Symlink to Package.swift

Remove unused verify functions. (#621 )
Add attestation info to readme (#620 )
2026-04-10 03:07:22 +02:00 · 2025-08-23 15:50:38 -07:00 · 2025-08-23 22:26:40 +00:00 · 2025-08-23 22:07:09 +00:00 · 2025-08-21 05:20:40 +00:00 · 2025-08-20 07:10:23 +00:00
35 changed files with 705 additions and 534 deletions
--- a/.github/templates/release.md
+++ b/.github/templates/release.md
@@ -0,0 +1,16 @@
+Update description
+
+## Features
+
+
+## Fixes
+
+
+## Minimum macOS Version
+
+
+## Build
+https://github.com/maxgoedjen/secretive/actions/runs/RUN_ID
+
+## Attestation
+https://github.com/maxgoedjen/secretive/attestations/ATTESTATION_ID
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -9,7 +9,7 @@ jobs:
    runs-on: macos-15
    timeout-minutes: 10
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
    - name: Setup Signing
      env: 
        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -20,7 +20,7 @@ jobs:
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta_5.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
    - name: Update Build Number
      env:
        RUN_ID: ${{ github.run_id }}
@@ -39,14 +39,11 @@ jobs:
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
-    - name: Document SHAs
-      run: |
-            echo "sha-512:"
-            shasum -a 512 Secretive.zip
-            shasum -a 512 Archive.zip
-            echo "sha-256:"
-            shasum -a 256 Secretive.zip
-            shasum -a 256 Archive.zip
+    - name: Attest
+      id: attest
+      uses: actions/attest-build-provenance@v2
+      with:
+        subject-path: 'Secretive.zip'
    - name: Upload App to Artifacts
      uses: actions/upload-artifact@v4
      with:
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,7 +10,7 @@ jobs:
    runs-on: macos-15
    timeout-minutes: 10
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
    - name: Setup Signing
      env: 
        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -21,18 +21,19 @@ jobs:
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta_5.app	
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
    - name: Test
-      run: |
-            pushd Sources/Packages
-            swift test
-            popd
+      run: swift build --build-system swiftbuild --package-path Sources/Packages
  build:
 #     runs-on: macOS-latest
    runs-on: macos-15
+    permissions:
+      id-token: write
+      contents: write
+      attestations: write
    timeout-minutes: 10
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
    - name: Setup Signing
      env: 
        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -43,7 +44,7 @@ jobs:
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta_5.app	
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
    - name: Update Build Number
      env:
        TAG_NAME: ${{ github.ref }}
@@ -58,54 +59,29 @@ jobs:
    - name: Create ZIPs
      run: |
            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
-            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Xcode_Archive.zip
    - name: Notarize
      env: 
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
-    - name: Document SHAs
-      run: |
-            echo "sha-512:"
-            shasum -a 512 Secretive.zip
-            shasum -a 512 Archive.zip
-            echo "sha-256:"
-            shasum -a 256 Secretive.zip
-            shasum -a 256 Archive.zip
+    - name: Attest
+      id: attest
+      uses: actions/attest-build-provenance@v2
+      with:
+        subject-path: 'Secretive.zip, Xcode_Archive.zip'
    - name: Create Release
-      id: create_release
-      uses: actions/create-release@v1
+      run: |
+            sed -i.tmp "s/RUN_ID/$RUN_ID/g" .github/templates/release.md
+            sed -i.tmp "s/ATTESTATION_ID/$ATTESTATION_ID/g" .github/templates/release.md
+            gh release create $TAG_NAME -d -F .github/templates/release.md
+            gh release upload Secretive.zip
+            gh release upload Xcode_Archive.zip
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        tag_name: ${{ github.ref }}
-        release_name: ${{ github.ref }}
-        body: |
-          Update description
-
-          ## Features
-
-
-          ## Fixes
-
-
-          ## Minimum macOS Version
-
-
-          ## Build
-          https://github.com/maxgoedjen/secretive/actions/runs/${{ github.run_id }}
-        draft: true
-        prerelease: false
-    - name: Upload App to Release
-      id: upload-release-asset-app
-      uses: actions/upload-release-asset@v1.0.1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ steps.create_release.outputs.upload_url }}
-        asset_path: ./Secretive.zip
-        asset_name: Secretive.zip
-        asset_content_type: application/zip
+        TAG_NAME: ${{ github.ref }}
+        RUN_ID: ${{ github.run_id }}
+        ATTESTATION_ID: ${{ steps.attest.outputs.attestation-id }}
    - name: Upload App to Artifacts
      uses: actions/upload-artifact@v4
      with:
@@ -115,4 +91,4 @@ jobs:
      uses: actions/upload-artifact@v4
      with:
        name: Xcode_Archive.zip
-        path: Archive.zip
+        path: Xcode_Archive.zip
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,11 +7,8 @@ jobs:
    runs-on: macos-15
    timeout-minutes: 10
    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_26_beta_5.app	
+      run: sudo xcrun xcode-select -s /Applications/Xcode_26.0.app
    - name: Test
-      run: |
-            pushd Sources/Packages
-            swift test
-            popd
+      run: swift build --build-system swiftbuild --package-path Sources/Packages
--- a/Package.swift
+++ b/Package.swift
@@ -0,0 +1 @@
+Sources/Packages/Package.swift
--- a/README.md
+++ b/README.md
@@ -49,7 +49,7 @@ There's a [FAQ here](FAQ.md).

 ### Auditable Build Process

-Builds are produced by GitHub Actions with an auditable build and release generation process. Each build has a "Document SHAs" step, which will output SHA checksums for the build produced by the GitHub Action, so you can verify that the source code for a given build corresponds to any given release.
+Builds are produced by GitHub Actions with an auditable build and release generation process. Starting with Secretive 3.0, builds are attested using [GitHub Artifact Attestation](https://docs.github.com/en/actions/concepts/security/artifact-attestations). Attestations are viewable in the build log for a build, and also on the [main attestation page](https://github.com/maxgoedjen/secretive/attestations).

 ### A Note Around Code Signing and Keychains

--- a/Sources/Secretive/Localizable.xcstrings
+++ b/Sources/Secretive/Localizable.xcstrings
--- a/Sources/Packages/Package.swift
+++ b/Sources/Packages/Package.swift
@@ -5,6 +5,7 @@ import PackageDescription

 let package = Package(
    name: "SecretivePackages",
+    defaultLocalization: "en",
    platforms: [
        .macOS(.v14)
    ],
@@ -34,6 +35,7 @@ let package = Package(
        .target(
            name: "SecretKit",
            dependencies: [],
+            resources: [localization],
            swiftSettings: swiftSettings
        ),
        .testTarget(
@@ -44,16 +46,19 @@ let package = Package(
        .target(
            name: "SecureEnclaveSecretKit",
            dependencies: ["SecretKit"],
+            resources: [localization],
            swiftSettings: swiftSettings
        ),
        .target(
            name: "SmartCardSecretKit",
            dependencies: ["SecretKit"],
+            resources: [localization],
            swiftSettings: swiftSettings
        ),
        .target(
            name: "SecretAgentKit",
            dependencies: ["SecretKit", "SecretAgentKitHeaders"],
+            resources: [localization],
            swiftSettings: swiftSettings
        ),
        .systemLibrary(
@@ -66,6 +71,7 @@ let package = Package(
        .target(
            name: "Brief",
            dependencies: [],
+            resources: [localization],
            swiftSettings: swiftSettings
        ),
        .testTarget(
@@ -75,6 +81,10 @@ let package = Package(
    ]
 )

+var localization: Resource {
+    .process("../../Localizable.xcstrings")
+}
+
 var swiftSettings: [PackageDescription.SwiftSetting] {
    [
        .swiftLanguageMode(.v6),
--- a/Sources/Packages/Sources/Localization/Stub.swift
+++ b/Sources/Packages/Sources/Localization/Stub.swift
@@ -0,0 +1 @@
+
--- a/Sources/Packages/Sources/SecretAgentKit/Sendability.swift
+++ b/Sources/Packages/Sources/SecretAgentKit/Sendability.swift
@@ -1,11 +0,0 @@
-import Foundation
-
-struct UncheckedSendable<T>: @unchecked Sendable {
-
-    let value: T
-
-    init(_ value: T) {
-        self.value = value
-    }
-
-}
--- a/Sources/Packages/Sources/SecretAgentKit/SocketController.swift
+++ b/Sources/Packages/Sources/SecretAgentKit/SocketController.swift
@@ -82,12 +82,12 @@ public final class SocketController {
        logger.debug("Socket controller has new data available")
        guard let new = notification.object as? FileHandle else { return }
        logger.debug("Socket controller received new file handle")
-        Task { [handler, logger = UncheckedSendable(logger)] in
+        Task { [handler, logger = logger] in
            if((await handler?(new, new)) == true) {
-                logger.value.debug("Socket controller handled data, wait for more data")
+                logger.debug("Socket controller handled data, wait for more data")
                await new.waitForDataInBackgroundAndNotifyOnMainActor()
            } else {
-                logger.value.debug("Socket controller called with empty data, socked closed")
+                logger.debug("Socket controller called with empty data, socked closed")
            }
        }
    }
--- a/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift
+++ b/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift
@@ -10,7 +10,6 @@ public class AnySecretStore: SecretStore, @unchecked Sendable {
    private let _name: @MainActor @Sendable () -> String
    private let _secrets: @MainActor @Sendable () -> [AnySecret]
    private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance) async throws -> Data
-    private let _verify: @Sendable (Data, Data, AnySecret) async throws -> Bool
    private let _existingPersistedAuthenticationContext: @Sendable (AnySecret) async -> PersistedAuthenticationContext?
    private let _persistAuthentication: @Sendable (AnySecret, TimeInterval) async throws -> Void
    private let _reloadSecrets: @Sendable () async -> Void
@@ -22,7 +21,6 @@ public class AnySecretStore: SecretStore, @unchecked Sendable {
        _id = { secretStore.id }
        _secrets = { secretStore.secrets.map { AnySecret($0) } }
        _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
-        _verify = { try await secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) }
        _existingPersistedAuthenticationContext = { await secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
        _persistAuthentication = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
        _reloadSecrets = { await secretStore.reloadSecrets() }
@@ -48,10 +46,6 @@ public class AnySecretStore: SecretStore, @unchecked Sendable {
        try await _sign(data, secret, provenance)
    }

-    public func verify(signature: Data, for data: Data, with secret: AnySecret) async throws -> Bool {
-        try await _verify(signature, data, secret)
-    }
-
    public func existingPersistedAuthenticationContext(secret: AnySecret) async -> PersistedAuthenticationContext? {
        await _existingPersistedAuthenticationContext(secret)
    }
--- a/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift
+++ b/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift
@@ -23,14 +23,6 @@ public protocol SecretStore: Identifiable, Sendable {
    /// - Returns: The signed data.
    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) async throws -> Data

-    /// Verifies that a signature is valid over a specified payload.
-    /// - Parameters:
-    ///   - signature: The signature over the data.
-    ///   - data: The data to verify the signature of.
-    ///   - secret: The secret whose signature to verify.
-    /// - Returns: Whether the signature was verified.
-    func verify(signature: Data, for data: Data, with secret: SecretType) async throws -> Bool
-
    /// Checks to see if there is currently a valid persisted authentication for a given secret.
    /// - Parameters:
    ///   - secret: The ``Secret`` to check if there is a persisted authentication for.
--- a/Sources/Packages/Sources/SecureEnclaveSecretKit/PersistentAuthenticationHandler.swift
+++ b/Sources/Packages/Sources/SecureEnclaveSecretKit/PersistentAuthenticationHandler.swift
@@ -50,16 +50,16 @@ extension SecureEnclave {
        func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) async throws {
            let newContext = LAContext()
            newContext.touchIDAuthenticationAllowableReuseDuration = duration
-            newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+            newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)

            let formatter = DateComponentsFormatter()
            formatter.unitsStyle = .spellOut
            formatter.allowedUnits = [.hour, .minute, .day]

            if let durationString = formatter.string(from: duration) {
-                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_\(secret.name)_\(durationString)")
+                newContext.localizedReason = String(localized: .authContextPersistForDuration(secretName: secret.name, duration: durationString))
            } else {
-                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_unknown_\(secret.name)")
+                newContext.localizedReason = String(localized: .authContextPersistForDurationUnknown(secretName: secret.name))
            }
            let success = try await newContext.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: newContext.localizedReason)
            guard success else { return }
--- a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift
+++ b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift
@@ -15,7 +15,7 @@ extension SecureEnclave {
            CryptoKit.SecureEnclave.isAvailable
        }
        public let id = UUID()
-        public let name = String(localized: "secure_enclave")
+        public let name = String(localized: .secureEnclave)
        private let persistentAuthenticationHandler = PersistentAuthenticationHandler()

        /// Initializes a Store.
@@ -105,10 +105,10 @@ extension SecureEnclave {
                context = existing.context
            } else {
                let newContext = LAContext()
-                newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+                newContext.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
                context = newContext
            }
-            context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
+            context.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
            let attributes = KeychainDictionary([
                kSecClass: kSecClassKey,
                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
@@ -136,41 +136,6 @@ extension SecureEnclave {
            return signature as Data
        }

-        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
-            let context = LAContext()
-            context.localizedReason = String(localized: "auth_context_request_verify_description_\(secret.name)")
-            context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
-            let attributes = KeychainDictionary([
-                kSecClass: kSecClassKey,
-                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                kSecAttrApplicationLabel: secret.id as CFData,
-                kSecAttrKeyType: Constants.keyType,
-                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
-                kSecAttrApplicationTag: Constants.keyTag,
-                kSecUseAuthenticationContext: context,
-                kSecReturnRef: true
-                ])
-            var verifyError: SecurityError?
-            var untyped: CFTypeRef?
-            let status = SecItemCopyMatching(attributes, &untyped)
-            if status != errSecSuccess {
-                throw KeychainError(statusCode: status)
-            }
-            guard let untypedSafe = untyped else {
-                throw KeychainError(statusCode: errSecSuccess)
-            }
-            let key = untypedSafe as! SecKey
-            let verified = SecKeyVerifySignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, signature as CFData, &verifyError)
-            if !verified, let verifyError {
-                if verifyError.takeUnretainedValue() ~= .verifyError {
-                    return false
-                } else {
-                    throw SigningError(error: verifyError)
-                }
-            }
-            return verified
-        }
-
        public func existingPersistedAuthenticationContext(secret: Secret) async -> PersistedAuthenticationContext? {
            await persistentAuthenticationHandler.existingPersistedAuthenticationContext(secret: secret)
        }
@@ -240,7 +205,7 @@ extension SecureEnclave.Store {
                                            nil)!

        let wrapped: [SecureEnclave.Secret] = publicTyped.map {
-            let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
+            let name = $0[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
            let id = $0[kSecAttrApplicationLabel] as! Data
            let publicKeyRef = $0[kSecValueRef] as! SecKey
            let publicKeyAttributes = SecKeyCopyAttributes(publicKeyRef) as! [CFString: Any]
--- a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift
+++ b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift
@@ -9,7 +9,7 @@ extension SmartCard {
    
    @MainActor @Observable fileprivate final class State {
        var isAvailable = false
-        var name = String(localized: "smart_card")
+        var name = String(localized: .smartCard)
        var secrets: [Secret] = []
        let watcher = TKTokenWatcher()
        var tokenID: String? = nil
@@ -63,8 +63,8 @@ extension SmartCard {
        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) async throws -> Data {
            guard let tokenID = await state.tokenID else { fatalError() }
            let context = LAContext()
-            context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
-            context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+            context.localizedReason = String(localized: .authContextRequestSignatureDescription(appName: provenance.origin.displayName, secretName: secret.name))
+            context.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
            let attributes = KeychainDictionary([
                kSecClass: kSecClassKey,
                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
@@ -89,29 +89,6 @@ extension SmartCard {
            return signature as Data
        }
        
-        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
-            let attributes = KeychainDictionary([
-                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
-                kSecAttrKeySizeInBits: secret.keySize,
-                kSecAttrKeyClass: kSecAttrKeyClassPublic
-            ])
-            var verifyError: SecurityError?
-            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
-            guard let untypedSafe = untyped else {
-                throw KeychainError(statusCode: errSecSuccess)
-            }
-            let key = untypedSafe as! SecKey
-            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, signature as CFData, &verifyError)
-            if !verified, let verifyError {
-                if verifyError.takeUnretainedValue() ~= .verifyError {
-                    return false
-                } else {
-                    throw SigningError(error: verifyError)
-                }
-            }
-            return verified
-        }
-
        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
            nil
        }
@@ -162,7 +139,7 @@ extension SmartCard.Store {
    @MainActor private func loadSecrets() {
        guard let tokenID = state.tokenID  else { return }

-        let fallbackName = String(localized: "smart_card")
+        let fallbackName = String(localized: .smartCard)
        if let driverName = state.watcher.tokenInfo(forTokenID: tokenID)?.driverName  {
            state.name = driverName
        } else {
@@ -180,7 +157,7 @@ extension SmartCard.Store {
        SecItemCopyMatching(attributes, &untyped)
        guard let typed = untyped as? [[CFString: Any]] else { return }
        let wrapped = typed.map {
-            let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
+            let name = $0[kSecAttrLabel] as? String ?? String(localized: .unnamedSecret)
            let tokenID = $0[kSecAttrApplicationLabel] as! Data
            let algorithm = Algorithm(secAttr: $0[kSecAttrKeyType] as! NSNumber)
            let keySize = $0[kSecAttrKeySizeInBits] as! Int
@@ -195,6 +172,88 @@ extension SmartCard.Store {

 }

+
+// MARK: Smart Card specific encryption/decryption/verification
+extension SmartCard.Store {
+
+    /// Encrypts a payload with a specified key.
+    /// - Parameters:
+    ///   - data: The payload to encrypt.
+    ///   - secret: The secret to encrypt with.
+    /// - Returns: The encrypted data.
+    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
+    public func encrypt(data: Data, with secret: SecretType) throws -> Data {
+        let context = LAContext()
+        context.localizedReason = String(localized: .authContextRequestEncryptDescription(secretName: secret.name))
+        context.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
+        let attributes = KeychainDictionary([
+            kSecAttrKeyType: secret.algorithm.secAttrKeyType,
+            kSecAttrKeySizeInBits: secret.keySize,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecUseAuthenticationContext: context
+        ])
+        var encryptError: SecurityError?
+        let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &encryptError)
+        guard let untypedSafe = untyped else {
+            throw KeychainError(statusCode: errSecSuccess)
+        }
+        let key = untypedSafe as! SecKey
+        guard let signature = SecKeyCreateEncryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
+            throw SigningError(error: encryptError)
+        }
+        return signature as Data
+    }
+
+    /// Decrypts a payload with a specified key.
+    /// - Parameters:
+    ///   - data: The payload to decrypt.
+    ///   - secret: The secret to decrypt with.
+    /// - Returns: The decrypted data.
+    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
+    public func decrypt(data: Data, with secret: SecretType) async throws -> Data {
+        guard let tokenID = await state.tokenID else { fatalError() }
+        let context = LAContext()
+        context.localizedReason = String(localized: .authContextRequestDecryptDescription(secretName: secret.name))
+        context.localizedCancelTitle = String(localized: .authContextRequestDenyButton)
+        let attributes = KeychainDictionary([
+            kSecClass: kSecClassKey,
+            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+            kSecAttrApplicationLabel: secret.id as CFData,
+            kSecAttrTokenID: tokenID,
+            kSecUseAuthenticationContext: context,
+            kSecReturnRef: true
+        ])
+        var untyped: CFTypeRef?
+        let status = SecItemCopyMatching(attributes, &untyped)
+        if status != errSecSuccess {
+            throw KeychainError(statusCode: status)
+        }
+        guard let untypedSafe = untyped else {
+            throw KeychainError(statusCode: errSecSuccess)
+        }
+        let key = untypedSafe as! SecKey
+        var encryptError: SecurityError?
+        guard let signature = SecKeyCreateDecryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
+            throw SigningError(error: encryptError)
+        }
+        return signature as Data
+    }
+
+    private func encryptionAlgorithm(for secret: SecretType) -> SecKeyAlgorithm {
+        switch (secret.algorithm, secret.keySize) {
+        case (.ellipticCurve, 256):
+            return .eciesEncryptionCofactorVariableIVX963SHA256AESGCM
+        case (.ellipticCurve, 384):
+            return .eciesEncryptionCofactorVariableIVX963SHA384AESGCM
+        case (.rsa, 1024), (.rsa, 2048):
+            return .rsaEncryptionOAEPSHA512AESGCM
+        default:
+            fatalError()
+        }
+    }
+
+}
+
 extension TKTokenWatcher {

    /// All available tokens, excluding the Secure Enclave.
--- a/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift
+++ b/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift
@@ -60,18 +60,10 @@ import CryptoKit
        }
        var rs = r
        rs.append(s)
-        let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs)
-        let referenceValid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
-        let store = await list.stores.first!
-        let derVerifies = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidRandomSignature = try await store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidRandomData = try await store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidWrongKey = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret))
-        #expect(referenceValid)
-        #expect(derVerifies)
-        #expect(invalidRandomSignature == false)
-        #expect(invalidRandomData == false)
-        #expect(invalidWrongKey == false)
+        let signature = try P256.Signing.ECDSASignature(rawRepresentation: rs)
+        // Correct signature
+        #expect(try P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey)
+            .isValidSignature(signature, for: dataToSign))
    }

    // MARK: Witness protocol
--- a/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift
+++ b/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift
@@ -61,29 +61,6 @@ extension Stub {
            return SecKeyCreateSignature(privateKey, signatureAlgorithm(for: secret), data as CFData, nil)! as Data
        }

-        public func verify(signature: Data, for data: Data, with secret: Stub.Secret) throws -> Bool {
-            let attributes = KeychainDictionary([
-                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
-                kSecAttrKeySizeInBits: secret.keySize,
-                kSecAttrKeyClass: kSecAttrKeyClassPublic
-            ])
-            var verifyError: Unmanaged<CFError>?
-            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
-            guard let untypedSafe = untyped else {
-                throw NSError(domain: "test", code: 0, userInfo: nil)
-            }
-            let key = untypedSafe as! SecKey
-            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret), data as CFData, signature as CFData, &verifyError)
-            if let verifyError {
-                if verifyError.takeUnretainedValue() ~= .verifyError {
-                    return false
-                } else {
-                    throw NSError(domain: "test", code: 0, userInfo: nil)
-                }
-            }
-            return verified
-        }
-
        public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {
            nil
        }
--- a/Sources/SecretAgent/Notifier.swift
+++ b/Sources/SecretAgent/Notifier.swift
@@ -10,8 +10,8 @@ final class Notifier: Sendable {
    private let notificationDelegate = NotificationDelegate()

    init() {
-        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: String(localized: "update_notification_update_button"), options: [])
-        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: String(localized: "update_notification_ignore_button"), options: [])
+        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: String(localized: .updateNotificationUpdateButton), options: [])
+        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: String(localized: .updateNotificationIgnoreButton), options: [])
        let updateCategory = UNNotificationCategory(identifier: Constants.updateCategoryIdentitifier, actions: [updateAction, ignoreAction], intentIdentifiers: [], options: [])
        let criticalUpdateCategory = UNNotificationCategory(identifier: Constants.criticalUpdateCategoryIdentitifier, actions: [updateAction], intentIdentifiers: [], options: [])

@@ -22,7 +22,7 @@ final class Notifier: Sendable {
            Measurement(value: 24, unit: UnitDuration.hours)
        ]

-        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: String(localized: "persist_authentication_decline_button"), options: [])
+        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: String(localized: .persistAuthenticationDeclineButton), options: [])
        var allPersistenceActions = [doNotPersistAction]

        let formatter = DateComponentsFormatter()
@@ -41,7 +41,7 @@ final class Notifier: Sendable {

        let persistAuthenticationCategory = UNNotificationCategory(identifier: Constants.persistAuthenticationCategoryIdentitifier, actions: allPersistenceActions, intentIdentifiers: [], options: [])
        if persistAuthenticationCategory.responds(to: Selector(("actionsMenuTitle"))) {
-            persistAuthenticationCategory.setValue(String(localized: "persist_authentication_accept_button"), forKey: "_actionsMenuTitle")
+            persistAuthenticationCategory.setValue(String(localized: .persistAuthenticationAcceptButton), forKey: "_actionsMenuTitle")
        }
        UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory])
        UNUserNotificationCenter.current().delegate = notificationDelegate
@@ -64,8 +64,8 @@ final class Notifier: Sendable {
        await notificationDelegate.state.setPending(secret: secret, store: store)
        let notificationCenter = UNUserNotificationCenter.current()
        let notificationContent = UNMutableNotificationContent()
-        notificationContent.title = String(localized: "signed_notification_title_\(provenance.origin.displayName)")
-        notificationContent.subtitle = String(localized: "signed_notification_description_\(secret.name)")
+        notificationContent.title = String(localized: .signedNotificationTitle(appName: provenance.origin.displayName))
+        notificationContent.subtitle = String(localized: .signedNotificationDescription(secretName: secret.name))
        notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
        notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
        notificationContent.interruptionLevel = .timeSensitive
@@ -85,11 +85,11 @@ final class Notifier: Sendable {
        let notificationContent = UNMutableNotificationContent()
        if update.critical {
            notificationContent.interruptionLevel = .critical
-            notificationContent.title = String(localized: "update_notification_update_critical_title_\(update.name)")
+            notificationContent.title = String(localized: .updateNotificationUpdateCriticalTitle(updateName: update.name))
        } else {
-            notificationContent.title = String(localized: "update_notification_update_normal_title_\(update.name)")
+            notificationContent.title = String(localized: .updateNotificationUpdateNormalTitle(updateName: update.name))
        }
-        notificationContent.subtitle = String(localized: "update_notification_update_description")
+        notificationContent.subtitle = String(localized: .updateNotificationUpdateDescription)
        notificationContent.body = update.body
        notificationContent.categoryIdentifier = update.critical ? Constants.criticalUpdateCategoryIdentitifier : Constants.updateCategoryIdentitifier
        let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
--- a/Sources/Secretive.xcodeproj/project.pbxproj
+++ b/Sources/Secretive.xcodeproj/project.pbxproj
@@ -18,8 +18,9 @@
 		5003EF612780081600DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF602780081600DF2006 /* SmartCardSecretKit */; };
 		5003EF632780081B00DF2006 /* SecureEnclaveSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF622780081B00DF2006 /* SecureEnclaveSecretKit */; };
 		5003EF652780081B00DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF642780081B00DF2006 /* SmartCardSecretKit */; };
+		5008C23E2E525D8900507AC2 /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 5008C23D2E525D8200507AC2 /* Localizable.xcstrings */; };
 		5008C2402E52792400507AC2 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8623FCE48E0099B055 /* Assets.xcassets */; };
-		500B93C32B478D8400E157DE /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 500B93C22B478D8400E157DE /* Localizable.xcstrings */; };
+		5008C2412E52D18700507AC2 /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 5008C23D2E525D8200507AC2 /* Localizable.xcstrings */; };
 		501421622781262300BBAA70 /* Brief in Frameworks */ = {isa = PBXBuildFile; productRef = 501421612781262300BBAA70 /* Brief */; };
 		501421652781268000BBAA70 /* SecretAgent.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = 50A3B78A24026B7500D209EA /* SecretAgent.app */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		50153E20250AFCB200525160 /* UpdateView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50153E1F250AFCB200525160 /* UpdateView.swift */; };
@@ -51,7 +52,6 @@
 		50B8550D24138C4F009958AC /* DeleteSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50B8550C24138C4F009958AC /* DeleteSecretView.swift */; };
 		50BB046B2418AAAE00D6E079 /* EmptyStoreView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */; };
 		50C385A52407A76D00AF2719 /* SecretDetailView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50C385A42407A76D00AF2719 /* SecretDetailView.swift */; };
-		50E9CF422B51D596004AB36D /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 500B93C22B478D8400E157DE /* Localizable.xcstrings */; };
 /* End PBXBuildFile section */

 /* Begin PBXContainerItemProxy section */
@@ -102,7 +102,7 @@
 		50020BAF24064869003D4025 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
 		50033AC227813F1700253856 /* BundleIDs.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BundleIDs.swift; sourceTree = "<group>"; };
 		5003EF39278005C800DF2006 /* Packages */ = {isa = PBXFileReference; lastKnownFileType = wrapper; path = Packages; sourceTree = "<group>"; };
-		500B93C22B478D8400E157DE /* Localizable.xcstrings */ = {isa = PBXFileReference; lastKnownFileType = text.json.xcstrings; path = Localizable.xcstrings; sourceTree = "<group>"; };
+		5008C23D2E525D8200507AC2 /* Localizable.xcstrings */ = {isa = PBXFileReference; lastKnownFileType = text.json.xcstrings; name = Localizable.xcstrings; path = Packages/Localizable.xcstrings; sourceTree = SOURCE_ROOT; };
 		50153E1F250AFCB200525160 /* UpdateView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = UpdateView.swift; sourceTree = "<group>"; };
 		50153E21250DECA300525160 /* SecretListItemView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretListItemView.swift; sourceTree = "<group>"; };
 		5018F54E24064786002EB505 /* Notifier.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Notifier.swift; sourceTree = "<group>"; };
@@ -210,7 +210,7 @@
 				508BF28D25B4F005009EFB7E /* InternetAccessPolicy.plist */,
 				50617D8F23FCE48E0099B055 /* Secretive.entitlements */,
 				506772C62424784600034DED /* Credits.rtf */,
-				500B93C22B478D8400E157DE /* Localizable.xcstrings */,
+				5008C23D2E525D8200507AC2 /* Localizable.xcstrings */,
 				50617D8823FCE48E0099B055 /* Preview Content */,
 			);
 			path = Secretive;
@@ -404,7 +404,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */,
-				500B93C32B478D8400E157DE /* Localizable.xcstrings in Resources */,
+				5008C23E2E525D8900507AC2 /* Localizable.xcstrings in Resources */,
 				50617D8723FCE48E0099B055 /* Assets.xcassets in Resources */,
 				506772C72424784600034DED /* Credits.rtf in Resources */,
 				508BF28E25B4F005009EFB7E /* InternetAccessPolicy.plist in Resources */,
@@ -416,7 +416,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				50A3B79724026B7600D209EA /* Main.storyboard in Resources */,
-				50E9CF422B51D596004AB36D /* Localizable.xcstrings in Resources */,
+				5008C2412E52D18700507AC2 /* Localizable.xcstrings in Resources */,
 				50A3B79424026B7600D209EA /* Preview Assets.xcassets in Resources */,
 				508BF2AA25B4F1CB009EFB7E /* InternetAccessPolicy.plist in Resources */,
 				5008C2402E52792400507AC2 /* Assets.xcassets in Resources */,
@@ -526,6 +526,8 @@
 				COPY_PHASE_STRIP = NO;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
+				ENABLE_ENHANCED_SECURITY = YES;
+				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -598,7 +600,9 @@
 				COPY_PHASE_STRIP = NO;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
+				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_NS_ASSERTIONS = NO;
+				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
 				GCC_C_LANGUAGE_STANDARD = gnu11;
@@ -637,8 +641,10 @@
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_APP_SANDBOX = YES;
+				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
 				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_PREVIEWS = YES;
 				ENABLE_USER_SELECTED_FILES = readwrite;
 				INFOPLIST_FILE = Secretive/Info.plist;
@@ -667,8 +673,10 @@
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
 				DEVELOPMENT_TEAM = Z72PRUAWF6;
 				ENABLE_APP_SANDBOX = YES;
+				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_HARDENED_RUNTIME = YES;
 				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_PREVIEWS = YES;
 				ENABLE_USER_SELECTED_FILES = readwrite;
 				INFOPLIST_FILE = Secretive/Info.plist;
@@ -723,6 +731,8 @@
 				COPY_PHASE_STRIP = NO;
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
+				ENABLE_ENHANCED_SECURITY = YES;
+				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -760,14 +770,17 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
+				CODE_SIGN_ENTITLEMENTS = Secretive/Secretive.entitlements;
 				CODE_SIGN_STYLE = Manual;
 				COMBINE_HIDPI_IMAGES = YES;
 				CURRENT_PROJECT_VERSION = 1;
 				DEAD_CODE_STRIPPING = YES;
 				DEVELOPMENT_ASSET_PATHS = "\"Secretive/Preview Content\"";
 				ENABLE_APP_SANDBOX = YES;
+				ENABLE_ENHANCED_SECURITY = YES;
 				ENABLE_HARDENED_RUNTIME = NO;
 				ENABLE_OUTGOING_NETWORK_CONNECTIONS = YES;
+				ENABLE_POINTER_AUTHENTICATION = YES;
 				ENABLE_PREVIEWS = YES;
 				ENABLE_USER_SELECTED_FILES = readwrite;
 				INFOPLIST_FILE = Secretive/Info.plist;
--- a/Sources/Secretive.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings
+++ b/Sources/Secretive.xcodeproj/project.xcworkspace/xcshareddata/WorkspaceSettings.xcsettings
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>iOSPackagesShouldBuildARM64e</key>
+	<true/>
+</dict>
+</plist>
--- a/Sources/Secretive/App.swift
+++ b/Sources/Secretive/App.swift
@@ -59,18 +59,18 @@ struct Secretive: App {
        }
        .commands {
            CommandGroup(after: CommandGroupPlacement.newItem) {
-                Button("app_menu_new_secret_button") {
+                Button(.appMenuNewSecretButton) {
                    showingCreation = true
                }
                .keyboardShortcut(KeyboardShortcut(KeyEquivalent("N"), modifiers: [.command, .shift]))
            }
            CommandGroup(replacing: .help) {
-                Button("app_menu_help_button") {
+                Button(.appMenuHelpButton) {
                    NSWorkspace.shared.open(Constants.helpURL)
                }
            }
            CommandGroup(after: .help) {
-                Button("app_menu_setup_button") {
+                Button(.appMenuSetupButton) {
                    showingSetup = true
                }
            }
--- a/Content/PreviewStore.swift
+++ b/Content/PreviewStore.swift
@@ -40,10 +40,6 @@ extension Preview {
            return data
        }

-        func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool {
-            true
-        }
-
        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
            nil
        }
@@ -76,10 +72,6 @@ extension Preview {
            return data
        }

-        func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool {
-            true
-        }
-
        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
            nil
        }
--- a/Sources/Secretive/Secretive.entitlements
+++ b/Sources/Secretive/Secretive.entitlements
@@ -2,6 +2,16 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>com.apple.security.hardened-process</key>
+	<true/>
+	<key>com.apple.security.hardened-process.dyld-ro</key>
+	<true/>
+	<key>com.apple.security.hardened-process.enhanced-security-version</key>
+	<integer>1</integer>
+	<key>com.apple.security.hardened-process.hardened-heap</key>
+	<true/>
+	<key>com.apple.security.hardened-process.platform-restrictions</key>
+	<integer>2</integer>
 	<key>com.apple.security.smartcard</key>
 	<true/>
 	<key>keychain-access-groups</key>
--- a/Sources/Secretive/Views/ContentView.swift
+++ b/Sources/Secretive/Views/ContentView.swift
@@ -70,15 +70,15 @@ extension ContentView {
        }
    }

-    var updateNoticeContent: (LocalizedStringKey, Color)? {
+    var updateNoticeContent: (LocalizedStringResource, Color)? {
        guard let update = updater.update else { return nil }
        if update.critical {
-            return ("update_critical_notice_title", .red)
+            return (.updateCriticalNoticeTitle, .red)
        } else {
            if updater.testBuild {
-                return ("update_test_notice_title", .blue)
+                return (.updateTestNoticeTitle, .blue)
            } else {
-                return ("update_normal_notice_title", .orange)
+                return (.updateNormalNoticeTitle, .orange)
            }
        }
    }
@@ -127,13 +127,13 @@ extension ContentView {
        }, label: {
            Group {
                if hasRunSetup && !agentStatusChecker.running {
-                    Text("agent_not_running_notice_title")
+                    Text(.agentNotRunningNoticeTitle)
                } else {
-                    Text("agent_setup_notice_title")
+                    Text(.agentSetupNoticeTitle)
                }
            }
            .font(.headline)
-            .foregroundColor(.white)
+
        })
        .buttonStyle(ToolbarButtonStyle(color: .orange))
    }
@@ -144,7 +144,7 @@ extension ContentView {
            showingAgentInfo = true
        }, label: {
            HStack {
-                Text("agent_running_notice_title")
+                Text(.agentRunningNoticeTitle)
                    .font(.headline)
                    .foregroundColor(colorScheme == .light ? Color(white: 0.3) : .white)
                Circle()
@@ -155,10 +155,10 @@ extension ContentView {
        .buttonStyle(ToolbarButtonStyle(lightColor: .black.opacity(0.05), darkColor: .white.opacity(0.05)))
        .popover(isPresented: $showingAgentInfo, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) {
            VStack {
-                Text("agent_running_notice_detail_title")
+                Text(.agentRunningNoticeDetailTitle)
                    .font(.title)
                    .padding(5)
-                Text("agent_running_notice_detail_description")
+                Text(.agentRunningNoticeDetailDescription)
                    .frame(width: 300)
            }
            .padding()
@@ -172,7 +172,7 @@ extension ContentView {
                showingAppPathNotice = true
            }, label: {
                Group {
-                    Text("app_not_in_applications_notice_title")
+                    Text(.appNotInApplicationsNoticeTitle)
                }
                .font(.headline)
                .foregroundColor(.white)
@@ -184,7 +184,7 @@ extension ContentView {
                        .resizable()
                        .aspectRatio(contentMode: .fit)
                        .frame(width: 64)
-                    Text("app_not_in_applications_notice_detail_description")
+                    Text(.appNotInApplicationsNoticeDetailDescription)
                        .frame(maxWidth: 300)
                }
                .padding()
--- a/Sources/Secretive/Views/CopyableView.swift
+++ b/Sources/Secretive/Views/CopyableView.swift
@@ -3,7 +3,7 @@ import UniformTypeIdentifiers

 struct CopyableView: View {

-    var title: LocalizedStringKey
+    var title: LocalizedStringResource
    var image: Image
    var text: String

@@ -125,6 +125,7 @@ extension View {
 fileprivate struct BackgroundViewModifier: ViewModifier {
    
    @Environment(\.colorScheme) private var colorScheme
+    @Environment(\.appearsActive) private var appearsActive

    let interactionState: InteractionState

@@ -148,6 +149,7 @@ fileprivate struct BackgroundViewModifier: ViewModifier {
    }
    
    func backgroundColor(interactionState: InteractionState) -> Color {
+        guard appearsActive else { return Color.clear }
        switch interactionState {
        case .normal:
            return colorScheme == .dark ? Color(white: 0.2) : Color(white: 0.885)
--- a/Sources/Secretive/Views/CreateSecretView.swift
+++ b/Sources/Secretive/Views/CreateSecretView.swift
@@ -14,30 +14,30 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
            HStack {
                VStack {
                    HStack {
-                        Text("create_secret_title")
+                        Text(.createSecretTitle)
                            .font(.largeTitle)
                        Spacer()
                    }
                    HStack {
-                        Text("create_secret_name_label")
-                        TextField("create_secret_name_placeholder", text: $name)
+                        Text(.createSecretNameLabel)
+                        TextField(String(localized: .createSecretNamePlaceholder), text: $name)
                            .focusable()
                    }
                    ThumbnailPickerView(items: [
-                        ThumbnailPickerView.Item(value: true, name: "create_secret_require_authentication_title", description: "create_secret_require_authentication_description", thumbnail: AuthenticationView()),
-                        ThumbnailPickerView.Item(value: false, name: "create_secret_notify_title",
-                                                 description: "create_secret_notify_description",
+                        ThumbnailPickerView.Item(value: true, name: .createSecretRequireAuthenticationTitle, description: .createSecretRequireAuthenticationDescription, thumbnail: AuthenticationView()),
+                        ThumbnailPickerView.Item(value: false, name: .createSecretNotifyTitle,
+                                                 description: .createSecretNotifyDescription,
                                                 thumbnail: NotificationView())
                    ], selection: $requiresAuthentication)
                }
            }
            HStack {
                Spacer()
-                Button("create_secret_cancel_button") {
+                Button(.createSecretCancelButton) {
                    showing = false
                }
                .keyboardShortcut(.cancelAction)
-                Button("create_secret_create_button", action: save)
+                Button(.createSecretCreateButton, action: save)
                    .disabled(name.isEmpty)
                    .keyboardShortcut(.defaultAction)
            }
@@ -98,11 +98,11 @@ extension ThumbnailPickerView {
    struct Item<InnerValueType: Hashable>: Identifiable {
        let id = UUID()
        let value: InnerValueType
-        let name: LocalizedStringKey
-        let description: LocalizedStringKey
+        let name: LocalizedStringResource
+        let description: LocalizedStringResource
        let thumbnail: AnyView

-        init<ViewType: View>(value: InnerValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) {
+        init<ViewType: View>(value: InnerValueType, name: LocalizedStringResource, description: LocalizedStringResource, thumbnail: ViewType) {
            self.value = value
            self.name = name
            self.description = description
--- a/Sources/Secretive/Views/DeleteSecretView.swift
+++ b/Sources/Secretive/Views/DeleteSecretView.swift
@@ -18,24 +18,24 @@ struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
                    .padding()
                VStack {
                    HStack {
-                        Text("delete_confirmation_title_\(secret.name)").bold()
+                        Text(.deleteConfirmationTitle(secretName: secret.name)).bold()
                        Spacer()
                    }
                    HStack {
-                        Text("delete_confirmation_description_\(secret.name)_\(secret.name)")
+                        Text(.deleteConfirmationDescription(secretName: secret.name, confirmSecretName: secret.name))
                        Spacer()
                    }
                    HStack {
-                        Text("delete_confirmation_confirm_name_label")
+                        Text(.deleteConfirmationConfirmNameLabel)
                        TextField(secret.name, text: $confirm)
                    }
                }
            }
            HStack {
                Spacer()
-                Button("delete_confirmation_delete_button", action: delete)
+                Button(.deleteConfirmationDeleteButton, action: delete)
                    .disabled(confirm != secret.name)
-                Button("delete_confirmation_cancel_button") {
+                Button(.deleteConfirmationCancelButton) {
                    dismissalBlock(false)
                }
                .keyboardShortcut(.cancelAction)
--- a/Sources/Secretive/Views/EmptyStoreView.swift
+++ b/Sources/Secretive/Views/EmptyStoreView.swift
@@ -18,9 +18,9 @@ struct EmptyStoreImmutableView: View {
    
    var body: some View {
        VStack {
-            Text("empty_store_nonmodifiable_title").bold()
-            Text("empty_store_nonmodifiable_description")
-            Text("empty_store_nonmodifiable_supported_key_types")
+            Text(.emptyStoreNonmodifiableTitle).bold()
+            Text(.emptyStoreNonmodifiableDescription)
+            Text(.emptyStoreNonmodifiableSupportedKeyTypes)
        }.frame(maxWidth: .infinity, maxHeight: .infinity)
    }
    
@@ -49,8 +49,8 @@ struct EmptyStoreModifiableView: View {
                        path.addLine(to: CGPoint(x: g.size.width - 3, y: 0))
                    }.fill()
                }.frame(height: (windowGeometry.size.height/2) - 20).padding()
-                Text("empty_store_modifiable_click_here_title").bold()
-                Text("empty_store_modifiable_click_here_description")
+                Text(.emptyStoreModifiableClickHereTitle).bold()
+                Text(.emptyStoreModifiableClickHereDescription)
                Spacer()
            }.frame(maxWidth: .infinity, maxHeight: .infinity)
        }
--- a/Sources/Secretive/Views/NoStoresView.swift
+++ b/Sources/Secretive/Views/NoStoresView.swift
@@ -4,10 +4,10 @@ struct NoStoresView: View {

    var body: some View {
        VStack {
-            Text("no_secure_storage_title")
+            Text(.noSecureStorageTitle)
                .bold()
-            Text("no_secure_storage_description")
-            Link("no_secure_storage_yubico_link", destination: URL(string: "https://www.yubico.com/products/compare-yubikey-5-series/")!)
+            Text(.noSecureStorageDescription)
+            Link(.noSecureStorageYubicoLink, destination: URL(string: "https://www.yubico.com/products/compare-yubikey-5-series/")!)
        }.padding()
    }
    
--- a/Sources/Secretive/Views/RenameSecretView.swift
+++ b/Sources/Secretive/Views/RenameSecretView.swift
@@ -18,7 +18,7 @@ struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
                    .padding()
                VStack {
                    HStack {
-                        Text("rename_title_\(secret.name)")
+                        Text(.renameTitle(secretName: secret.name))
                        Spacer()
                    }
                    HStack {
@@ -28,10 +28,10 @@ struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
            }
            HStack {
                Spacer()
-                Button("rename_rename_button", action: rename)
+                Button(.renameRenameButton, action: rename)
                    .disabled(newName.count == 0)
                    .keyboardShortcut(.return)
-                Button("rename_cancel_button") {
+                Button(.renameCancelButton) {
                    dismissalBlock(false)
                }.keyboardShortcut(.cancelAction)
            }
--- a/Sources/Secretive/Views/SecretDetailView.swift
+++ b/Sources/Secretive/Views/SecretDetailView.swift
@@ -12,16 +12,16 @@ struct SecretDetailView<SecretType: Secret>: View {
        ScrollView {
            Form {
                Section {
-                    CopyableView(title: "secret_detail_sha256_fingerprint_label", image: Image(systemName: "touchid"), text: keyWriter.openSSHSHA256Fingerprint(secret: secret))
+                    CopyableView(title: .secretDetailSha256FingerprintLabel, image: Image(systemName: "touchid"), text: keyWriter.openSSHSHA256Fingerprint(secret: secret))
                    Spacer()
                        .frame(height: 20)
-                    CopyableView(title: "secret_detail_md5_fingerprint_label", image: Image(systemName: "touchid"), text: keyWriter.openSSHMD5Fingerprint(secret: secret))
+                    CopyableView(title: .secretDetailMd5FingerprintLabel, image: Image(systemName: "touchid"), text: keyWriter.openSSHMD5Fingerprint(secret: secret))
                    Spacer()
                        .frame(height: 20)
-                    CopyableView(title: "secret_detail_public_key_label", image: Image(systemName: "key"), text: keyString)
+                    CopyableView(title: .secretDetailPublicKeyLabel, image: Image(systemName: "key"), text: keyString)
                    Spacer()
                        .frame(height: 20)
-                    CopyableView(title: "secret_detail_public_key_path_label", image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret))
+                    CopyableView(title: .secretDetailPublicKeyPathLabel, image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret))
                    Spacer()
                }
            }
--- a/Sources/Secretive/Views/SecretListItemView.swift
+++ b/Sources/Secretive/Views/SecretListItemView.swift
@@ -39,10 +39,10 @@ struct SecretListItemView: View {
        .contextMenu {
            if store is AnySecretStoreModifiable {
                Button(action: { isRenaming = true }) {
-                    Text("secret_list_rename_button")
+                    Text(.secretListRenameButton)
                }
                Button(action: { isDeleting = true }) {
-                    Text("secret_list_delete_button")
+                    Text(.secretListDeleteButton)
                }
            }
        }
--- a/Sources/Secretive/Views/SetupView.swift
+++ b/Sources/Secretive/Views/SetupView.swift
@@ -61,7 +61,7 @@ struct StepView: View {
                            Circle()
                                .foregroundColor(.green)
                                .frame(width: Constants.circleWidth, height: Constants.circleWidth)
-                            Text("setup_step_complete_symbol")
+                            Text(.setupStepCompleteSymbol)
                                .foregroundColor(.white)
                                .bold()
                        } else {
@@ -101,14 +101,14 @@ extension StepView {

 struct SetupStepView<Content> : View where Content : View {

-    let title: LocalizedStringKey
+    let title: LocalizedStringResource
    let image: Image
-    let bodyText: LocalizedStringKey
-    let buttonTitle: LocalizedStringKey
+    let bodyText: LocalizedStringResource
+    let buttonTitle: LocalizedStringResource
    let buttonAction: () -> Void
    let content: Content

-    init(title: LocalizedStringKey, image: Image, bodyText: LocalizedStringKey, buttonTitle: LocalizedStringKey, buttonAction: @escaping () -> Void = {}, @ViewBuilder content: () -> Content) {
+    init(title: LocalizedStringResource, image: Image, bodyText: LocalizedStringResource, buttonTitle: LocalizedStringResource, buttonAction: @escaping () -> Void = {}, @ViewBuilder content: () -> Content) {
        self.title = title
        self.image = image
        self.bodyText = bodyText
@@ -145,12 +145,12 @@ struct SecretAgentSetupView: View {
    let buttonAction: () -> Void

    var body: some View {
-        SetupStepView(title: "setup_agent_title",
+        SetupStepView(title: .setupAgentTitle,
                      image: Image(nsImage: NSApplication.shared.applicationIconImage),
-                      bodyText: "setup_agent_description",
-                      buttonTitle: "setup_agent_install_button",
+                      bodyText: .setupAgentDescription,
+                      buttonTitle: .setupAgentInstallButton,
                      buttonAction: install) {
-            Text("setup_agent_activity_monitor_description")
+            Text(.setupAgentActivityMonitorDescription)
                .multilineTextAlignment(.center)
        }
    }
@@ -172,12 +172,12 @@ struct SSHAgentSetupView: View {
    @State private var selectedShellInstruction: ShellConfigInstruction = controller.shellInstructions.first!

    var body: some View {
-        SetupStepView(title: "setup_ssh_title",
+        SetupStepView(title: .setupSshTitle,
                      image: Image(systemName: "terminal"),
-                      bodyText: "setup_ssh_description",
-                      buttonTitle: "setup_ssh_added_manually_button",
+                      bodyText: .setupSshDescription,
+                      buttonTitle: .setupSshAddedManuallyButton,
                      buttonAction: buttonAction) {
-        Link("setup_third_party_faq_link", destination: URL(string: "https://github.com/maxgoedjen/secretive/blob/main/APP_CONFIG.md")!)
+        Link(.setupThirdPartyFaqLink, destination: URL(string: "https://github.com/maxgoedjen/secretive/blob/main/APP_CONFIG.md")!)
            Picker(selection: $selectedShellInstruction, label: EmptyView()) {
                ForEach(SSHAgentSetupView.controller.shellInstructions) { instruction in
                    Text(instruction.shell)
@@ -185,8 +185,8 @@ struct SSHAgentSetupView: View {
                        .padding()
                }
            }.pickerStyle(SegmentedPickerStyle())
-            CopyableView(title: "setup_ssh_add_to_config_button_\(selectedShellInstruction.shellConfigPath)", image: Image(systemName: "greaterthan.square"), text: selectedShellInstruction.text)
-            Button("setup_ssh_add_for_me_button") {
+            CopyableView(title: .setupSshAddToConfigButton(configPath: selectedShellInstruction.shellConfigPath), image: Image(systemName: "greaterthan.square"), text: selectedShellInstruction.text)
+            Button(.setupSshAddForMeButton) {
                let controller = ShellConfigurationController()
                if controller.addToShell(shellInstructions: selectedShellInstruction) {
                    buttonAction()
@@ -216,12 +216,12 @@ struct UpdaterExplainerView: View {
    let buttonAction: () -> Void

    var body: some View {
-        SetupStepView(title: "setup_updates_title",
+        SetupStepView(title: .setupUpdatesTitle,
                      image: Image(systemName: "dot.radiowaves.left.and.right"),
-                      bodyText: "setup_updates_description",
-                      buttonTitle: "setup_updates_ok",
+                      bodyText: .setupUpdatesDescription,
+                      buttonTitle: .setupUpdatesOk,
                      buttonAction: buttonAction) {
-            Link("setup_updates_readmore", destination: SetupView.Constants.updaterFAQURL)
+            Link(.setupUpdatesReadmore, destination: SetupView.Constants.updaterFAQURL)
        }
    }

--- a/Sources/Secretive/Views/UpdateView.swift
+++ b/Sources/Secretive/Views/UpdateView.swift
@@ -9,22 +9,22 @@ struct UpdateDetailView: View {

    var body: some View {
        VStack {
-            Text("update_version_name_\(update.name)").font(.title)
-            GroupBox(label: Text("update_release_notes_title")) {
+            Text(.updateVersionName(updateName: update.name)).font(.title)
+            GroupBox(label: Text(.updateReleaseNotesTitle)) {
                ScrollView {
                    attributedBody
                }
            }
            HStack {
                if !update.critical {
-                    Button("update_ignore_button") {
+                    Button(.updateIgnoreButton) {
                        Task {
                            await updater.ignore(release: update)
                        }
                    }
                    Spacer()
                }
-                Button("update_update_button") {
+                Button(.updateUpdateButton) {
                    NSWorkspace.shared.open(update.html_url)
                }
                .keyboardShortcut(.defaultAction)
Author	SHA1	Message	Date
Max Goedjen	b2c294211a	Symlink to Package.swift	2025-08-23 15:50:38 -07:00
Max Goedjen	e3938caecb	Remove unused verify functions. (#621 )	2025-08-23 22:26:40 +00:00
Max Goedjen	bd096c3012	Add attestation info to readme (#620 ) * Update README.md * Enhance README with attestation visibility details * Update README to clarify build process and attestations	2025-08-23 22:07:09 +00:00
Max Goedjen	2355d3f989	Use the symlink (#619 )	2025-08-21 05:20:40 +00:00
Max Goedjen	45bcb03fef	Enable enhanced security. (#618 )	2025-08-20 07:10:23 +00:00
Max Goedjen	e86aa559a4	Remove unchecked sendable (#617 )	2025-08-20 06:32:46 +00:00
Max Goedjen	d36537b919	Release and attestation tweaks (#616 ) * Abs path * Write. * Pass attestation. * Attest nightly	2025-08-19 23:27:58 -07:00
Max Goedjen	8adb4423ac	Release management using gh cli (#615 )	2025-08-19 07:24:22 +00:00
Max Goedjen	8dbf992cce	Add attestation (#614 )	2025-08-19 07:07:43 +00:00
Max Goedjen	f382d72ee5	Update localization status (#613 )	2025-08-18 03:31:53 +00:00
Max Goedjen	9749cd6f3e	Switch to generated localized string symbols (#607 ) * Switch to string symbols * Names * Cleanup packages * Cleanup packages * Remove namespace * More cleanup * Fix extra param. * Use swiftbuild	2025-08-18 03:26:13 +00:00
Max Goedjen	83ecc15332	Dim cells on background (#612 )	2025-08-18 03:19:13 +00:00
Max Goedjen	ecd001a082	Update (#611 )	2025-08-18 02:42:23 +00:00