Create a vault whole in a temporary directory, then select it (closes #105)

vault.CreateVault takes the unlocker passphrase and writes the vault
directory, its metadata, long-term public key and passphrase unlocker
into a temporary directory, renames that into vaults.d once complete,
and only then makes the vault current. secret init and secret vault
create call it once instead of adding the unlocker afterwards, so a
kill part-way leaves either no vault, whose temporary directory the
next command that takes the lock deletes, or a complete one. A test
records the state directory before every change the call makes and
checks each state, and the command run again from it.

Model: opus-5-5

TODO.md

@@ -31,22 +31,6 @@ https://git.eeqj.de/sneak/secret/milestone/12
   deletes the temporary directory; or, killed between the rename and making
   the vault current, a complete vault that is not current, which
   `secret vault select` makes current.
-- 2026-10-04: A failed `secret unlocker add keychain` or
-  `secret unlocker add secure-enclave` no longer leaves its keychain item or
-  Secure Enclave key behind (https://git.eeqj.de/sneak/secret/issues/89).
-  `CreateSecureEnclaveUnlocker` gets the long-term key before it creates the
-  Secure Enclave key, so that a wrong passphrase creates none, and deletes the
-  key again if encrypting with it or writing the unlocker then fails.
-  `macse.CreateKey` finds the new key's hash right after `sc_auth` creates
-  it, and fails with an error naming the key's label if it cannot; it deletes
-  the key again if getting its public key then fails. The Objective-C was only
-  read, never compiled or run, and so was `macse_darwin.go`, which is cgo only.
-  `CreateKeychainUnlocker` writes all of the unlocker's files, the metadata
-  among them, before it stores the item in the keychain, and deletes the item
-  again if moving the unlocker into place then fails. A failure to delete is
-  reported along with the first error. The tests of this run only on macOS:
-  the Secure Enclave one in a build with cgo on a Mac with a Secure Enclave,
-  the keychain one in a build with cgo.
 - 2026-10-04: What a command killed part-way left under a `.tmp-` name
   (https://git.eeqj.de/sneak/secret/issues/75), the temporary directories
   of `secret.TempDirFor` and the temporary files of

internal/macse/macse_darwin.go

@@ -15,7 +15,6 @@ package macse
 import "C"
 
 import (
-	"errors"
 	"fmt"
 	"unsafe"
 )
@@ -40,9 +39,10 @@ const (
 
 // CreateKey creates a new P-256 non-exportable key in the Secure Enclave via sc_auth.
 // Returns the uncompressed public key bytes (65 bytes) and the identity hash
-// (for deletion). If getting the public key fails, CreateKey deletes the key
-// again; a failure to delete is returned along with the first error.
+// (for deletion).
 func CreateKey(label string) (publicKey []byte, hash string, err error) {
+	pubKeyBuf := make([]C.uint8_t, p256UncompressedKeySize)
+	pubKeyLen := C.int(p256UncompressedKeySize)
 	var hashBuf [hashBufferSize]C.char
 	var errBuf [errorBufferSize]C.char
 
@@ -50,6 +50,7 @@ func CreateKey(label string) (publicKey []byte, hash string, err error) {
 	defer C.free(unsafe.Pointer(cLabel)) //nolint:nlreturn // CGo free pattern
 
 	result := C.se_create_key(cLabel,
+		&pubKeyBuf[0], &pubKeyLen,
 		&hashBuf[0], C.int(hashBufferSize),
 		&errBuf[0], C.int(errorBufferSize))
 
@@ -57,29 +58,9 @@ func CreateKey(label string) (publicKey []byte, hash string, err error) {
 		return nil, "", fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
 	}
 
-	h := C.GoString(&hashBuf[0])
-
-	pubKeyBuf := make([]C.uint8_t, p256UncompressedKeySize)
-	pubKeyLen := C.int(p256UncompressedKeySize)
-
-	result = C.se_copy_public_key(cLabel,
-		&pubKeyBuf[0], &pubKeyLen,
-		&errBuf[0], C.int(errorBufferSize))
-
-	if result != 0 {
-		err = fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
-
-		deleteErr := DeleteKey(h)
-		if deleteErr != nil {
-			err = errors.Join(err,
-				fmt.Errorf("failed to delete key %s: %w", label, deleteErr))
-		}
-
-		return nil, "", err
-	}
-
 	//nolint:nlreturn // CGo result extraction
 	pk := C.GoBytes(unsafe.Pointer(&pubKeyBuf[0]), pubKeyLen)
+	h := C.GoString(&hashBuf[0])
 
 	return pk, h, nil
 }

internal/macse/secure_enclave.h

@@ -5,30 +5,20 @@
 
 #include <stdint.h>
 
-// se_create_key creates a new P-256 key in the Secure Enclave via sc_auth and
-// finds its identity hash. If the hash cannot be found, the key exists but
-// se_create_key fails, with an error naming the label.
+// se_create_key creates a new P-256 key in the Secure Enclave via sc_auth.
 // label: unique identifier for the CTK identity (UTF-8 C string)
+// pub_key_out: output buffer for the uncompressed public key (65 bytes for P-256)
+// pub_key_len: on input, size of pub_key_out; on output, actual size written
 // hash_out: output buffer for the identity hash (for deletion)
 // hash_out_len: size of hash_out buffer
 // error_out: output buffer for error message
 // error_out_len: size of error_out buffer
 // Returns 0 on success, -1 on failure.
 int se_create_key(const char *label,
+                  uint8_t *pub_key_out, int *pub_key_len,
                   char *hash_out, int hash_out_len,
                   char *error_out, int error_out_len);
 
-// se_copy_public_key copies the public key of a CTK identity.
-// label: label of the CTK identity
-// pub_key_out: output buffer for the uncompressed public key (65 bytes for P-256)
-// pub_key_len: on input, size of pub_key_out; on output, actual size written
-// error_out: output buffer for error message
-// error_out_len: size of error_out buffer
-// Returns 0 on success, -1 on failure.
-int se_copy_public_key(const char *label,
-                       uint8_t *pub_key_out, int *pub_key_len,
-                       char *error_out, int error_out_len);
-
 // se_encrypt encrypts data using the SE-backed public key (ECIES).
 // label: label of the CTK identity whose public key to use
 // plaintext: data to encrypt

internal/macse/secure_enclave.m

@@ -47,6 +47,7 @@ static SecKeyRef lookup_ctk_private_key(const char *label, char *error_out, int
 }
 
 int se_create_key(const char *label,
+                  uint8_t *pub_key_out, int *pub_key_len,
                   char *hash_out, int hash_out_len,
                   char *error_out, int error_out_len) {
     @autoreleasepool {
@@ -86,56 +87,7 @@ int se_create_key(const char *label,
             return -1;
         }
 
-        // Get the identity hash, which deleting the key needs, by parsing
-        // sc_auth list output
-        hash_out[0] = '\0';
-        NSTask *listTask = [[NSTask alloc] init];
-        listTask.executableURL = [NSURL fileURLWithPath:@"/usr/sbin/sc_auth"];
-        listTask.arguments = @[@"list-ctk-identities"];
-
-        NSPipe *listPipe = [NSPipe pipe];
-        listTask.standardOutput = listPipe;
-        listTask.standardError = [NSPipe pipe];
-
-        if ([listTask launchAndReturnError:&nsError]) {
-            [listTask waitUntilExit];
-            NSData *listData = [listPipe.fileHandleForReading readDataToEndOfFile];
-            NSString *listStr = [[NSString alloc] initWithData:listData
-                                                      encoding:NSUTF8StringEncoding];
-
-            for (NSString *line in [listStr componentsSeparatedByString:@"\n"]) {
-                if ([line containsString:labelStr]) {
-                    NSMutableArray *tokens = [NSMutableArray array];
-                    for (NSString *part in [line componentsSeparatedByCharactersInSet:
-                                            [NSCharacterSet whitespaceCharacterSet]]) {
-                        if (part.length > 0) {
-                            [tokens addObject:part];
-                        }
-                    }
-                    if (tokens.count > 1) {
-                        snprintf(hash_out, hash_out_len, "%s", [tokens[1] UTF8String]);
-                    }
-                    break;
-                }
-            }
-        }
-
-        if (hash_out[0] == '\0') {
-            NSString *msg = [NSString stringWithFormat:
-                             @"created key '%s' but found no hash for it in sc_auth list-ctk-identities",
-                             label];
-            snprintf_error(error_out, error_out_len, msg);
-            return -1;
-        }
-
-        return 0;
-    }
-}
-
-int se_copy_public_key(const char *label,
-                       uint8_t *pub_key_out, int *pub_key_len,
-                       char *error_out, int error_out_len) {
-    @autoreleasepool {
+        // Retrieve the public key from the created identity
         SecKeyRef privateKey = lookup_ctk_private_key(label, error_out, error_out_len);
         if (!privateKey) {
             return -1;
@@ -174,6 +126,39 @@ int se_copy_public_key(const char *label,
         *pub_key_len = (int)length;
         CFRelease(pubKeyData);
 
+        // Get the identity hash by parsing sc_auth list output
+        hash_out[0] = '\0';
+        NSTask *listTask = [[NSTask alloc] init];
+        listTask.executableURL = [NSURL fileURLWithPath:@"/usr/sbin/sc_auth"];
+        listTask.arguments = @[@"list-ctk-identities"];
+
+        NSPipe *listPipe = [NSPipe pipe];
+        listTask.standardOutput = listPipe;
+        listTask.standardError = [NSPipe pipe];
+
+        if ([listTask launchAndReturnError:&nsError]) {
+            [listTask waitUntilExit];
+            NSData *listData = [listPipe.fileHandleForReading readDataToEndOfFile];
+            NSString *listStr = [[NSString alloc] initWithData:listData
+                                                      encoding:NSUTF8StringEncoding];
+
+            for (NSString *line in [listStr componentsSeparatedByString:@"\n"]) {
+                if ([line containsString:labelStr]) {
+                    NSMutableArray *tokens = [NSMutableArray array];
+                    for (NSString *part in [line componentsSeparatedByCharactersInSet:
+                                            [NSCharacterSet whitespaceCharacterSet]]) {
+                        if (part.length > 0) {
+                            [tokens addObject:part];
+                        }
+                    }
+                    if (tokens.count > 1) {
+                        snprintf(hash_out, hash_out_len, "%s", [tokens[1] UTF8String]);
+                    }
+                    break;
+                }
+            }
+        }
+
         return 0;
     }
 }

internal/secret/atomic_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"filippo.io/age"
-	"git.eeqj.de/sneak/secret/internal/macse"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"github.com/awnumar/memguard"
@@ -900,42 +899,3 @@ func TestWriteDirRefusesExistingDir(t *testing.T) {
 		})
 	}
 }
-
-// TestSecureEnclaveUnlockerFailureDeletesKey makes moving a new Secure
-// Enclave unlocker into place fail after its Secure Enclave key is created:
-// the key must be deleted again. Skipped when the add fails before that, as
-// it does everywhere but in a macOS build with cgo on a Mac with a Secure
-// Enclave.
-func TestSecureEnclaveUnlockerFailureDeletesKey(t *testing.T) {
-	t.Parallel()
-
-	mnemonic := testMnemonicBuffer(t)
-	base := afero.NewMemMapFs()
-	_, err := vault.CreateVault(base, testVaultStateDir, testVaultName, mnemonic, nil)
-	require.NoError(t, err)
-
-	// The unlocker's directory is named se-<label of its Secure Enclave key>
-	var seKeyLabel string
-
-	fs := hookFs{Fs: base, before: func(op, path string) error {
-		if op == opRename && filepath.Base(filepath.Dir(path)) == "unlockers.d" {
-			seKeyLabel = strings.TrimPrefix(filepath.Base(path), "se-")
-
-			return errInjected
-		}
-
-		return nil
-	}}
-
-	_, err = secret.CreateSecureEnclaveUnlocker(fs, testVaultStateDir, mnemonic,
-		nil)
-
-	if seKeyLabel == "" {
-		t.Skipf("the add failed before moving the unlocker into place: %v", err)
-	}
-
-	require.ErrorIs(t, err, errInjected)
-
-	_, err = macse.Encrypt(seKeyLabel, []byte("test"))
-	assert.Error(t, err, "Secure Enclave key left behind")
-}

internal/secret/keychainunlocker.go

@@ -490,8 +490,6 @@ func CreateKeychainUnlocker(
 
 // writeKeychainUnlocker writes a new keychain unlocker into unlockerDir and
 // stores its data in the keychain (steps 7 and 8 of CreateKeychainUnlocker).
-// The data is stored after the unlocker's files are written, and the keychain
-// item is deleted again if moving the unlocker into place then fails.
 func writeKeychainUnlocker(
 	fs afero.Fs, unlockerDir, keychainItemName, ageRecipient string,
 	encryptedAgePrivKey, encryptedLtPrivKey []byte,
@@ -512,10 +510,8 @@ func writeKeychainUnlocker(
 		return nil, fmt.Errorf("failed to marshal unlocker metadata: %w", err)
 	}
 
-	// Step 8: Write the unlocker's files, the metadata last, then store the
-	// data in the keychain
-	stored := false
-
+	// Step 8: Write the unlocker's files and store the data in the keychain,
+	// the metadata last
 	err = WriteDir(fs, unlockerDir, func(dir string) error {
 		err := WriteFileAtomic(fs, filepath.Join(dir, "pub.txt"), []byte(ageRecipient))
 		if err != nil {
@@ -532,29 +528,19 @@ func writeKeychainUnlocker(
 			return fmt.Errorf("failed to write encrypted long-term private key: %w", err)
 		}
 
+		err = storeInKeychain(keychainItemName, keychainDataBuffer)
+		if err != nil {
+			return fmt.Errorf("failed to store data in keychain: %w", err)
+		}
+
 		err = WriteFileAtomic(fs, filepath.Join(dir, "unlocker-metadata.json"),
 			metadataBytes)
 		if err != nil {
 			return fmt.Errorf("failed to write unlocker metadata: %w", err)
 		}
 
-		err = storeInKeychain(keychainItemName, keychainDataBuffer)
-		if err != nil {
-			return fmt.Errorf("failed to store data in keychain: %w", err)
-		}
-
-		stored = true
-
 		return nil
 	})
-	if err != nil && stored {
-		deleteErr := deleteFromKeychain(keychainItemName)
-		if deleteErr != nil {
-			err = errors.Join(err, fmt.Errorf(
-				"failed to delete keychain item %s: %w", keychainItemName, deleteErr))
-		}
-	}
-
 	if err != nil {
 		return nil, err
 	}

internal/secret/keychainunlocker_test.go

@@ -4,13 +4,10 @@ package secret
 
 import (
 	"encoding/hex"
-	"os"
-	"path/filepath"
 	"runtime"
 	"testing"
 
 	"github.com/awnumar/memguard"
-	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -188,27 +185,3 @@ func TestDeleteNonExistentKeychainItem(t *testing.T) {
 	assert.NoError(t, err,
 		"Deleting non-existent keychain item should not return an error")
 }
-
-// TestWriteKeychainUnlockerFailureDeletesItem makes moving a new keychain
-// unlocker into place fail after its data is stored in the keychain: the
-// keychain item must be deleted again.
-func TestWriteKeychainUnlockerFailureDeletesItem(t *testing.T) {
-	testItemName := "test-secret-keychain-unlocker-cleanup"
-	_ = deleteFromKeychain(testItemName)
-
-	// Moving the unlocker into a read-only directory fails
-	unlockersDir := filepath.Join(t.TempDir(), "unlockers.d")
-	require.NoError(t, os.Mkdir(unlockersDir, 0o500))
-
-	testBuffer := memguard.NewBufferFromBytes([]byte("test-keychain-data"))
-	defer testBuffer.Destroy()
-
-	_, err := writeKeychainUnlocker(afero.NewOsFs(),
-		filepath.Join(unlockersDir, testItemName), testItemName, "age1test",
-		[]byte("test-priv"), []byte("test-longterm"), testBuffer)
-	require.ErrorIs(t, err, os.ErrPermission,
-		"moving the unlocker into place should fail")
-
-	_, err = retrieveFromKeychain(testItemName)
-	assert.Error(t, err, "keychain item left behind")
-}

internal/secret/seunlocker_darwin.go

@@ -4,7 +4,6 @@ package secret
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"log/slog"
 	"os"
@@ -217,8 +216,6 @@ func generateSEKeyLabel(vaultName string) (string, error) {
 // using ECIES. No intermediate age keypair is used.
 // The long-term key comes from mnemonic when it is not nil, else from the
 // current unlocker, as getLongTermKeyForSE describes.
-// The SE key is created once the long-term key is in hand and the unlocker's
-// path is known, and is deleted again if a later step fails.
 func CreateSecureEnclaveUnlocker(
 	fs afero.Fs,
 	stateDir string,
@@ -240,26 +237,7 @@ func CreateSecureEnclaveUnlocker(
 		return nil, fmt.Errorf("failed to generate SE key label: %w", err)
 	}
 
-	// Step 1: Get the vault's long-term private key
-	ltPrivKeyData, err := getLongTermKeyForSE(fs, vault, mnemonic, passphrase)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"failed to get long-term private key: %w",
-			err,
-		)
-	}
-	defer ltPrivKeyData.Destroy()
-
-	// Step 2: Prepare the unlocker directory's path
-	vaultDir, err := vault.GetDirectory()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get vault directory: %w", err)
-	}
-
-	unlockerDirName := "se-" + filepath.Base(seKeyLabel)
-	unlockerDir := filepath.Join(vaultDir, "unlockers.d", unlockerDirName)
-
-	// Step 3: Create P-256 key in the Secure Enclave via sc_auth
+	// Step 1: Create P-256 key in the Secure Enclave via sc_auth
 	Debug("Creating Secure Enclave key", "label", seKeyLabel)
 
 	_, seKeyHash, err := macse.CreateKey(seKeyLabel)
@@ -269,31 +247,17 @@ func CreateSecureEnclaveUnlocker(
 
 	Debug("Created SE key", "label", seKeyLabel, "hash", seKeyHash)
 
-	// Steps 4 and 5: Write the unlocker, or delete the SE key if that fails
-	unlocker, err := writeSEUnlocker(fs, unlockerDir, seKeyLabel, seKeyHash,
-		ltPrivKeyData)
+	// Step 2: Get the vault's long-term private key
+	ltPrivKeyData, err := getLongTermKeyForSE(fs, vault, mnemonic, passphrase)
 	if err != nil {
-		deleteErr := macse.DeleteKey(seKeyHash)
-		if deleteErr != nil {
-			err = errors.Join(err, fmt.Errorf(
-				"failed to delete SE key %s: %w", seKeyLabel, deleteErr))
-		}
-
-		return nil, err
+		return nil, fmt.Errorf(
+			"failed to get long-term private key: %w",
+			err,
+		)
 	}
+	defer ltPrivKeyData.Destroy()
 
-	return unlocker, nil
-}
-
-// writeSEUnlocker encrypts the long-term key with the SE key and writes the
-// new unlocker into unlockerDir (steps 4 and 5 of
-// CreateSecureEnclaveUnlocker).
-func writeSEUnlocker(
-	fs afero.Fs, unlockerDir, seKeyLabel, seKeyHash string,
-	ltPrivKeyData *memguard.LockedBuffer,
-) (*SecureEnclaveUnlocker, error) {
-	// Step 4: Encrypt the long-term key directly with the SE (ECIES), and
-	// prepare the metadata
+	// Step 3: Encrypt the long-term key directly with the SE (ECIES)
 	encryptedLtKey, err := macse.Encrypt(seKeyLabel, ltPrivKeyData.Bytes())
 	if err != nil {
 		return nil, fmt.Errorf(
@@ -302,6 +266,15 @@ func writeSEUnlocker(
 		)
 	}
 
+	// Step 4: Prepare the unlocker directory's path and metadata
+	vaultDir, err := vault.GetDirectory()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get vault directory: %w", err)
+	}
+
+	unlockerDirName := "se-" + filepath.Base(seKeyLabel)
+	unlockerDir := filepath.Join(vaultDir, "unlockers.d", unlockerDirName)
+
 	seMetadata := SecureEnclaveUnlockerMetadata{
 		UnlockerMetadata: UnlockerMetadata{
 			Type:      seUnlockerType,