable import SecretKit
 @testable import SecretAgentKit
 
-@Suite struct AgentTests {
+class AgentTests: XCTestCase {
+
+    let stubWriter = StubFileHandleWriter()
 
     // MARK: Identity Listing
 
-    @Test func emptyStores() async throws {
+    func testEmptyStores() {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
         let agent = Agent(storeList: SecretStoreList())
-        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestIdentities)
-        let response = await agent.handle(request: request, provenance: .test)
-        #expect(response == Constants.Responses.requestIdentitiesEmpty)
+        agent.handle(reader: stubReader, writer: stubWriter)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesEmpty)
     }
 
-    @Test func identitiesList() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+    func testIdentitiesList() {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestIdentities)
-        let response = await agent.handle(request: request, provenance: .test)
-
-        let actual = OpenSSHReader(data: response)
-        let expected = OpenSSHReader(data: Constants.Responses.requestIdentitiesMultiple)
-        print(actual, expected)
-        #expect(response == Constants.Responses.requestIdentitiesMultiple)
+        agent.handle(reader: stubReader, writer: stubWriter)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesMultiple)
     }
 
     // MARK: Signatures
 
-    @Test func noMatchingIdentities() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+    func testNoMatchingIdentities() {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignatureWithNoneMatching)
-        let response = await agent.handle(request: request, provenance: .test)
-        #expect(response == Constants.Responses.requestFailure)
+        agent.handle(reader: stubReader, writer: stubWriter)
+//        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
-    @Test func ecdsaSignature() async throws {
-        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        guard case SSHAgent.Request.signRequest(let context) = request else { return }
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+    func testSignature() {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...])
+        _ = requestReader.readNextChunk()
+        let dataToSign = requestReader.readNextChunk()
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        let response = await agent.handle(request: request, provenance: .test)
-        let responseReader = OpenSSHReader(data: response)
-        let length = try responseReader.readNextBytes(as: UInt32.self)
-        let type = try responseReader.readNextBytes(as: UInt8.self)
-        #expect(length == response.count - MemoryLayout<UInt32>.size)
-        #expect(type == SSHAgent.Response.agentSignResponse.rawValue)
-        let outer = OpenSSHReader(data: responseReader.remaining)
-        let inner = try outer.readNextChunkAsSubReader()
-        _ = try inner.readNextChunk()
-        let rsData = try inner.readNextChunkAsSubReader()
-        var r = try rsData.readNextChunk()
-        var s = try rsData.readNextChunk()
+        agent.handle(reader: stubReader, writer: stubWriter)
+        let outer = OpenSSHReader(data: stubWriter.data[5...])
+        let payload = outer.readNextChunk()
+        let inner = OpenSSHReader(data: payload)
+        _ = inner.readNextChunk()
+        let signedData = inner.readNextChunk()
+        let rsData = OpenSSHReader(data: signedData)
+        var r = rsData.readNextChunk()
+        var s = rsData.readNextChunk()
         // This is fine IRL, but it freaks out CryptoKit
         if r[0] == 0 {
             r.removeFirst()
@@ -64,42 +60,43 @@ import CryptoKit
         }
         var rs = r
         rs.append(s)
-        let signature = try P256.Signing.ECDSASignature(rawRepresentation: rs)
-        // Correct signature
-        #expect(try P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey)
-            .isValidSignature(signature, for: context.dataToSign))
+        let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs)
+        let valid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
+        XCTAssertTrue(valid)
     }
 
     // MARK: Witness protocol
 
-    @Test func witnessObjectionStopsRequest() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
+    func testWitnessObjectionStopsRequest() {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
         let witness = StubWitness(speakNow: { _,_  in
             return true
         }, witness: { _, _ in })
         let agent = Agent(storeList: list, witness: witness)
-        let response = await agent.handle(request: .signRequest(.empty), provenance: .test)
-        #expect(response == Constants.Responses.requestFailure)
+        agent.handle(reader: stubReader, writer: stubWriter)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
-    @Test func witnessSignature() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
-        nonisolated(unsafe) var witnessed = false
+    func testWitnessSignature() {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
+        var witnessed = false
         let witness = StubWitness(speakNow: { _, trace  in
             return false
         }, witness: { _, trace in
             witnessed = true
         })
         let agent = Agent(storeList: list, witness: witness)
-        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        _ = await agent.handle(request: request, provenance: .test)
-        #expect(witnessed)
+        agent.handle(reader: stubReader, writer: stubWriter)
+        XCTAssertTrue(witnessed)
     }
 
-    @Test func requestTracing() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret])
-        nonisolated(unsafe) var speakNowTrace: SigningRequestProvenance?
-        nonisolated(unsafe) var witnessTrace: SigningRequestProvenance?
+    func testRequestTracing() {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
+        var speakNowTrace: SigningRequestProvenance! = nil
+        var witnessTrace: SigningRequestProvenance! = nil
         let witness = StubWitness(speakNow: { _, trace  in
             speakNowTrace = trace
             return false
@@ -107,43 +104,39 @@ import CryptoKit
             witnessTrace = trace
         })
         let agent = Agent(storeList: list, witness: witness)
-        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        _ = await agent.handle(request: request, provenance: .test)
-        #expect(witnessTrace == speakNowTrace)
-        #expect(witnessTrace == .test)
+        agent.handle(reader: stubReader, writer: stubWriter)
+        XCTAssertEqual(witnessTrace, speakNowTrace)
+        XCTAssertEqual(witnessTrace.origin.displayName, "Finder")
+        XCTAssertEqual(witnessTrace.origin.validSignature, true)
+        XCTAssertEqual(witnessTrace.origin.parentPID, 1)
     }
 
     // MARK: Exception Handling
 
-    @Test func signatureException() async throws {
-        let list = await storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
-        let store = await list.stores.first?.base as! Stub.Store
+    func testSignatureException() {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
+        let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
+        let store = list.stores.first?.base as! Stub.Store
         store.shouldThrow = true
         let agent = Agent(storeList: list)
-        let request = try SSHAgentInputParser().parse(data: Constants.Requests.requestSignature)
-        let response = await agent.handle(request: request, provenance: .test)
-        #expect(response == Constants.Responses.requestFailure)
+        agent.handle(reader: stubReader, writer: stubWriter)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
     // MARK: Unsupported
 
-    @Test func unhandledAdd() async throws {
+    func testUnhandledAdd() {
+        let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity)
         let agent = Agent(storeList: SecretStoreList())
-        let response = await agent.handle(request: .addIdentity, provenance: .test)
-        #expect(response == Constants.Responses.requestFailure)
+        agent.handle(reader: stubReader, writer: stubWriter)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
 }
 
-extension SigningRequestProvenance {
-
-    static let test = SigningRequestProvenance(root: .init(pid: 0, processName: "test", appName: nil, iconURL: nil, path: "/", validSignature: true, parentPID: 0))
-
-}
-
 extension AgentTests {
 
-    @MainActor func storeList(with secrets: [Stub.Secret]) async -> SecretStoreList {
+    func storeList(with secrets: [Stub.Secret]) -> SecretStoreList {
         let store = Stub.Store()
         store.secrets.append(contentsOf: secrets)
         let storeList = SecretStoreList()
@@ -155,13 +148,14 @@ extension AgentTests {
 
         enum Requests {
             static let requestIdentities = Data(base64Encoded: "AAAAAQs=")!
+            static let addIdentity = Data(base64Encoded: "AAAAARE=")!
             static let requestSignatureWithNoneMatching = Data(base64Encoded: "AAABhA0AAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAO8AAAAgbqmrqPUtJ8mmrtaSVexjMYyXWNqjHSnoto7zgv86xvcyAAAAA2dpdAAAAA5zc2gtY29ubmVjdGlvbgAAAAlwdWJsaWNrZXkBAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQAAAAA=")!
             static let requestSignature = Data(base64Encoded: "AAABRA0AAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKzOkUiVJEcACMtAd9X7xalbc0FYZyhbmv2dsWl4IP2GWIi+RcsaHQNw+nAIQ8CKEYmLnl0VLDp5Ef8KMhgIy08AAADPAAAAIBIFsbCZ4/dhBmLNGHm0GKj7EJ4N8k/jXRxlyg+LFIYzMgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAAA==")!
         }
 
         enum Responses {
             static let requestIdentitiesEmpty = Data(base64Encoded: "AAAABQwAAAAA")!
-            static let requestIdentitiesMultiple = Data(base64Encoded: "AAABLwwAAAACAAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAFWVjZHNhLTI1NkBleGFtcGxlLmNvbQAAAIgAAAATZWNkc2Etc2hhMi1uaXN0cDM4NAAAAAhuaXN0cDM4NAAAAGEEspLMDmreMJverQkqKC9zF9ZUasn5uSWkbRlz1jNTCtuyH1KKm+VImL6wdAj47SbzwM6lEEC24AdfrR64P9i/bnS2i83v/4wQVtcZn+Et13QGgWlZst8lxCPzTookaVwMAAAAFWVjZHNhLTM4NEBleGFtcGxlLmNvbQ==")!
+            static let requestIdentitiesMultiple = Data(base64Encoded: "AAABKwwAAAACAAAAaAAAABNlY2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSszpFIlSRHAAjLQHfV+8WpW3NBWGcoW5r9nbFpeCD9hliIvkXLGh0DcPpwCEPAihGJi55dFSw6eRH/CjIYCMtPAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAACIAAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBLKSzA5q3jCb3q0JKigvcxfWVGrJ+bklpG0Zc9YzUwrbsh9SipvlSJi+sHQI+O0m88DOpRBAtuAHX60euD/Yv250tovN7/+MEFbXGZ/hLdd0BoFpWbLfJcQj806KJGlcDAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0")!
             static let requestFailure = Data(base64Encoded: "AAAAAQU=")!
         }
 

Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleReader.swift

@@ -0,0 +1,14 @@
+import SecretAgentKit
+import AppKit
+
+struct StubFileHandleReader: FileHandleReader {
+
+    let availableData: Data
+    var fileDescriptor: Int32 {
+        NSWorkspace.shared.runningApplications.filter({ $0.localizedName == "Finder" }).first!.processIdentifier
+    }
+    var pidOfConnectedProcess: Int32 {
+        fileDescriptor
+    }
+
+}

Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift

@@ -0,0 +1,12 @@
+import Foundation
+import SecretAgentKit
+
+class StubFileHandleWriter: FileHandleWriter {
+
+    var data = Data()
+
+    func write(_ data: Data) {
+        self.data.append(data)
+    }
+
+}

Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift

@@ -1,13 +1,12 @@
 import Foundation
 import SecretKit
 import CryptoKit
-import SSHProtocolKit
 
 struct Stub {}
 
 extension Stub {
 
-    public final class Store: SecretStore, @unchecked Sendable {
+    public class Store: SecretStore {
 
         public let isAvailable = true
         public let id = UUID()
@@ -28,7 +27,7 @@ extension Stub {
                                                 flags,
                                                 nil) as Any
 
-            let attributes = KeychainDictionary([
+            let attributes = [
                 kSecAttrLabel: name,
                 kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
                 kSecAttrKeySizeInBits: size,
@@ -36,25 +35,40 @@ extension Stub {
                     kSecAttrIsPermanent: true,
                     kSecAttrAccessControl: access
                 ]
-                ])
+                ] as CFDictionary
 
-            let privateKey = SecKeyCreateRandomKey(attributes, nil)!
-            let publicKey = SecKeyCopyPublicKey(privateKey)!
+            var privateKey: SecKey! = nil
+            var publicKey: SecKey! = nil
+            SecKeyGeneratePair(attributes, &publicKey, &privateKey)
             let publicAttributes = SecKeyCopyAttributes(publicKey) as! [CFString: Any]
             let privateAttributes = SecKeyCopyAttributes(privateKey) as! [CFString: Any]
             let publicData = (publicAttributes[kSecValueData] as! Data)
             let privateData = (privateAttributes[kSecValueData] as! Data)
             let secret = Secret(keySize: size, publicKey: publicData, privateKey: privateData)
             print(secret)
-            print("Public Key OpenSSH: \(OpenSSHPublicKeyWriter().openSSHString(secret: secret))")
+            print("Public Key OpenSSH: \(OpenSSHKeyWriter().openSSHString(secret: secret))")
         }
 
         public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
             guard !shouldThrow else {
                 throw NSError(domain: "test", code: 0, userInfo: nil)
             }
-            let privateKey = try CryptoKit.P256.Signing.PrivateKey(x963Representation: secret.privateKey)
-            return try privateKey.signature(for: data).rawRepresentation
+            let privateKey = SecKeyCreateWithData(secret.privateKey as CFData, [
+                kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
+                kSecAttrKeySizeInBits: secret.keySize,
+                kSecAttrKeyClass: kSecAttrKeyClassPrivate
+                ] as CFDictionary
+                , nil)!
+            let signatureAlgorithm: SecKeyAlgorithm
+            switch secret.keySize {
+            case 256:
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA256
+            case 384:
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA384
+            default:
+                fatalError()
+            }
+            return SecKeyCreateSignature(privateKey, signatureAlgorithm, data as CFData, nil)! as Data
         }
 
         public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {
@@ -75,22 +89,24 @@ extension Stub {
 
     struct Secret: SecretKit.Secret, CustomDebugStringConvertible {
 
-        let id = Data(UUID().uuidString.utf8)
+        let id = UUID().uuidString.data(using: .utf8)!
         let name = UUID().uuidString
-        let attributes: Attributes
+        let algorithm = Algorithm.ellipticCurve
+
+        let keySize: Int
         let publicKey: Data
         let requiresAuthentication = false
         let privateKey: Data
 
         init(keySize: Int, publicKey: Data, privateKey: Data) {
-            self.attributes = Attributes(keyType: .init(algorithm: .ecdsa, size: keySize), authentication: .notRequired, publicKeyAttribution: "ecdsa-\(keySize)@example.com")
+            self.keySize = keySize
             self.publicKey = publicKey
             self.privateKey = privateKey
         }
 
         var debugDescription: String {
             """
-            Key Size \(attributes.keyType.size)
+            Key Size \(keySize)
             Private: \(privateKey.base64EncodedString())
             Public: \(publicKey.base64EncodedString())
             """

Sources/Packages/Tests/SecretAgentKitTests/StubWitness.swift

@@ -3,8 +3,8 @@ import SecretAgentKit
 
 struct StubWitness {
 
-    let speakNow: @Sendable (AnySecret, SigningRequestProvenance) -> Bool
-    let witness: @Sendable (AnySecret, SigningRequestProvenance) -> ()
+    let speakNow: (AnySecret, SigningRequestProvenance) -> Bool
+    let witness: (AnySecret, SigningRequestProvenance) -> ()
 
 }
 

Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift

@@ -1,20 +1,19 @@
 import Foundation
-import Testing
+import XCTest
 @testable import SecretKit
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
+class AnySecretTests: XCTestCase {
 
-@Suite struct AnySecretTests {
-
-    @Test func eraser() {
-        let data = Data(UUID().uuidString.utf8)
-        let secret = SmartCard.Secret(id: data, name: "Name", publicKey: data, attributes: Attributes(keyType: KeyType(algorithm: .ecdsa, size: 256), authentication: .notRequired))
+    func testEraser() {
+        let secret = SmartCard.Secret(id: UUID().uuidString.data(using: .utf8)!, name: "Name", algorithm: .ellipticCurve, keySize: 256, publicKey: UUID().uuidString.data(using: .utf8)!)
         let erased = AnySecret(secret)
-        #expect(erased.id == secret.id as AnyHashable)
-        #expect(erased.name == secret.name)
-        #expect(erased.keyType == secret.keyType)
-        #expect(erased.publicKey == secret.publicKey)
+        XCTAssert(erased.id == secret.id as AnyHashable)
+        XCTAssert(erased.name == secret.name)
+        XCTAssert(erased.algorithm == secret.algorithm)
+        XCTAssert(erased.keySize == secret.keySize)
+        XCTAssert(erased.publicKey == secret.publicKey)
     }
 
 }

Sources/Packages/Tests/SecretKitTests/OpenSSHReaderTests.swift

@@ -0,0 +1,27 @@
+import Foundation
+import XCTest
+@testable import SecretKit
+@testable import SecureEnclaveSecretKit
+@testable import SmartCardSecretKit
+
+class OpenSSHReaderTests: XCTestCase {
+
+    func testSignatureRequest() {
+        let reader = OpenSSHReader(data: Constants.signatureRequest)
+        let hash = reader.readNextChunk()
+        XCTAssert(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ=="))
+        let dataToSign = reader.readNextChunk()
+        XCTAssert(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU="))
+        let empty = reader.readNextChunk()
+        XCTAssert(empty.isEmpty)
+    }
+
+}
+
+extension OpenSSHReaderTests {
+
+    enum Constants {
+        static let signatureRequest = Data(base64Encoded: "AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QUAAADvAAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QUAAAAA")!
+    }
+
+}

Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift

@@ -0,0 +1,55 @@
+import Foundation
+import XCTest
+@testable import SecretKit
+@testable import SecureEnclaveSecretKit
+@testable import SmartCardSecretKit
+
+class OpenSSHWriterTests: XCTestCase {
+
+    let writer = OpenSSHKeyWriter()
+
+    func testECDSA256MD5Fingerprint() {
+        XCTAssertEqual(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa256Secret), "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
+    }
+
+    func testECDSA256SHA256Fingerprint() {
+        XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa256Secret), "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650")
+    }
+
+    func testECDSA256PublicKey() {
+        XCTAssertEqual(writer.openSSHString(secret:  Constants.ecdsa256Secret),
+        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")
+    }
+
+    func testECDSA256Hash() {
+    XCTAssertEqual(writer.data(secret: Constants.ecdsa256Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo="))
+    }
+
+    func testECDSA384MD5Fingerprint() {
+        XCTAssertEqual(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa384Secret), "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e")
+    }
+
+    func testECDSA384SHA256Fingerprint() {
+        XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa384Secret), "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I")
+    }
+
+    func testECDSA384PublicKey() {
+        XCTAssertEqual(writer.openSSHString(secret:  Constants.ecdsa384Secret),
+                       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")
+    }
+
+    func testECDSA384Hash() {
+        XCTAssertEqual(writer.data(secret: Constants.ecdsa384Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ=="))
+    }
+
+}
+
+extension OpenSSHWriterTests {
+
+    enum Constants {
+        static let ecdsa256Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 256)", algorithm: .ellipticCurve, keySize: 256, publicKey: Data(base64Encoded: "BOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")!)
+        static let ecdsa384Secret =  SmartCard.Secret(id: Data(), name: "Test Key (ECDSA 384)", algorithm: .ellipticCurve, keySize: 384, publicKey: Data(base64Encoded: "BG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")!)
+
+    }
+
+}

Sources/SecretAgent/AppDelegate.swift

@@ -1,71 +1,46 @@
 import Cocoa
 import OSLog
+import Combine
 import SecretKit
 import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import SecretAgentKit
 import Brief
-import Observation
-import Common
 
-@main
+@NSApplicationMain
 class AppDelegate: NSObject, NSApplicationDelegate {
 
-    @MainActor private let storeList: SecretStoreList = {
+    private let storeList: SecretStoreList = {
         let list = SecretStoreList()
-        let cryptoKit = SecureEnclave.Store()
-        let migrator = SecureEnclave.CryptoKitMigrator()
-        try? migrator.migrate(to: cryptoKit)
-        list.add(store: cryptoKit)
+        list.add(store: SecureEnclave.Store())
         list.add(store: SmartCard.Store())
         return list
     }()
-    private let updater = Updater(checkOnLaunch: true)
+    private let updater = Updater(checkOnLaunch: false)
     private let notifier = Notifier()
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(directory: URL.publicKeyDirectory)
+    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
     private lazy var agent: Agent = {
         Agent(storeList: storeList, witness: notifier)
     }()
     private lazy var socketController: SocketController = {
-        let path = URL.socketPath as String
+        let path = (NSHomeDirectory() as NSString).appendingPathComponent("socket.ssh") as String
         return SocketController(path: path)
     }()
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "AppDelegate")
+    private var updateSink: AnyCancellable?
 
     func applicationDidFinishLaunching(_ aNotification: Notification) {
-        logger.debug("SecretAgent finished launching")
-        Task {
-            for await session in socketController.sessions {
-                Task {
-                    let inputParser = try await XPCAgentInputParser()
-                    do {
-                        for await message in session.messages {
-                            let request = try await inputParser.parse(data: message)
-                            let agentResponse = await agent.handle(request: request, provenance: session.provenance)
-                            try session.write(agentResponse)
-                        }
-                    } catch {
-                        try session.close()
-                    }
-                }
-            }
+        Logger().debug("SecretAgent finished launching")
+        DispatchQueue.main.async {
+            self.socketController.handler = self.agent.handle(reader:writer:)
         }
-        Task {
-            for await _ in NotificationCenter.default.notifications(named: .secretStoreReloaded) {
-                try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
-            }
+        NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in
+            try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
         }
-        try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
+        try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
         notifier.prompt()
-        _ = withObservationTracking {
-            updater.update
-        } onChange: { [updater, notifier] in
-            Task {
-                guard !updater.currentVersion.isTestBuild else { return }
-                await notifier.notify(update: updater.update!) { release in
-                    await updater.ignore(release: release)
-                }
-            }
+        updateSink = updater.$update.sink { update in
+            guard let update = update else { return }
+            self.notifier.notify(update: update, ignore: self.updater.ignore(release:))
         }
     }
 

Sources/SecretAgent/Assets.xcassets/AppIcon.appiconset/Contents.json

@@ -0,0 +1,60 @@
+{
+  "images" : [
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "16x16"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "16x16"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "32x32"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "32x32"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "128x128"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "128x128"
+    },
+    {
+      "filename" : "Mac Icon.png",
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "256x256"
+    },
+    {
+      "filename" : "Mac Icon@0.25x.png",
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "256x256"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "1x",
+      "size" : "512x512"
+    },
+    {
+      "idiom" : "mac",
+      "scale" : "2x",
+      "size" : "512x512"
+    }
+  ],
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

Sources/SecretAgent/Assets.xcassets/Contents.json

@@ -0,0 +1,6 @@
+{
+  "info" : {
+    "author" : "xcode",
+    "version" : 1
+  }
+}

Sources/SecretAgent/InternetAccessPolicy.plist

@@ -9,7 +9,22 @@
 	<key>Website</key>
 	<string>https://github.com/maxgoedjen/secretive</string>
 	<key>Connections</key>
-	<array/>
+	<array>
+		<dict>
+			<key>IsIncoming</key>
+			<false/>
+			<key>Host</key>
+			<string>api.github.com</string>
+			<key>NetworkProtocol</key>
+			<string>TCP</string>
+			<key>Port</key>
+			<string>443</string>
+			<key>Purpose</key>
+			<string>Secretive checks GitHub for new versions and security updates.</string>
+			<key>DenyConsequences</key>
+			<string>If you deny these connections, you will not be notified about new versions and critical security updates.</string>
+		</dict>
+	</array>
 	<key>Services</key>
 	<array/>
 </dict>

Sources/SecretAgent/Notifier.swift

@@ -5,13 +5,13 @@ import SecretKit
 import SecretAgentKit
 import Brief
 
-final class Notifier: Sendable {
+class Notifier {
 
     private let notificationDelegate = NotificationDelegate()
 
     init() {
-        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: String(localized: .updateNotificationUpdateButton), options: [])
-        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: String(localized: .updateNotificationIgnoreButton), options: [])
+        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: "Update", options: [])
+        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: "Ignore", options: [])
         let updateCategory = UNNotificationCategory(identifier: Constants.updateCategoryIdentitifier, actions: [updateAction, ignoreAction], intentIdentifiers: [], options: [])
         let criticalUpdateCategory = UNNotificationCategory(identifier: Constants.criticalUpdateCategoryIdentitifier, actions: [updateAction], intentIdentifiers: [], options: [])
 
@@ -22,35 +22,32 @@ final class Notifier: Sendable {
             Measurement(value: 24, unit: UnitDuration.hours)
         ]
 
-        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: String(localized: .persistAuthenticationDeclineButton), options: [])
+        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: "Do Not Unlock", options: [])
         var allPersistenceActions = [doNotPersistAction]
 
         let formatter = DateComponentsFormatter()
         formatter.unitsStyle = .spellOut
         formatter.allowedUnits = [.hour, .minute, .day]
 
-        var identifiers: [String: TimeInterval] = [:]
         for duration in rawDurations {
             let seconds = duration.converted(to: .seconds).value
             guard let string = formatter.string(from: seconds)?.capitalized else { continue }
             let identifier = Constants.persistAuthenticationCategoryIdentitifier.appending("\(seconds)")
             let action = UNNotificationAction(identifier: identifier, title: string, options: [])
-            identifiers[identifier] = seconds
+            notificationDelegate.persistOptions[identifier] = seconds
             allPersistenceActions.append(action)
         }
 
         let persistAuthenticationCategory = UNNotificationCategory(identifier: Constants.persistAuthenticationCategoryIdentitifier, actions: allPersistenceActions, intentIdentifiers: [], options: [])
         if persistAuthenticationCategory.responds(to: Selector(("actionsMenuTitle"))) {
-            persistAuthenticationCategory.setValue(String(localized: .persistAuthenticationAcceptButton), forKey: "_actionsMenuTitle")
+            persistAuthenticationCategory.setValue("Leave Unlocked", forKey: "_actionsMenuTitle")
         }
         UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory])
         UNUserNotificationCenter.current().delegate = notificationDelegate
 
-        Task {
-            await notificationDelegate.state.setPersistenceState(options: identifiers) { secret, store, duration in
-                guard let duration = duration else { return }
-                try? await store.persistAuthentication(secret: secret, forDuration: duration)
-            }
+        notificationDelegate.persistAuthentication = { secret, store, duration in
+            guard let duration = duration else { return }
+            try? store.persistAuthentication(secret: secret, forDuration: duration)
         }
 
     }
@@ -60,74 +57,57 @@ final class Notifier: Sendable {
         notificationCenter.requestAuthorization(options: .alert) { _, _ in }
     }
 
-    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async {
-        await notificationDelegate.state.setPending(secret: secret, store: store)
+    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) {
+        notificationDelegate.pendingPersistableSecrets[secret.id.description] = secret
+        notificationDelegate.pendingPersistableStores[store.id.description] = store
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
-        notificationContent.title = String(localized: .signedNotificationTitle(appName: provenance.origin.displayName))
-        notificationContent.subtitle = String(localized: .signedNotificationDescription(secretName: secret.name))
+        notificationContent.title = "Signed Request from \(provenance.origin.displayName)"
+        notificationContent.subtitle = "Using secret \"\(secret.name)\""
         notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
         notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
-        notificationContent.interruptionLevel = .timeSensitive
-        if await store.existingPersistedAuthenticationContext(secret: secret, provenance: provenance) == nil && secret.authenticationRequirement.required {
+        if #available(macOS 12.0, *) {
+            notificationContent.interruptionLevel = .timeSensitive
+        }
+        if secret.requiresAuthentication && store.existingPersistedAuthenticationContext(secret: secret) == nil {
             notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
         }
         if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
             notificationContent.attachments = [attachment]
         }
         let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
-        try? await notificationCenter.add(request)
+        notificationCenter.add(request, withCompletionHandler: nil)
     }
 
-    func notify(pendingAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async {
-        await notificationDelegate.state.setPending(secret: secret, store: store)
-        let notificationCenter = UNUserNotificationCenter.current()
-        let notificationContent = UNMutableNotificationContent()
-        notificationContent.title = "pending" //String(localized: .signedNotificationTitle(appName: provenance.origin.displayName))
-        notificationContent.subtitle = "pending" //String(localized: .signedNotificationDescription(secretName: secret.name))
-        notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
-        notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
-        notificationContent.interruptionLevel = .timeSensitive
-        notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
-        notificationContent.threadIdentifier = "\(secret.id)_\(provenance.hashValue)"
-        if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
-            notificationContent.attachments = [attachment]
-        }
-        let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
-        try? await notificationCenter.add(request)
-
-    }
-
-    func notify(update: Release, ignore: (@Sendable (Release) async -> Void)?) async {
-        await notificationDelegate.state.prepareForNotification(release: update, ignoreAction: ignore)
+    func notify(update: Release, ignore: ((Release) -> Void)?) {
+        notificationDelegate.release = update
+        notificationDelegate.ignore = ignore
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
         if update.critical {
-            notificationContent.interruptionLevel = .critical
-            notificationContent.title = String(localized: .updateNotificationUpdateCriticalTitle(updateName: update.name))
+            if #available(macOS 12.0, *) {
+                notificationContent.interruptionLevel = .critical
+            }
+            notificationContent.title = "Critical Security Update - \(update.name)"
         } else {
-            notificationContent.title = String(localized: .updateNotificationUpdateNormalTitle(updateName: update.name))
+            notificationContent.title = "Update Available - \(update.name)"
         }
-        notificationContent.subtitle = String(localized: .updateNotificationUpdateDescription)
+        notificationContent.subtitle = "Click to Update"
         notificationContent.body = update.body
         notificationContent.categoryIdentifier = update.critical ? Constants.criticalUpdateCategoryIdentitifier : Constants.updateCategoryIdentitifier
         let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
-        try? await notificationCenter.add(request)
+        notificationCenter.add(request, withCompletionHandler: nil)
     }
 
 }
 
 extension Notifier: SigningWitness {
 
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
     }
 
-    func witness(pendingAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
-        await notify(pendingAccessTo: secret, from: store, by: provenance)
-    }
-
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
-        await notify(accessTo: secret, from: store, by: provenance)
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
+        notify(accessTo: secret, from: store, by: provenance)
     }
 
 }
@@ -153,91 +133,55 @@ extension Notifier {
 
 }
 
-final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Sendable {
+class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
 
-    fileprivate actor State {
-        typealias PersistAction = (@Sendable (AnySecret, AnySecretStore, TimeInterval?) async -> Void)
-        typealias IgnoreAction = (@Sendable (Release) async -> Void)
-        fileprivate var release: Release?
-        fileprivate var ignoreAction: IgnoreAction?
-        fileprivate var persistAction: PersistAction?
-        fileprivate var persistOptions: [String: TimeInterval] = [:]
-        fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
-        fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
-
-        func setPending(secret: AnySecret, store: AnySecretStore) {
-            pendingPersistableSecrets[secret.id.description] = secret
-            pendingPersistableStores[store.id.description] = store
-        }
-
-        func retrievePending(secretID: String, storeID: String, optionID: String) -> (AnySecret, AnySecretStore, TimeInterval)? {
-            guard let secret = pendingPersistableSecrets[secretID],
-                  let store = pendingPersistableStores[storeID],
-                  let options = persistOptions[optionID] else {
-                return nil
-            }
-            pendingPersistableSecrets.removeValue(forKey: secretID)
-            return (secret, store, options)
-        }
-
-        func setPersistenceState(options: [String: TimeInterval], action: @escaping PersistAction) {
-            self.persistOptions = options
-            self.persistAction = action
-        }
-
-        func prepareForNotification(release: Release, ignoreAction: IgnoreAction?) {
-            self.release = release
-            self.ignoreAction = ignoreAction
-        }
-
-        
-    }
-
-    fileprivate let state = State()
+    fileprivate var release: Release?
+    fileprivate var ignore: ((Release) -> Void)?
+    fileprivate var persistAuthentication: ((AnySecret, AnySecretStore, TimeInterval?) -> Void)?
+    fileprivate var persistOptions: [String: TimeInterval] = [:]
+    fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
+    fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
 
     func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) {
 
     }
 
-    func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse) async {
+    func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
         let category = response.notification.request.content.categoryIdentifier
         switch category {
         case Notifier.Constants.updateCategoryIdentitifier:
-            await handleUpdateResponse(response: response)
+            handleUpdateResponse(response: response)
         case Notifier.Constants.persistAuthenticationCategoryIdentitifier:
-            await handlePersistAuthenticationResponse(response: response)
+            handlePersistAuthenticationResponse(response: response)
         default:
             break
         }
+
+        completionHandler()
     }
 
-    func handleUpdateResponse(response: UNNotificationResponse) async {
-        let id = response.actionIdentifier
-        guard let update = await state.release else { return }
-        switch id {
+    func handleUpdateResponse(response: UNNotificationResponse) {
+        guard let update = release else { return }
+        switch response.actionIdentifier {
         case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier:
             NSWorkspace.shared.open(update.html_url)
         case Notifier.Constants.ignoreActionIdentitifier:
-            await state.ignoreAction?(update)
+            ignore?(update)
         default:
             fatalError()
         }
     }
 
-    func handlePersistAuthenticationResponse(response: UNNotificationResponse) async {
-        guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String,
-              let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String else {
-            return
-        }
-        let optionID = response.actionIdentifier
-        guard let (secret, store, persistOptions) = await state.retrievePending(secretID: secretID, storeID: storeID, optionID: optionID) else { return }
-        await state.persistAction?(secret, store, persistOptions)
+    func handlePersistAuthenticationResponse(response: UNNotificationResponse) {
+        guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String, let secret = pendingPersistableSecrets[secretID],
+              let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String, let store = pendingPersistableStores[storeID]
+        else { return }
+        pendingPersistableSecrets[secretID] = nil
+        persistAuthentication?(secret, store, persistOptions[response.actionIdentifier])
     }
 
-
-    func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification) async -> UNNotificationPresentationOptions {
-        [.list, .banner]
+    func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
+        completionHandler([.list, .banner])
     }
 
 }
-

Sources/SecretAgent/SecretAgent.entitlements

@@ -2,24 +2,12 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>com.apple.security.hardened-process</key>
+	<key>com.apple.security.app-sandbox</key>
 	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.enable-pure-data</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.no-tagged-receive</key>
-	<true/>
-	<key>com.apple.security.hardened-process.dyld-ro</key>
-	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
-	<string>1</string>
-	<key>com.apple.security.hardened-process.hardened-heap</key>
+	<key>com.apple.security.network.client</key>
 	<true/>
 	<key>com.apple.security.smartcard</key>
 	<true/>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
 	<key>keychain-access-groups</key>
 	<array>
 		<string>$(AppIdentifierPrefix)com.maxgoedjen.Secretive</string>

Sources/SecretAgent/XPCInputParser.swift

@@ -1,30 +0,0 @@
-import Foundation
-import SecretAgentKit
-import Brief
-import XPCWrappers
-import OSLog
-import SSHProtocolKit
-
-/// Delegates all agent input parsing to an XPC service which wraps OpenSSH
-public final class XPCAgentInputParser: SSHAgentInputParserProtocol {
-
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "XPCAgentInputParser")
-    private let session: XPCTypedSession<SSHAgent.Request, SSHAgentInputParser.AgentParsingError>
-
-    public init() async throws {
-        logger.debug("Creating XPCAgentInputParser")
-        session = try await XPCTypedSession(serviceName: "com.maxgoedjen.Secretive.SecretAgentInputParser", warmup: true)
-        logger.debug("XPCAgentInputParser is warmed up.")
-    }
-
-    public func parse(data: Data) async throws -> SSHAgent.Request {
-        logger.debug("Parsing input")
-        defer { logger.debug("Parsed input") }
-        return try await session.send(data)
-    }
-
-    deinit {
-        session.complete()
-    }
-
-}

Sources/SecretAgentInputParser/Info.plist

@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>XPCService</key>
-	<dict>
-		<key>ServiceType</key>
-		<string>Application</string>
-	</dict>
-</dict>
-</plist>

Sources/SecretAgentInputParser/SecretAgentInputParser.entitlements

@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>com.apple.security.hardened-process</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.enable-pure-data</key>
-	<true/>
-	<key>com.apple.security.hardened-process.checked-allocations.no-tagged-receive</key>
-	<true/>
-	<key>com.apple.security.hardened-process.dyld-ro</key>
-	<true/>
-	<key>com.apple.security.hardened-process.hardened-heap</key>
-	<true/>
-	<key>com.apple.security.hardened-process.enhanced-security-version-string</key>
-	<string>1</string>
-	<key>com.apple.security.hardened-process.platform-restrictions-string</key>
-	<string>2</string>
-</dict>
-</plist>