secret

226 Commits 2 Branches 2 Tags

3 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
clawbot	2d6675a452	Remove the keychain and Secure Enclave unlockers (closes #132 ) check / check (push) Failing after 5s Details Neither unlocker works without macOS code signing and entitlements, which secret does not have, so both were research and leave the build. `secret unlocker add` takes only passphrase and pgp on every platform; keychain and secure-enclave fail as unknown types and are gone from --help and shell completion. internal/macse, their files in internal/secret with their tests, and their branches in internal/vault and internal/cli are deleted; github.com/keybase/go-keychain leaves go.mod and go.sum. README and Dockerfile comments no longer mention them. The research stays at `ef0ae90`, tagged v1.0.0-rc1. Judgement call: derivation_index_test.go goes with getLongTermPrivateKey, its only subject, which only these two unlockers used. Unverified: not built or run on a Mac; only the GOOS=darwin vet and lint ran. Model: opus-5-5	2026-10-13 00:39:35 +02:00
clawbot	af9ac6d979	Rename the Go module to sneak.berlin/go/secret (closes #43 ) check / check (push) Failing after 2s Details REPO_POLICIES.md requires the module root sneak.berlin/go/<name>. go.mod, every import (rewritten with gofmt -r), the -X flags in script/build and the examples in the pkg READMEs now use the new path. go mod tidy lists go-humanize and fatih/color as direct requirements, since internal/cli imports them. This breaks anyone who fetched or imported git.eeqj.de/sneak/secret: they must switch to sneak.berlin/go/secret, which resolves to this repository. Model: opus-5-5	2026-10-05 02:45:37 +02:00
clawbot	0e6a4afb71	Make an unlocker's ID the name of its directory (closes #98 ) check / check (push) Failing after 2s Details Keychain and Secure Enclave unlocker IDs were the creation time to the minute plus the host name, and passphrase unlocker IDs the time to the minute, so two created within one minute shared an ID, and `unlocker select`, `unlocker remove` and the selection after `unlocker add` acted on the older one. Every unlocker's ID is now its directory name, unique in its vault. `vault.ListUnlockers` returns each unlocker's metadata keyed by that name, so `unlocker list` and shell completion no longer find IDs by matching metadata. PGP unlocker IDs were `pgp-<fingerprint>`; a second PGP unlocker for one key is refused by comparing fingerprints in metadata. Model: opus-5-5	2026-10-04 21:25:00 +02:00

clawbot

2d6675a452

Remove the keychain and Secure Enclave unlockers (closes #132 )

check / check (push) Failing after 5s

Details

Neither unlocker works without macOS code signing and entitlements, which
secret does not have, so both were research and leave the build.
`secret unlocker add` takes only passphrase and pgp on every platform;
keychain and secure-enclave fail as unknown types and are gone from
--help and shell completion. internal/macse, their files in
internal/secret with their tests, and their branches in internal/vault
and internal/cli are deleted; github.com/keybase/go-keychain leaves
go.mod and go.sum. README and Dockerfile comments no longer mention
them. The research stays at ef0ae90, tagged v1.0.0-rc1.

Judgement call: derivation_index_test.go goes with getLongTermPrivateKey,
its only subject, which only these two unlockers used.
Unverified: not built or run on a Mac; only the GOOS=darwin vet and lint ran.

Model: opus-5-5

2026-10-13 00:39:35 +02:00

clawbot

af9ac6d979

Rename the Go module to sneak.berlin/go/secret (closes #43 )

check / check (push) Failing after 2s

Details

REPO_POLICIES.md requires the module root sneak.berlin/go/<name>.
go.mod, every import (rewritten with gofmt -r), the -X flags in
script/build and the examples in the pkg READMEs now use the new path.
go mod tidy lists go-humanize and fatih/color as direct requirements,
since internal/cli imports them.

This breaks anyone who fetched or imported git.eeqj.de/sneak/secret:
they must switch to sneak.berlin/go/secret, which resolves to this
repository.

Model: opus-5-5

2026-10-05 02:45:37 +02:00

clawbot

0e6a4afb71

Make an unlocker's ID the name of its directory (closes #98 )

check / check (push) Failing after 2s

Details

Keychain and Secure Enclave unlocker IDs were the creation time to the
minute plus the host name, and passphrase unlocker IDs the time to the
minute, so two created within one minute shared an ID, and `unlocker
select`, `unlocker remove` and the selection after `unlocker add` acted on
the older one. Every unlocker's ID is now its directory name, unique in
its vault. `vault.ListUnlockers` returns each unlocker's metadata keyed by
that name, so `unlocker list` and shell completion no longer find IDs by
matching metadata. PGP unlocker IDs were `pgp-<fingerprint>`; a second
PGP unlocker for one key is refused by comparing fingerprints in metadata.

Model: opus-5-5

2026-10-04 21:25:00 +02:00