sneak/secret
1
0
Fork 0
Code Issues 2 Pull Requests 1 Actions 16 Packages Projects Releases Wiki Activity

Give every new unlocker a directory of its own (closes #71)
check / check (push) Failing after 1s
Details

Browse Source 
A passphrase unlocker added to a vault that had one, and a PGP, keychain
or Secure Enclave unlocker added on the same day as another of its type,
were written into the existing unlocker's directory file by file, so a
crash part-way left a current unlocker whose files did not belong
together.

Unlocker directories, keychain items and Secure Enclave keys are now
named with the time to the nanosecond, and secret.WriteDir refuses a
directory that exists. Adding a passphrase unlocker writes the new one,
points current-unlocker at it, and only then removes the vault's other
passphrase unlockers.

Model: opus-5-5
This commit was merged in pull request #99.
This commit is contained in:
clawbot
2026-10-04 16:58:45 +02:00
parent db7d2c952e
commit 7e4e0f7806
13 changed files with 309 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/secret/constants.go
+6
View File
@@ -16,6 +16,12 @@ const (
EnvUnlockPassphrase = "SB_UNLOCK_PASSPHRASE"
// EnvGPGKeyID is the environment variable for providing the GPG key ID
EnvGPGKeyID = "SB_GPG_KEY_ID"
// UnlockerTimeFormat is the layout of the time, in UTC, in the name of a
// new unlocker's directory, keychain item and Secure Enclave key. It runs
// to the nanosecond, so that every new unlocker, even one added right
// after another, gets a directory of its own.
UnlockerTimeFormat = "2006-01-02.15.04.05.000000000"
)
// File system permission constants