Type-check and lint the macOS build from Linux (closes #50)

script/lint-darwin (make lint-darwin; run by script/check, and its
commands by the Dockerfile lint stage) runs go vet and golangci-lint
with GOOS=darwin and cgo off. Compiling cgo for macOS needs Apple's SDK,
and keychainunlocker.go uses go-keychain, which is cgo there, so it and
its tests are now built only with cgo on macOS, like internal/macse;
their stubs serve a macOS build without cgo. checkMacOSAvailable moves
to seunlocker_darwin.go. The findings in the newly checked files are
fixed, and lines over 88 columns in the unchecked ones are wrapped.

Model: opus-5-5

Dockerfile

@@ -14,8 +14,11 @@ ARG CHECK_EPOCH
 COPY . .
 
 RUN make fmt-check
-# Not make lint: script/lint is a docker build, which cannot run in here.
+# Not make lint or make lint-darwin: script/lint and script/lint-darwin are
+# docker builds, which cannot run in here. These are their commands.
 RUN golangci-lint run --config .golangci.yml ./...
+RUN GOOS=darwin CGO_ENABLED=0 go vet ./...
+RUN GOOS=darwin CGO_ENABLED=0 golangci-lint run --config .golangci.yml ./...
 
 # Build stage — tests and compilation
 # golang 1.24.13-alpine (2026-03-10)

Dockerfile.lint

@@ -1,6 +1,6 @@
-# Lint image, built by script/lint: golangci-lint runs as a build step, so a
-# successful build is a clean lint. Works where the docker daemon is remote
-# and bind mounts are impossible.
+# Lint image, built by script/lint and script/lint-darwin: golangci-lint runs
+# as a build step, so a successful build is a clean lint. Works where the
+# docker daemon is remote and bind mounts are impossible.
 
 # golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
 FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS deps
@@ -17,3 +17,13 @@ FROM deps AS lint
 COPY . .
 
 RUN golangci-lint run --config .golangci.yml ./...
+
+# script/lint-darwin rebuilds this stage on every run, by this name. It
+# checks the code as a macOS build compiles it, but with cgo off, which
+# leaves out the files that need cgo on macOS (see script/lint-darwin).
+FROM deps AS lint-darwin
+
+COPY . .
+
+RUN GOOS=darwin CGO_ENABLED=0 go vet ./...
+RUN GOOS=darwin CGO_ENABLED=0 golangci-lint run --config .golangci.yml ./...

Makefile

@@ -1,7 +1,7 @@
 export CGO_ENABLED=1
 
-.PHONY: default bootstrap setup build test lint fmt fmt-check check docker \
-	docker-run clean install hooks
+.PHONY: default bootstrap setup build test lint lint-darwin fmt fmt-check \
+	check docker docker-run clean install hooks
 
 default: check
 
@@ -24,6 +24,10 @@ fmt:
 lint:
 	@script/lint
 
+# Type-check and lint the macOS build from Linux (see script/lint-darwin)
+lint-darwin:
+	@script/lint-darwin
+
 check:
 	@script/check
 

README.md

@@ -197,9 +197,6 @@ Creates a new unlocker of the specified type:
 **Options:**
 - `--keyid <id>`: GPG key ID (optional for PGP type, uses default key if not specified)
 
-A vault has one passphrase unlocker: adding one replaces the one the vault
-has, which is removed only once the new one is the current unlocker.
-
 #### `secret unlocker remove <unlocker-id> [--force]` / `secret unlocker rm` ⚠️ 🛑
 
 **DANGER**: Permanently removes an unlocker. Like Unix `rm`, this command
@@ -246,8 +243,8 @@ Decrypts data using an Age key stored as a secret.
 ├── vaults.d/
 │   ├── default/
 │   │   ├── unlockers.d/
-│   │   │   ├── passphrase-<time>/       # Passphrase unlocker
-│   │   │   └── <host>-pgp-<time>/       # PGP unlocker
+│   │   │   ├── passphrase/              # Passphrase unlocker
+│   │   │   └── pgp/                     # PGP unlocker
 │   │   ├── secrets.d/
 │   │   │   ├── api%key/                 # Secret: api/key
 │   │   │   │   ├── versions/
@@ -263,7 +260,7 @@ Decrypts data using an Age key stored as a secret.
 │   │   │       └── current -> versions/20231215.001
 │   │   ├── vault-metadata.json          # Vault metadata
 │   │   ├── pub.age                      # Long-term public key
-│   │   └── current-unlocker             # Current unlocker's directory name
+│   │   └── current-unlocker -> ../unlockers.d/passphrase
 │   └── work/
 │       ├── unlockers.d/
 │       ├── secrets.d/
@@ -522,10 +519,15 @@ them. We provide:
 - `script/lint` — run `golangci-lint` in docker only: builds
   `Dockerfile.lint`, where the linter is a build step that runs on every
   call, also on an unchanged tree
+- `script/lint-darwin` — run `go vet` and `golangci-lint` in docker on
+  the code as a macOS build compiles it (`GOOS=darwin`), which a Linux
+  build never compiles; cgo is off, so the keychain unlocker
+  (`internal/secret/keychainunlocker.go` and its tests) and the Secure
+  Enclave bindings (`internal/macse`) are not checked
 - `script/fmt` — format all Go code (writes)
 - `script/fmt-check` — check formatting without writing
-- `script/check` — run `script/test`, `script/lint`, and
-  `script/fmt-check`
+- `script/check` — run `script/test`, `script/lint`,
+  `script/lint-darwin`, and `script/fmt-check`
 - `script/docker` — build the Docker image tagged with the project name
 - `script/cibuild` — CI entrypoint: `docker build --ulimit
   memlock=-1:-1 .` (memguard needs mlock; the Dockerfile runs the

TODO.md

@@ -25,31 +25,22 @@ Bring the repo into policy compliance in one commit:
 
 # Completed Steps
 
-- 2026-10-04: A crash while an unlocker is being replaced no longer
-  leaves a current unlocker that cannot open the vault
-  (https://git.eeqj.de/sneak/secret/issues/71). Every new unlocker gets
-  a directory of its own, named with the time to the nanosecond:
-  `passphrase-<time>`, `<host>-pgp-<time>`, and for a keychain or Secure
-  Enclave unlocker the keychain item or Secure Enclave key, which names
-  the directory, carries the time instead of the day. `secret.WriteDir`
-  fails on a directory that exists instead of writing into it.
-  `unlocker add passphrase` writes the new unlocker, makes it current,
-  and only then removes the vault's other passphrase unlockers; a crash
-  between the last two steps leaves the old one beside the new, and the
-  old passphrase still opens the vault through it until the next
-  `unlocker add passphrase` or an `unlocker remove` removes it. A PGP,
-  keychain or
-  Secure Enclave unlocker added on the same host and day as another of
-  its type is added beside it instead of replacing it.
-- 2026-10-04: `secret unlocker add pgp` works on Linux
-  (https://git.eeqj.de/sneak/secret/issues/88). `CreatePGPUnlocker` gets
-  the vault's long-term key as adding a passphrase unlocker does, with the
-  vault's `GetOrDeriveLongTermKey`, now part of `VaultInterface`: from the
-  mnemonic, checked against the vault, or else from the current unlocker.
-  Before, it used the keychain unlocker's helper, which on every platform
-  but macOS always failed. A test adds a PGP unlocker for a throwaway GPG
-  key, getting the long-term key once from the mnemonic and once from a
-  passphrase unlocker, and reads a secret through the new unlocker.
+- 2026-10-04: `script/lint-darwin` (`make lint-darwin`) runs `go vet` and
+  `golangci-lint` in docker on the code as a macOS build compiles it
+  (`GOOS=darwin`), with cgo off
+  (https://git.eeqj.de/sneak/secret/issues/50). `script/check` runs it,
+  and the `Dockerfile` lint stage runs its commands, so `script/cibuild`
+  does too. Before, CI on Linux never compiled the files built only for
+  macOS. Compiling cgo code for macOS needs Apple's SDK headers, and both
+  `internal/macse` and `github.com/keybase/go-keychain`, which
+  `keychainunlocker.go` uses, are cgo on macOS. So `keychainunlocker.go`
+  and its tests are now built only with cgo on macOS, like
+  `macse_darwin.go`, and the keychain and `macse` stubs serve a macOS
+  build without cgo, which before did not compile. `checkMacOSAvailable`
+  moved to `seunlocker_darwin.go`. The check covers the Secure Enclave
+  unlocker and the macOS-only tests `seunlocker_test.go` and
+  `pgpunlock_test.go`, whose lint findings are fixed; lines over 88
+  columns in the macOS files it cannot check are wrapped.
 - 2026-10-04: A vault name may use only lowercase ASCII letters, digits,
   `.`, `-` and `_`, and must not be empty, `.` or `..`
   (https://git.eeqj.de/sneak/secret/issues/68); the error and `README.md`
@@ -75,7 +66,9 @@ Bring the repo into policy compliance in one commit:
   and encrypt everything before writing anything. All four unlocker
   types write their files through `secret.WriteDir`: a new unlocker is
   built in a temporary directory, renamed into place when complete and
-  removed on a failure.
+  removed on a failure. One added under the directory name of an
+  existing unlocker is still written into that directory in place
+  (https://git.eeqj.de/sneak/secret/issues/71).
 - 2026-10-04: `secret unlocker select` and `secret unlocker remove`
   skip, with the warning `unlocker list` gives, an unlocker directory
   whose metadata file cannot be checked for, read or parsed, instead of
@@ -171,6 +164,12 @@ Bring the repo into policy compliance in one commit:
   into place, and removals rename out of the way first, so a version
   or secret is never half-added and never half-removed. An
   interrupted command can still leave:
+    - a broken unlocker, when it was replacing one: an unlocker added
+      under the directory name of an existing one is rewritten file by
+      file. That happens to a passphrase unlocker added to a vault that
+      has one, and to a PGP, keychain or Secure Enclave unlocker added
+      on the same host and day as another of its type
+      (https://git.eeqj.de/sneak/secret/issues/71);
     - from `init` or `vault create` killed after the passphrase prompt
       but before the unlocker is written, a vault with no unlocker,
       which `vault create` has already made the current vault;
@@ -265,11 +264,15 @@ Bring the repo into policy compliance in one commit:
 - Cover mnemonic-vs-xprv identity consistency in
   `pkg/agehd/agehd_test.go` `TestMnemonicVsXPRVConsistency` (was an
   in-code FIXME removed for godox).
-- Darwin-gated files (`internal/secret/keychainunlocker.go`,
-  `seunlocker_darwin.go`, `internal/macse/macse_darwin.go`, related
-  tests) are not linted on the Linux CI runner and still contain lines
-  over the new 88-column limit; they will surface if lint ever runs on
-  macOS.
+- CI does not compile, lint or test the files built only with cgo on
+  macOS, since compiling them needs Apple's SDK:
+  `internal/secret/keychainunlocker.go` with `keychainunlocker_test.go`,
+  `validation_darwin_test.go` and `derivation_index_test.go`, and
+  `internal/macse` (`macse_darwin.go`, `macse_test.go`, the Objective-C
+  sources). Lint has never run on them, so it would likely find more
+  there than the line lengths. No macOS test runs in CI. A macOS runner
+  would cover all of it (asked on
+  https://git.eeqj.de/sneak/secret/issues/50).
 - Merge secure-enclave-unlocker to main once review is done.
 - 1.0 critical security blockers (from repo TODO.md):
     - Command injection: GPG key IDs passed unescaped to exec.Command

internal/cli/integration_test.go

@@ -366,15 +366,8 @@ func test01Initialize(t *testing.T, tempDir, testMnemonic, testPassphrase string
 	unlockersDir := filepath.Join(defaultVaultDir, "unlockers.d")
 	verifyFileExists(t, unlockersDir)
 
-	// Check current-unlocker file names the unlocker's directory
-	currentUnlockerFile := filepath.Join(defaultVaultDir, "current-unlocker")
-	verifyFileExists(t, currentUnlockerFile)
-
-	currentUnlockerContent := readFile(t, currentUnlockerFile)
-	assert.Contains(t, string(currentUnlockerContent), "passphrase", "current unlocker should point to passphrase type")
-
 	// Verify passphrase unlocker was created
-	passphraseUnlockerDir := filepath.Join(unlockersDir, string(currentUnlockerContent))
+	passphraseUnlockerDir := filepath.Join(unlockersDir, "passphrase")
 	verifyFileExists(t, passphraseUnlockerDir)
 
 	// Check unlocker metadata
@@ -389,6 +382,13 @@ func test01Initialize(t *testing.T, tempDir, testMnemonic, testPassphrase string
 	encryptedLTPubKey := filepath.Join(passphraseUnlockerDir, "pub.age")
 	verifyFileExists(t, encryptedLTPubKey)
 
+	// Check current-unlocker file contains the relative path
+	currentUnlockerFile := filepath.Join(defaultVaultDir, "current-unlocker")
+	verifyFileExists(t, currentUnlockerFile)
+
+	currentUnlockerContent := readFile(t, currentUnlockerFile)
+	assert.Contains(t, string(currentUnlockerContent), "passphrase", "current unlocker should point to passphrase type")
+
 	// Verify vault-metadata.json in vault
 	vaultMetadata := filepath.Join(defaultVaultDir, "vault-metadata.json")
 	verifyFileExists(t, vaultMetadata)
@@ -537,8 +537,7 @@ func test04ImportMnemonic(t *testing.T, tempDir, testMnemonic, testPassphrase st
 	verifyFileExists(t, pubKeyFile)
 
 	// Verify passphrase unlocker was created
-	currentUnlocker := readFile(t, filepath.Join(workVaultDir, "current-unlocker"))
-	passphraseUnlockerDir := filepath.Join(workVaultDir, "unlockers.d", string(currentUnlocker))
+	passphraseUnlockerDir := filepath.Join(workVaultDir, "unlockers.d", "passphrase")
 	verifyFileExists(t, passphraseUnlockerDir)
 
 	// Check unlocker files

internal/cli/path_traversal_test.go

@@ -171,7 +171,7 @@ func TestInvalidSecretNameLeavesVaultsUnchanged(t *testing.T) {
 
 	vaultDir := testStateDir + "/vaults.d/default"
 	require.Contains(t, before, vaultDir+"/secrets.d/x/")
-	require.Contains(t, before, vaultDir+"/current-unlocker")
+	require.Contains(t, before, vaultDir+"/unlockers.d/passphrase/")
 	require.Equal(t, "default", before[testStateDir+"/currentvault"])
 
 	cmd := &cobra.Command{}

internal/cli/unlockers_add_test.go

@@ -5,88 +5,18 @@ import (
 	"path/filepath"
 	"testing"
 
-	"git.eeqj.de/sneak/secret/internal/secret"
-	"git.eeqj.de/sneak/secret/internal/vault"
-	"github.com/awnumar/memguard"
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 // unknownTestGPGUserID is a GPG user ID that no key in the test keyring has.
 const unknownTestGPGUserID = "not-in-keyring@example.com"
 
-// The secret TestAddPGPUnlocker stores, then reads through the new unlocker.
-const (
-	addTestSecretName  = "api-key"
-	addTestSecretValue = "value"
-)
-
-// TestAddPGPUnlocker adds a PGP unlocker for a throwaway GPG key to a vault
-// with a passphrase unlocker, getting the vault's long-term key from the
-// mnemonic or, with the mnemonic unset, from the passphrase unlocker. It
-// then reads a secret with neither the mnemonic nor the passphrase set, so
-// through the new unlocker, which the add selects.
-func TestAddPGPUnlocker(t *testing.T) {
-	newTestGPGKey(t)
-
-	tests := []struct {
-		name string
-		// mnemonic is the mnemonic set while the unlocker is added.
-		mnemonic string
-	}{
-		{"long-term key from the mnemonic", testMnemonic},
-		{"long-term key from the current unlocker", ""},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			t.Setenv(secret.EnvMnemonic, testMnemonic)
-			t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
-
-			fs := afero.NewMemMapFs()
-			vlt, err := vault.CreateVault(fs, listTestStateDir, listTestVaultName)
-			require.NoError(t, err)
-
-			err = vlt.AddSecret(addTestSecretName,
-				memguard.NewBufferFromBytes([]byte(addTestSecretValue)), false)
-			require.NoError(t, err)
-
-			_, err = vlt.CreatePassphraseUnlocker(
-				memguard.NewBufferFromBytes([]byte(testPassphrase)))
-			require.NoError(t, err)
-
-			t.Setenv(secret.EnvMnemonic, test.mnemonic)
-
-			instance, cmd := newTestInstance(fs)
-			cmd.Flags().String("keyid", unreadableTestGPGUserID, "")
-			require.NoError(t, instance.UnlockersAdd(unlockerTypePGP, cmd))
-
-			t.Setenv(secret.EnvMnemonic, "")
-			t.Setenv(secret.EnvUnlockPassphrase, "")
-
-			reopened := vault.NewVault(fs, listTestStateDir, listTestVaultName)
-
-			current, err := reopened.GetCurrentUnlocker()
-			require.NoError(t, err)
-			assert.Equal(t, unlockerTypePGP, current.GetType())
-
-			value, err := reopened.GetSecret(addTestSecretName)
-			require.NoError(t, err)
-
-			defer value.Destroy()
-
-			assert.Equal(t, addTestSecretValue, value.String())
-		})
-	}
-}
-
 // TestAddPGPUnlockerUnknownKey asserts that adding a PGP unlocker for a key
 // the keyring does not hold fails at looking up the key's fingerprint and
 // leaves no new unlocker directory. The error must come from the lookup: a
 // lookup moved after anything is written would also come after getting the
-// vault's long-term key, which fails first here: this vault's unlockers hold
-// no keys.
+// vault's long-term key, which fails first on every platform but macOS
+// (https://git.eeqj.de/sneak/secret/issues/88).
 //
 //nolint:paralleltest // t.Setenv (GNUPGHOME) forbids parallel tests
 func TestAddPGPUnlockerUnknownKey(t *testing.T) {

internal/cli/unreadable_dir_test.go

@@ -122,8 +122,7 @@ func assertDirEntries(t *testing.T, fs afero.Fs, dir string, want ...string) {
 }
 
 // newTestGPGKey points GNUPGHOME at a fresh directory, generates a GPG key
-// without a passphrase there, with a subkey for encryption, and returns the
-// key's fingerprint.
+// without a passphrase there, and returns the key's fingerprint.
 func newTestGPGKey(t *testing.T) string {
 	t.Helper()
 
@@ -152,14 +151,6 @@ func newTestGPGKey(t *testing.T) string {
 	fingerprint, err := secret.ResolveGPGKeyFingerprint(unreadableTestGPGUserID)
 	require.NoError(t, err)
 
-	//nolint:gosec // G204: fingerprint is the test key's, as gpg printed it
-	output, err = exec.CommandContext(t.Context(), "gpg", "--batch",
-		"--pinentry-mode", "loopback", "--passphrase", "",
-		"--quick-add-key", fingerprint, "cv25519", "encr", "never",
-	).CombinedOutput()
-	require.NoError(t, err, "adding the test GPG key's encryption subkey: %s",
-		output)
-
 	return fingerprint
 }
 

internal/macse/macse_darwin.go

@@ -38,7 +38,8 @@ const (
 )
 
 // CreateKey creates a new P-256 non-exportable key in the Secure Enclave via sc_auth.
-// Returns the uncompressed public key bytes (65 bytes) and the identity hash (for deletion).
+// Returns the uncompressed public key bytes (65 bytes) and the identity hash
+// (for deletion).
 func CreateKey(label string) (publicKey []byte, hash string, err error) {
 	pubKeyBuf := make([]C.uint8_t, p256UncompressedKeySize)
 	pubKeyLen := C.int(p256UncompressedKeySize)
@@ -57,7 +58,8 @@ func CreateKey(label string) (publicKey []byte, hash string, err error) {
 		return nil, "", fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
 	}
 
-	pk := C.GoBytes(unsafe.Pointer(&pubKeyBuf[0]), pubKeyLen) //nolint:nlreturn // CGo result extraction
+	//nolint:nlreturn // CGo result extraction
+	pk := C.GoBytes(unsafe.Pointer(&pubKeyBuf[0]), pubKeyLen)
 	h := C.GoString(&hashBuf[0])
 
 	return pk, h, nil
@@ -83,7 +85,8 @@ func Encrypt(label string, plaintext []byte) ([]byte, error) {
 		return nil, fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
 	}
 
-	out := C.GoBytes(unsafe.Pointer(&ciphertextBuf[0]), ciphertextLen) //nolint:nlreturn // CGo result extraction
+	//nolint:nlreturn // CGo result extraction
+	out := C.GoBytes(unsafe.Pointer(&ciphertextBuf[0]), ciphertextLen)
 
 	return out, nil
 }
@@ -107,7 +110,8 @@ func Decrypt(label string, ciphertext []byte) ([]byte, error) {
 		return nil, fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
 	}
 
-	out := C.GoBytes(unsafe.Pointer(&plaintextBuf[0]), plaintextLen) //nolint:nlreturn // CGo result extraction
+	//nolint:nlreturn // CGo result extraction
+	out := C.GoBytes(unsafe.Pointer(&plaintextBuf[0]), plaintextLen)
 
 	return out, nil
 }

internal/macse/macse_stub.go

@@ -1,4 +1,4 @@
-//go:build !darwin
+//go:build !darwin || !cgo
 
 // Package macse provides Go bindings for macOS Secure Enclave operations.
 package macse

internal/macse/macse_test.go

@@ -1,5 +1,4 @@
-//go:build darwin
-// +build darwin
+//go:build darwin && cgo
 
 package macse
 
@@ -45,7 +44,8 @@ func TestCreateAndDeleteKey(t *testing.T) {
 
 	// Verify valid uncompressed P-256 public key
 	if len(pubKey) != p256UncompressedKeySize {
-		t.Fatalf("expected public key length %d, got %d", p256UncompressedKeySize, len(pubKey))
+		t.Fatalf("expected public key length %d, got %d",
+			p256UncompressedKeySize, len(pubKey))
 	}
 
 	if pubKey[0] != 0x04 {
@@ -83,7 +83,8 @@ func TestEncryptDecryptRoundTrip(t *testing.T) {
 	}()
 
 	// Test data simulating an age private key
-	plaintext := []byte("AGE-SECRET-KEY-1QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ")
+	plaintext := []byte("AGE-SECRET-KEY-1" +
+		"QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ")
 
 	// Encrypt
 	ciphertext, err := Encrypt(testKeyLabel, plaintext)

internal/secret/atomic.go

@@ -3,7 +3,6 @@ package secret
 import (
 	"errors"
 	"fmt"
-	"os"
 	"path/filepath"
 
 	"github.com/spf13/afero"
@@ -63,12 +62,13 @@ func TempDirFor(fs afero.Fs, target string) (string, error) {
 	return dir, nil
 }
 
-// WriteDir calls write to write the files of the new directory dir into a
-// temporary directory from TempDirFor, which is then renamed to dir, so that
-// neither a failure nor a crash leaves dir half-written; on a failure the
-// temporary directory is removed, and a failure to remove it is returned
-// along with the first. A directory cannot be replaced in one rename, so if
-// dir already exists, WriteDir fails without calling write.
+// WriteDir calls write to write the files of the directory dir. When dir does
+// not exist yet, write writes them into a temporary directory from TempDirFor,
+// which is then renamed to dir, so that neither a failure nor a crash leaves
+// dir half-written; on a failure the temporary directory is removed, and a
+// failure to remove it is returned along with the first. A directory cannot be
+// renamed over one that has files in it, so when dir already exists, write
+// writes into it in place; dir is then never removed.
 func WriteDir(fs afero.Fs, dir string, write func(dir string) error) error {
 	exists, err := afero.Exists(fs, dir)
 	if err != nil {
@@ -76,7 +76,7 @@ func WriteDir(fs afero.Fs, dir string, write func(dir string) error) error {
 	}
 
 	if exists {
-		return fmt.Errorf("failed to create %s: %w", dir, os.ErrExist)
+		return write(dir)
 	}
 
 	// Create the directory the finished one is renamed into

internal/secret/atomic_test.go

@@ -191,22 +191,6 @@ func dirNames(t *testing.T, fs afero.Fs, dir string) []string {
 	return names
 }
 
-// dirFiles returns the contents of the files in dir, by name.
-func dirFiles(t *testing.T, fs afero.Fs, dir string) map[string]string {
-	t.Helper()
-
-	files := map[string]string{}
-
-	for _, name := range dirNames(t, fs, dir) {
-		data, err := afero.ReadFile(fs, filepath.Join(dir, name))
-		require.NoError(t, err)
-
-		files[name] = string(data)
-	}
-
-	return files
-}
-
 // writeLongTermKey gives the test vault under stateDir a new long-term key
 // and returns it.
 func writeLongTermKey(
@@ -682,14 +666,14 @@ func TestPassphraseUnlockerIsWholeOrAbsent(t *testing.T) {
 			vaultDir, err := vlt.GetDirectory()
 			require.NoError(t, err)
 
-			// The vault has no unlocker yet, so any directory in here is
-			// the new one
-			unlockersDir := filepath.Join(vaultDir, "unlockers.d")
+			unlockerDir := filepath.Join(vaultDir, "unlockers.d", "passphrase")
 
 			fs := hookFs{Fs: base, before: func(string, string) error {
-				for _, name := range dirNames(t, base, unlockersDir) {
-					assert.ElementsMatch(t, files,
-						dirNames(t, base, filepath.Join(unlockersDir, name)),
+				exists, err := afero.DirExists(base, unlockerDir)
+				require.NoError(t, err)
+
+				if exists {
+					assert.ElementsMatch(t, files, dirNames(t, base, unlockerDir),
 						"unlocker directory visible before it was complete")
 				}
 
@@ -699,118 +683,14 @@ func TestPassphraseUnlockerIsWholeOrAbsent(t *testing.T) {
 			passphrase := memguard.NewBufferFromBytes([]byte(unlockerPassphrase))
 			defer passphrase.Destroy()
 
-			unlocker, err := vault.NewVault(fs, stateDir, testVaultName).
+			_, err = vault.NewVault(fs, stateDir, testVaultName).
 				CreatePassphraseUnlocker(passphrase)
 			require.NoError(t, err)
-			assert.ElementsMatch(t, files, dirNames(t, base, unlocker.GetDirectory()))
+			assert.ElementsMatch(t, files, dirNames(t, base, unlockerDir))
 		})
 	}
 }
 
-// TestPassphraseUnlockerReplacementKeepsVaultOpen replaces the vault's
-// passphrase unlocker, failing at each change the replacement makes in turn,
-// until an attempt makes all of its changes; each attempt starts from what
-// the one before left. Both at the change that fails, which is where a crash
-// would leave the vault, and after the attempt returns, the vault must open
-// with the passphrase through its current unlocker. Once an attempt
-// succeeds, the vault must have one passphrase unlocker left.
-func TestPassphraseUnlockerReplacementKeepsVaultOpen(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, unlockerPassphrase)
-
-	for _, tfs := range testFilesystems {
-		t.Run(tfs.name, func(t *testing.T) {
-			base, stateDir := tfs.open(t)
-			vlt, err := vault.CreateVault(base, stateDir, testVaultName)
-			require.NoError(t, err)
-
-			ltIdentity, err := vlt.GetOrDeriveLongTermKey()
-			require.NoError(t, err)
-
-			passphrase := memguard.NewBufferFromBytes([]byte(unlockerPassphrase))
-			defer passphrase.Destroy()
-
-			_, err = vlt.CreatePassphraseUnlocker(passphrase)
-			require.NoError(t, err)
-
-			// From here on only the current unlocker opens the vault
-			t.Setenv(secret.EnvMnemonic, "")
-
-			assertOpens := vaultOpensCheck(t, base, stateDir, ltIdentity)
-
-			for failAt := 1; ; failAt++ {
-				changes := 0
-				fs := hookFs{Fs: base, before: func(string, string) error {
-					changes++
-					if changes != failAt {
-						return nil
-					}
-
-					assertOpens()
-
-					return errInjected
-				}}
-
-				replacing := vault.NewVault(fs, stateDir, testVaultName)
-				replacing.Unlock(ltIdentity)
-
-				_, err = replacing.CreatePassphraseUnlocker(passphrase)
-
-				assertOpens()
-
-				if changes < failAt {
-					require.NoError(t, err)
-
-					break
-				}
-
-				require.ErrorIs(t, err, errInjected)
-			}
-
-			unlockers, err := vlt.ListUnlockers()
-			require.NoError(t, err)
-			assert.Len(t, unlockers, 1)
-		})
-	}
-}
-
-// vaultOpensCheck returns a function that checks that the test vault under
-// stateDir opens through its current unlocker, with the test passphrase, to
-// the long-term key ltIdentity. Opening it takes a second, so an unlocker
-// directory it has opened through before is not opened again: it must hold
-// the same files as then.
-func vaultOpensCheck(
-	t *testing.T, fs afero.Fs, stateDir string, ltIdentity *age.X25519Identity,
-) func() {
-	t.Helper()
-
-	vaultDir := filepath.Join(stateDir, "vaults.d", testVaultName)
-
-	// The files of each unlocker directory the vault has opened through
-	opened := map[string]map[string]string{}
-
-	return func() {
-		t.Helper()
-
-		current, err := afero.ReadFile(fs, filepath.Join(vaultDir, "current-unlocker"))
-		require.NoError(t, err)
-
-		files := dirFiles(t, fs, filepath.Join(vaultDir, "unlockers.d", string(current)))
-
-		if before, ok := opened[string(current)]; ok {
-			assert.Equal(t, before, files, "unlocker changed since it opened the vault")
-
-			return
-		}
-
-		key, err := vault.NewVault(fs, stateDir, testVaultName).UnlockVault()
-		require.NoError(t, err)
-		assert.Equal(t, ltIdentity.Recipient().String(), key.Recipient().String())
-
-		opened[string(current)] = files
-	}
-}
-
 // TestWriteDirFailureLeavesNothing makes writing a new directory fail after
 // a file has been written in it, and checks that neither the directory nor
 // its temporary directory is left behind; and, when the temporary directory
@@ -856,10 +736,10 @@ func TestWriteDirFailureLeavesNothing(t *testing.T) {
 	}
 }
 
-// TestWriteDirRefusesExistingDir checks that WriteDir fails, without calling
-// write, when the directory already exists, and leaves the directory as it
-// was: it never writes into a directory in place.
-func TestWriteDirRefusesExistingDir(t *testing.T) {
+// TestWriteDirKeepsExistingDir makes writing into a directory that already
+// exists fail, and checks that the directory, with what was in it, is still
+// there: WriteDir writes into it in place and never removes it.
+func TestWriteDirKeepsExistingDir(t *testing.T) {
 	t.Parallel()
 
 	for _, tfs := range testFilesystems {
@@ -867,17 +747,17 @@ func TestWriteDirRefusesExistingDir(t *testing.T) {
 			t.Parallel()
 
 			fs, dir := tfs.open(t)
-			target := filepath.Join(dir, "unlockers.d", "existing")
+			target := filepath.Join(dir, "unlockers.d", "passphrase")
 			require.NoError(t, fs.MkdirAll(target, secret.DirPerms))
 			require.NoError(t, secret.WriteFileAtomic(fs,
 				filepath.Join(target, unlockerMetadataFile), []byte("{}")))
 
-			err := secret.WriteDir(fs, target, func(string) error {
-				t.Error("write called for a directory that exists")
+			err := secret.WriteDir(fs, target, func(got string) error {
+				assert.Equal(t, target, got)
 
-				return nil
+				return errInjected
 			})
-			require.ErrorIs(t, err, os.ErrExist)
+			require.ErrorIs(t, err, errInjected)
 			assert.Equal(t, []string{unlockerMetadataFile}, dirNames(t, fs, target))
 		})
 	}

internal/secret/constants.go

@@ -16,12 +16,6 @@ const (
 	EnvUnlockPassphrase = "SB_UNLOCK_PASSPHRASE"
 	// EnvGPGKeyID is the environment variable for providing the GPG key ID
 	EnvGPGKeyID = "SB_GPG_KEY_ID"
-
-	// UnlockerTimeFormat is the layout of the time, in UTC, in the name of a
-	// new unlocker's directory, keychain item and Secure Enclave key. It runs
-	// to the nanosecond, so that every new unlocker, even one added right
-	// after another, gets a directory of its own.
-	UnlockerTimeFormat = "2006-01-02.15.04.05.000000000"
 )
 
 // File system permission constants

internal/secret/derivation_index_test.go

@@ -1,4 +1,4 @@
-//go:build darwin
+//go:build darwin && cgo
 
 package secret
 
@@ -8,7 +8,6 @@ import (
 	"testing"
 	"time"
 
-	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
@@ -31,16 +30,25 @@ func (v *realVault) GetName() string         { return v.name }
 func (v *realVault) GetFilesystem() afero.Fs { return v.fs }
 
 // Unused by getLongTermPrivateKey — these satisfy VaultInterface.
-func (v *realVault) AddSecret(string, *memguard.LockedBuffer, bool) error { panic("not used") }
-func (v *realVault) GetCurrentUnlocker() (Unlocker, error)                { panic("not used") }
-func (v *realVault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) { panic("not used") }
-func (v *realVault) CreatePassphraseUnlocker(*memguard.LockedBuffer) (*PassphraseUnlocker, error) {
+func (v *realVault) AddSecret(string, *memguard.LockedBuffer, bool) error {
+	panic("not used")
+}
+
+func (v *realVault) GetCurrentUnlocker() (Unlocker, error) {
+	panic("not used")
+}
+
+func (v *realVault) CreatePassphraseUnlocker(
+	*memguard.LockedBuffer,
+) (*PassphraseUnlocker, error) {
 	panic("not used")
 }
 
 // createRealVault sets up a complete vault directory structure on an in-memory
 // filesystem, identical to what vault.CreateVault produces.
-func createRealVault(t *testing.T, fs afero.Fs, stateDir, name string, derivationIndex uint32) *realVault {
+func createRealVault(
+	t *testing.T, fs afero.Fs, stateDir, name string, derivationIndex uint32,
+) *realVault {
 	t.Helper()
 
 	vaultDir := filepath.Join(stateDir, "vaults.d", name)
@@ -53,13 +61,15 @@ func createRealVault(t *testing.T, fs afero.Fs, stateDir, name string, derivatio
 	}
 	metaBytes, err := json.Marshal(metadata)
 	require.NoError(t, err)
-	require.NoError(t, afero.WriteFile(fs, filepath.Join(vaultDir, "vault-metadata.json"), metaBytes, FilePerms))
+	require.NoError(t, afero.WriteFile(fs,
+		filepath.Join(vaultDir, "vault-metadata.json"), metaBytes, FilePerms))
 
 	return &realVault{name: name, stateDir: stateDir, fs: fs}
 }
 
 func TestGetLongTermPrivateKeyUsesVaultDerivationIndex(t *testing.T) {
-	const testMnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
+	const testMnemonic = "abandon abandon abandon abandon abandon abandon " +
+		"abandon abandon abandon abandon abandon about"
 
 	// Derive expected keys at two different indices to prove they differ.
 	key0, err := agehd.DeriveIdentity(testMnemonic, 0)

internal/secret/keychainunlocker.go

@@ -1,5 +1,4 @@
-//go:build darwin
-// +build darwin
+//go:build darwin && cgo
 
 package secret
 
@@ -11,7 +10,6 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
-	"runtime"
 	"time"
 
 	"filippo.io/age"
@@ -24,7 +22,9 @@ import (
 const (
 	agePrivKeyPassphraseLength = 64
 	// KEYCHAIN_APP_IDENTIFIER is the service name used for keychain items
-	KEYCHAIN_APP_IDENTIFIER = "berlin.sneak.app.secret" //nolint:revive // ALL_CAPS is intentional for this constant
+	//
+	//nolint:revive // ALL_CAPS is intentional for this constant
+	KEYCHAIN_APP_IDENTIFIER = "berlin.sneak.app.secret"
 )
 
 // keychainItemNameRegex validates keychain item names
@@ -64,7 +64,8 @@ func (k *KeychainUnlocker) GetIdentity() (*age.X25519Identity, error) {
 	Debug("Retrieving data from macOS keychain", "keychain_item", keychainItemName)
 	keychainDataBytes, err := retrieveFromKeychain(keychainItemName)
 	if err != nil {
-		Debug("Failed to retrieve data from keychain", "error", err, "keychain_item", keychainItemName)
+		Debug("Failed to retrieve data from keychain",
+			"error", err, "keychain_item", keychainItemName)
 
 		return nil, fmt.Errorf("failed to retrieve data from keychain: %w", err)
 	}
@@ -95,7 +96,8 @@ func (k *KeychainUnlocker) GetIdentity() (*age.X25519Identity, error) {
 
 	encryptedAgePrivKeyData, err := afero.ReadFile(k.fs, agePrivKeyPath)
 	if err != nil {
-		Debug("Failed to read encrypted age private key", "error", err, "path", agePrivKeyPath)
+		Debug("Failed to read encrypted age private key",
+			"error", err, "path", agePrivKeyPath)
 
 		return nil, fmt.Errorf("failed to read encrypted age private key: %w", err)
 	}
@@ -106,12 +108,16 @@ func (k *KeychainUnlocker) GetIdentity() (*age.X25519Identity, error) {
 	)
 
 	// Step 5: Decrypt the age private key using the passphrase from keychain
-	Debug("Decrypting age private key with keychain passphrase", "unlocker_id", k.GetID())
-	agePrivKeyBuffer, err := DecryptWithPassphrase(encryptedAgePrivKeyData, keychainData.AgePrivKeyPassphrase)
+	Debug("Decrypting age private key with keychain passphrase",
+		"unlocker_id", k.GetID())
+	agePrivKeyBuffer, err := DecryptWithPassphrase(
+		encryptedAgePrivKeyData, keychainData.AgePrivKeyPassphrase)
 	if err != nil {
-		Debug("Failed to decrypt age private key with keychain passphrase", "error", err, "unlocker_id", k.GetID())
+		Debug("Failed to decrypt age private key with keychain passphrase",
+			"error", err, "unlocker_id", k.GetID())
 
-		return nil, fmt.Errorf("failed to decrypt age private key with keychain passphrase: %w", err)
+		return nil, fmt.Errorf(
+			"failed to decrypt age private key with keychain passphrase: %w", err)
 	}
 	defer agePrivKeyBuffer.Destroy()
 
@@ -174,7 +180,8 @@ func (k *KeychainUnlocker) Remove() error {
 	// Step 1: Get keychain item name
 	keychainItemName, err := k.GetKeychainItemName()
 	if err != nil {
-		Debug("Failed to get keychain item name during removal", "error", err, "unlocker_id", k.GetID())
+		Debug("Failed to get keychain item name during removal",
+			"error", err, "unlocker_id", k.GetID())
 
 		return fmt.Errorf("failed to get keychain item name: %w", err)
 	}
@@ -182,7 +189,8 @@ func (k *KeychainUnlocker) Remove() error {
 	// Step 2: Remove from keychain
 	Debug("Removing keychain item", "keychain_item", keychainItemName)
 	if err := deleteFromKeychain(keychainItemName); err != nil {
-		Debug("Failed to remove keychain item", "error", err, "keychain_item", keychainItemName)
+		Debug("Failed to remove keychain item",
+			"error", err, "keychain_item", keychainItemName)
 
 		return fmt.Errorf("failed to remove keychain item: %w", err)
 	}
@@ -190,18 +198,22 @@ func (k *KeychainUnlocker) Remove() error {
 	// Step 3: Remove directory
 	Debug("Removing keychain unlocker directory", "directory", k.Directory)
 	if err := RemoveDirAtomic(k.fs, k.Directory); err != nil {
-		Debug("Failed to remove keychain unlocker directory", "error", err, "directory", k.Directory)
+		Debug("Failed to remove keychain unlocker directory",
+			"error", err, "directory", k.Directory)
 
 		return fmt.Errorf("failed to remove keychain unlocker directory: %w", err)
 	}
 
-	Debug("Successfully removed keychain unlocker", "unlocker_id", k.GetID(), "keychain_item", keychainItemName)
+	Debug("Successfully removed keychain unlocker",
+		"unlocker_id", k.GetID(), "keychain_item", keychainItemName)
 
 	return nil
 }
 
 // NewKeychainUnlocker creates a new KeychainUnlocker instance
-func NewKeychainUnlocker(fs afero.Fs, directory string, metadata UnlockerMetadata) *KeychainUnlocker {
+func NewKeychainUnlocker(
+	fs afero.Fs, directory string, metadata UnlockerMetadata,
+) *KeychainUnlocker {
 	return &KeychainUnlocker{
 		Directory: directory,
 		Metadata:  metadata,
@@ -233,15 +245,18 @@ func generateKeychainUnlockerName(vaultName string) (string, error) {
 		return "", fmt.Errorf("failed to get hostname: %w", err)
 	}
 
-	// Format: secret-<vault>-<hostname>-<time>
-	enrollmentTime := time.Now().UTC().Format(UnlockerTimeFormat)
+	// Format: secret-<vault>-<hostname>-<date>
+	enrollmentDate := time.Now().Format("2006-01-02")
 
-	return fmt.Sprintf("secret-%s-%s-%s", vaultName, hostname, enrollmentTime), nil
+	return fmt.Sprintf("secret-%s-%s-%s", vaultName, hostname, enrollmentDate), nil
 }
 
-// getLongTermPrivateKey retrieves the long-term private key either from environment or current unlocker
+// getLongTermPrivateKey retrieves the long-term private key either from
+// environment or current unlocker
 // Returns a LockedBuffer to ensure the private key is protected in memory
-func getLongTermPrivateKey(fs afero.Fs, vault VaultInterface) (*memguard.LockedBuffer, error) {
+func getLongTermPrivateKey(
+	fs afero.Fs, vault VaultInterface,
+) (*memguard.LockedBuffer, error) {
 	// Check if mnemonic is available in environment variable
 	envMnemonic := os.Getenv(EnvMnemonic)
 	if envMnemonic != "" {
@@ -265,7 +280,8 @@ func getLongTermPrivateKey(fs afero.Fs, vault VaultInterface) (*memguard.LockedB
 		// Use mnemonic with the vault's actual derivation index
 		ltIdentity, err := agehd.DeriveIdentity(envMnemonic, metadata.DerivationIndex)
 		if err != nil {
-			return nil, fmt.Errorf("failed to derive long-term key from mnemonic: %w", err)
+			return nil, fmt.Errorf(
+				"failed to derive long-term key from mnemonic: %w", err)
 		}
 
 		// Return the private key in a secure buffer
@@ -289,31 +305,40 @@ func getLongTermPrivateKey(fs afero.Fs, vault VaultInterface) (*memguard.LockedB
 	switch currentUnlocker := currentUnlocker.(type) {
 	case *PassphraseUnlocker:
 		// Read the encrypted long-term private key from passphrase unlocker
-		encryptedLtPrivKey, err = afero.ReadFile(fs, filepath.Join(currentUnlocker.GetDirectory(), "longterm.age"))
+		encryptedLtPrivKey, err = afero.ReadFile(fs,
+			filepath.Join(currentUnlocker.GetDirectory(), "longterm.age"))
 		if err != nil {
-			return nil, fmt.Errorf("failed to read encrypted long-term key from current passphrase unlocker: %w", err)
+			return nil, fmt.Errorf("failed to read encrypted long-term key "+
+				"from current passphrase unlocker: %w", err)
 		}
 
 	case *PGPUnlocker:
 		// Read the encrypted long-term private key from PGP unlocker
-		encryptedLtPrivKey, err = afero.ReadFile(fs, filepath.Join(currentUnlocker.GetDirectory(), "longterm.age"))
+		encryptedLtPrivKey, err = afero.ReadFile(fs,
+			filepath.Join(currentUnlocker.GetDirectory(), "longterm.age"))
 		if err != nil {
-			return nil, fmt.Errorf("failed to read encrypted long-term key from current PGP unlocker: %w", err)
+			return nil, fmt.Errorf("failed to read encrypted long-term key "+
+				"from current PGP unlocker: %w", err)
 		}
 
 	case *KeychainUnlocker:
-		// Read the encrypted long-term private key from another keychain unlocker
-		encryptedLtPrivKey, err = afero.ReadFile(fs, filepath.Join(currentUnlocker.GetDirectory(), "longterm.age"))
+		// Read the encrypted long-term private key from another keychain
+		// unlocker
+		encryptedLtPrivKey, err = afero.ReadFile(fs,
+			filepath.Join(currentUnlocker.GetDirectory(), "longterm.age"))
 		if err != nil {
-			return nil, fmt.Errorf("failed to read encrypted long-term key from current keychain unlocker: %w", err)
+			return nil, fmt.Errorf("failed to read encrypted long-term key "+
+				"from current keychain unlocker: %w", err)
 		}
 
 	default:
-		return nil, fmt.Errorf("unsupported current unlocker type for keychain unlocker creation")
+		return nil, fmt.Errorf(
+			"unsupported current unlocker type for keychain unlocker creation")
 	}
 
 	// Decrypt long-term private key using current unlocker
-	ltPrivKeyBuffer, err := DecryptWithIdentity(encryptedLtPrivKey, currentUnlockerIdentity)
+	ltPrivKeyBuffer, err := DecryptWithIdentity(
+		encryptedLtPrivKey, currentUnlockerIdentity)
 	if err != nil {
 		return nil, fmt.Errorf("failed to decrypt long-term private key: %w", err)
 	}
@@ -370,7 +395,8 @@ func CreateKeychainUnlocker(fs afero.Fs, stateDir string) (*KeychainUnlocker, er
 	agePrivKeyBuffer := memguard.NewBufferFromBytes([]byte(agePrivKeyStr))
 	defer agePrivKeyBuffer.Destroy()
 
-	encryptedAgePrivKey, err := EncryptWithPassphrase(agePrivKeyBuffer, agePrivKeyPassphrase)
+	encryptedAgePrivKey, err := EncryptWithPassphrase(
+		agePrivKeyBuffer, agePrivKeyPassphrase)
 	if err != nil {
 		return nil, fmt.Errorf("failed to encrypt age private key with passphrase: %w", err)
 	}
@@ -383,9 +409,11 @@ func CreateKeychainUnlocker(fs afero.Fs, stateDir string) (*KeychainUnlocker, er
 	defer ltPrivKeyData.Destroy()
 
 	// Step 5: Encrypt long-term private key to the new age unlocker
-	encryptedLtPrivKeyToAge, err := EncryptToRecipient(ltPrivKeyData, ageIdentity.Recipient())
+	encryptedLtPrivKeyToAge, err := EncryptToRecipient(
+		ltPrivKeyData, ageIdentity.Recipient())
 	if err != nil {
-		return nil, fmt.Errorf("failed to encrypt long-term private key to age unlocker: %w", err)
+		return nil, fmt.Errorf(
+			"failed to encrypt long-term private key to age unlocker: %w", err)
 	}
 
 	// Step 6: Prepare keychain data
@@ -456,16 +484,8 @@ func CreateKeychainUnlocker(fs afero.Fs, stateDir string) (*KeychainUnlocker, er
 	}, nil
 }
 
-// checkMacOSAvailable verifies that we're running on macOS
-func checkMacOSAvailable() error {
-	if runtime.GOOS != "darwin" {
-		return fmt.Errorf("keychain unlockers are only supported on macOS, current OS: %s", runtime.GOOS)
-	}
-
-	return nil
-}
-
-// validateKeychainItemName validates that a keychain item name is safe for command execution
+// validateKeychainItemName validates that a keychain item name is safe for
+// command execution
 func validateKeychainItemName(itemName string) error {
 	if itemName == "" {
 		return fmt.Errorf("keychain item name cannot be empty")

internal/secret/keychainunlocker_stub.go

@@ -1,4 +1,4 @@
-//go:build !darwin
+//go:build !darwin || !cgo
 
 package secret
 
@@ -6,6 +6,7 @@ import (
 	"errors"
 
 	"filippo.io/age"
+	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 )
 
@@ -78,3 +79,10 @@ func (k *KeychainUnlocker) Remove() error {
 func CreateKeychainUnlocker(_ afero.Fs, _ string) (*KeychainUnlocker, error) {
 	return nil, errKeychainNotSupported
 }
+
+// getLongTermPrivateKey returns an error on non-Darwin platforms
+func getLongTermPrivateKey(
+	_ afero.Fs, _ VaultInterface,
+) (*memguard.LockedBuffer, error) {
+	return nil, errKeychainNotSupported
+}

internal/secret/keychainunlocker_test.go

@@ -1,5 +1,4 @@
-//go:build darwin
-// +build darwin
+//go:build darwin && cgo
 
 package secret
 
@@ -35,7 +34,8 @@ func TestKeychainStoreRetrieveDelete(t *testing.T) {
 	// Test 2: Retrieve data from keychain
 	retrievedData, err := retrieveFromKeychain(testItemName)
 	require.NoError(t, err, "Failed to retrieve data from keychain")
-	assert.Equal(t, testData, string(retrievedData), "Retrieved data doesn't match stored data")
+	assert.Equal(t, testData, string(retrievedData),
+		"Retrieved data doesn't match stored data")
 
 	// Test 3: Update existing item (store again with different data)
 	newTestData := "updated-test-data-67890"
@@ -48,7 +48,8 @@ func TestKeychainStoreRetrieveDelete(t *testing.T) {
 	// Verify updated data
 	retrievedData, err = retrieveFromKeychain(testItemName)
 	require.NoError(t, err, "Failed to retrieve updated data from keychain")
-	assert.Equal(t, newTestData, string(retrievedData), "Retrieved data doesn't match updated data")
+	assert.Equal(t, newTestData, string(retrievedData),
+		"Retrieved data doesn't match updated data")
 
 	// Test 4: Delete from keychain
 	err = deleteFromKeychain(testItemName)
@@ -93,7 +94,8 @@ func TestKeychainInvalidItemName(t *testing.T) {
 	for _, name := range invalidNames {
 		err := storeInKeychain(name, testData)
 		assert.Error(t, err, "Expected error for invalid name: %s", name)
-		assert.Contains(t, err.Error(), "invalid keychain item name", "Error should mention invalid name for: %s", name)
+		assert.Contains(t, err.Error(), "invalid keychain item name",
+			"Error should mention invalid name for: %s", name)
 	}
 
 	// Test valid names (should not error on validation)
@@ -180,5 +182,6 @@ func TestDeleteNonExistentKeychainItem(t *testing.T) {
 	// This is important for cleaning up unlocker directories when the keychain item
 	// has already been removed (e.g., manually by user, or on a different machine)
 	err := deleteFromKeychain(testItemName)
-	assert.NoError(t, err, "Deleting non-existent keychain item should not return an error")
+	assert.NoError(t, err,
+		"Deleting non-existent keychain item should not return an error")
 }

internal/secret/pgpunlock_test.go

@@ -4,7 +4,9 @@ package secret_test
 
 import (
 	"bytes"
+	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -22,23 +24,24 @@ import (
 	"github.com/spf13/afero"
 )
 
-// Register vault with secret package for testing
-func init() {
-	// Register the vault.GetCurrentVault function with the secret package
-	secret.RegisterGetCurrentVaultFunc(func(fs afero.Fs, stateDir string) (secret.VaultInterface, error) {
-		return vault.GetCurrentVault(fs, stateDir)
-	})
-}
+// pgpUnlockerType is the type of a PGP unlocker.
+const pgpUnlockerType = "pgp"
+
+var errNilDataBuffer = errors.New("data buffer is nil")
 
 // setupNonInteractiveGPG creates a custom GPG environment for testing
 func setupNonInteractiveGPG(t *testing.T, _, passphrase, gnupgHomeDir string) {
+	t.Helper()
+
 	// Create GPG config file for non-interactive operation
 	gpgConfPath := filepath.Join(gnupgHomeDir, "gpg.conf")
 	gpgConfContent := `batch
 no-tty
 pinentry-mode loopback
 `
-	if err := os.WriteFile(gpgConfPath, []byte(gpgConfContent), 0o600); err != nil {
+
+	err := os.WriteFile(gpgConfPath, []byte(gpgConfContent), 0o600)
+	if err != nil {
 		t.Fatalf("Failed to write GPG config file: %v", err)
 	}
 
@@ -47,11 +50,15 @@ pinentry-mode loopback
 	origDecryptFunc := secret.GPGDecryptFunc
 
 	// Set custom GPG functions for this test
-	secret.GPGEncryptFunc = func(data *memguard.LockedBuffer, keyID string) ([]byte, error) {
+	secret.GPGEncryptFunc = func(
+		data *memguard.LockedBuffer, keyID string,
+	) ([]byte, error) {
 		if data == nil {
-			return nil, fmt.Errorf("data buffer is nil")
+			return nil, errNilDataBuffer
 		}
-		cmd := exec.Command("gpg",
+
+		//nolint:gosec // G204: test runs gpg with test-controlled arguments
+		cmd := exec.CommandContext(t.Context(), "gpg",
 			"--homedir", gnupgHomeDir,
 			"--batch",
 			"--yes",
@@ -63,11 +70,13 @@ pinentry-mode loopback
 			"-r", keyID)
 
 		var stdout, stderr bytes.Buffer
+
 		cmd.Stdout = &stdout
 		cmd.Stderr = &stderr
 		cmd.Stdin = bytes.NewReader(data.Bytes())
 
-		if err := cmd.Run(); err != nil {
+		err := cmd.Run()
+		if err != nil {
 			return nil, fmt.Errorf("GPG encryption failed: %w\nStderr: %s", err, stderr.String())
 		}
 
@@ -75,7 +84,8 @@ pinentry-mode loopback
 	}
 
 	secret.GPGDecryptFunc = func(encryptedData []byte) (*memguard.LockedBuffer, error) {
-		cmd := exec.Command("gpg",
+		//nolint:gosec // G204: test runs gpg with test-controlled arguments
+		cmd := exec.CommandContext(t.Context(), "gpg",
 			"--homedir", gnupgHomeDir,
 			"--batch",
 			"--yes",
@@ -85,11 +95,13 @@ pinentry-mode loopback
 			"--decrypt")
 
 		var stdout, stderr bytes.Buffer
+
 		cmd.Stdout = &stdout
 		cmd.Stderr = &stderr
 		cmd.Stdin = bytes.NewReader(encryptedData)
 
-		if err := cmd.Run(); err != nil {
+		err := cmd.Run()
+		if err != nil {
 			return nil, fmt.Errorf("GPG decryption failed: %w\nStderr: %s", err, stderr.String())
 		}
 
@@ -105,20 +117,24 @@ pinentry-mode loopback
 }
 
 // runGPGWithPassphrase executes a GPG command with the specified passphrase
-func runGPGWithPassphrase(gnupgHome, passphrase string, args []string, input io.Reader) ([]byte, error) {
-	cmdArgs := []string{
+func runGPGWithPassphrase(
+	ctx context.Context,
+	gnupgHome, passphrase string, args []string, input io.Reader,
+) ([]byte, error) {
+	cmdArgs := append([]string{
 		"--homedir=" + gnupgHome,
 		"--batch",
 		"--yes",
 		"--pinentry-mode", "loopback",
 		"--passphrase", passphrase,
-	}
-	cmdArgs = append(cmdArgs, args...)
+	}, args...)
 
-	cmd := exec.Command("gpg", cmdArgs...)
+	//nolint:gosec // G204: test runs gpg with test-controlled arguments
+	cmd := exec.CommandContext(ctx, "gpg", cmdArgs...)
 	cmd.Stdin = input
 
 	var stdout, stderr bytes.Buffer
+
 	cmd.Stdout = &stdout
 	cmd.Stderr = &stderr
 
@@ -130,14 +146,96 @@ func runGPGWithPassphrase(gnupgHome, passphrase string, args []string, input io.
 	return stdout.Bytes(), nil
 }
 
+// generateTestGPGKey generates a GPG key protected by passphrase in
+// gnupgHomeDir and returns its key ID and fingerprint.
+func generateTestGPGKey(
+	t *testing.T, tempDir, gnupgHomeDir, passphrase string,
+) (string, string) {
+	t.Helper()
+
+	// Create GPG batch file for key generation
+	batchFile := filepath.Join(tempDir, "gen-key-batch")
+	batchContent := `%echo Generating a test key
+Key-Type: RSA
+Key-Length: 2048
+Name-Real: Test User
+Name-Email: test@example.com
+Expire-Date: 0
+Passphrase: ` + passphrase + `
+%commit
+%echo Key generation completed
+`
+
+	err := os.WriteFile(batchFile, []byte(batchContent), 0o600)
+	if err != nil {
+		t.Fatalf("Failed to write batch file: %v", err)
+	}
+
+	// Generate GPG key with batch mode
+	t.Log("Generating GPG key...")
+
+	_, err = runGPGWithPassphrase(t.Context(), gnupgHomeDir, passphrase,
+		[]string{"--gen-key", batchFile}, nil)
+	if err != nil {
+		t.Fatalf("Failed to generate GPG key: %v", err)
+	}
+
+	t.Log("GPG key generated successfully")
+
+	// Get the key ID and fingerprint
+	output, err := runGPGWithPassphrase(t.Context(), gnupgHomeDir, passphrase,
+		[]string{"--list-secret-keys", "--with-colons", "--fingerprint"}, nil)
+	if err != nil {
+		t.Fatalf("Failed to list GPG keys: %v", err)
+	}
+
+	// Parse output to get key ID and fingerprint
+	var keyID, fingerprint string
+
+	for line := range strings.SplitSeq(string(output), "\n") {
+		if strings.HasPrefix(line, "sec:") {
+			fields := strings.Split(line, ":")
+			if len(fields) >= 5 {
+				keyID = fields[4]
+			}
+		} else if strings.HasPrefix(line, "fpr:") {
+			fields := strings.Split(line, ":")
+			if len(fields) >= 10 && fields[9] != "" {
+				fingerprint = fields[9]
+
+				break
+			}
+		}
+	}
+
+	if keyID == "" {
+		t.Fatalf("Failed to find GPG key ID in output: %s", output)
+	}
+
+	if fingerprint == "" {
+		t.Fatalf("Failed to find GPG fingerprint in output: %s", output)
+	}
+
+	t.Logf("Generated GPG key ID: %s", keyID)
+	t.Logf("Generated GPG fingerprint: %s", fingerprint)
+
+	return keyID, fingerprint
+}
+
+//nolint:paralleltest // t.Setenv forbids parallel subtests
 func TestPGPUnlockerWithRealFS(t *testing.T) {
 	// Check if gpg is available
-	if _, err := exec.LookPath("gpg"); err != nil {
+	_, err := exec.LookPath("gpg")
+	if err != nil {
 		t.Log("GPG not available, PGP unlock key tests may not fully function")
 		// Continue anyway to test what we can
 	}
 
-	// Create a temporary directory for our tests
+	// Create a temporary directory for our tests. Not t.TempDir: its longer
+	// path would put gpg-agent's socket in GNUPGHOME past the 104-byte limit
+	// macOS sets on socket paths.
+	//
+	//nolint:usetesting // see the comment above
 	tempDir, err := os.MkdirTemp("", "secret-pgp-test-")
 	if err != nil {
 		t.Fatalf("Failed to create temp dir: %v", err)
@@ -146,7 +244,9 @@ func TestPGPUnlockerWithRealFS(t *testing.T) {
 
 	// Create a temporary GNUPGHOME
 	gnupgHomeDir := filepath.Join(tempDir, "gnupg")
-	if err := os.MkdirAll(gnupgHomeDir, 0o700); err != nil {
+
+	err = os.MkdirAll(gnupgHomeDir, 0o700)
+	if err != nil {
 		t.Fatalf("Failed to create GNUPGHOME: %v", err)
 	}
 
@@ -159,64 +259,7 @@ func TestPGPUnlockerWithRealFS(t *testing.T) {
 	// Setup non-interactive GPG with custom functions
 	setupNonInteractiveGPG(t, tempDir, testPassphrase, gnupgHomeDir)
 
-	// Create GPG batch file for key generation
-	batchFile := filepath.Join(tempDir, "gen-key-batch")
-	batchContent := `%echo Generating a test key
-Key-Type: RSA
-Key-Length: 2048
-Name-Real: Test User
-Name-Email: test@example.com
-Expire-Date: 0
-Passphrase: ` + testPassphrase + `
-%commit
-%echo Key generation completed
-`
-	if err := os.WriteFile(batchFile, []byte(batchContent), 0o600); err != nil {
-		t.Fatalf("Failed to write batch file: %v", err)
-	}
-
-	// Generate GPG key with batch mode
-	t.Log("Generating GPG key...")
-	_, err = runGPGWithPassphrase(gnupgHomeDir, testPassphrase,
-		[]string{"--gen-key", batchFile}, nil)
-	if err != nil {
-		t.Fatalf("Failed to generate GPG key: %v", err)
-	}
-	t.Log("GPG key generated successfully")
-
-	// Get the key ID and fingerprint
-	output, err := runGPGWithPassphrase(gnupgHomeDir, testPassphrase,
-		[]string{"--list-secret-keys", "--with-colons", "--fingerprint"}, nil)
-	if err != nil {
-		t.Fatalf("Failed to list GPG keys: %v", err)
-	}
-
-	// Parse output to get key ID and fingerprint
-	var keyID, fingerprint string
-	lines := strings.Split(string(output), "\n")
-	for _, line := range lines {
-		if strings.HasPrefix(line, "sec:") {
-			fields := strings.Split(line, ":")
-			if len(fields) >= 5 {
-				keyID = fields[4]
-			}
-		} else if strings.HasPrefix(line, "fpr:") {
-			fields := strings.Split(line, ":")
-			if len(fields) >= 10 && fields[9] != "" {
-				fingerprint = fields[9]
-				break
-			}
-		}
-	}
-
-	if keyID == "" {
-		t.Fatalf("Failed to find GPG key ID in output: %s", output)
-	}
-	if fingerprint == "" {
-		t.Fatalf("Failed to find GPG fingerprint in output: %s", output)
-	}
-	t.Logf("Generated GPG key ID: %s", keyID)
-	t.Logf("Generated GPG fingerprint: %s", fingerprint)
+	keyID, fingerprint := generateTestGPGKey(t, tempDir, gnupgHomeDir, testPassphrase)
 
 	// Set the GPG_AGENT_INFO to empty to ensure gpg-agent doesn't interfere
 	t.Setenv("GPG_AGENT_INFO", "")
@@ -224,9 +267,6 @@ Passphrase: ` + testPassphrase + `
 	// Use the real filesystem
 	fs := afero.NewOsFs()
 
-	// Test data
-	testMnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
-
 	// Set test environment variables
 	t.Setenv(secret.EnvMnemonic, testMnemonic)
 	t.Setenv(secret.EnvGPGKeyID, keyID)
@@ -237,162 +277,20 @@ Passphrase: ` + testPassphrase + `
 
 	// Test creation of a PGP unlock key through a vault
 	t.Run("CreatePGPUnlocker", func(t *testing.T) {
-		// Set a limited test timeout to avoid hanging
-		timer := time.AfterFunc(30*time.Second, func() {
-			t.Fatalf("Test timed out after 30 seconds")
-		})
-		defer timer.Stop()
-
-		// Create a test vault directory structure
-		vlt, err := vault.CreateVault(fs, stateDir, vaultName)
-		if err != nil {
-			t.Fatalf("Failed to create vault: %v", err)
-		}
-
-		// Set the current vault
-		err = vault.SelectVault(fs, stateDir, vaultName)
-		if err != nil {
-			t.Fatalf("Failed to select vault: %v", err)
-		}
-
-		// Derive long-term key from mnemonic
-		ltIdentity, err := agehd.DeriveIdentity(testMnemonic, 0)
-		if err != nil {
-			t.Fatalf("Failed to derive long-term key: %v", err)
-		}
-
-		// Get the vault directory
-		vaultDir, err := vlt.GetDirectory()
-		if err != nil {
-			t.Fatalf("Failed to get vault directory: %v", err)
-		}
-
-		// Write long-term public key
-		ltPubKeyPath := filepath.Join(vaultDir, "pub.age")
-		if err := afero.WriteFile(fs, ltPubKeyPath, []byte(ltIdentity.Recipient().String()), secret.FilePerms); err != nil {
-			t.Fatalf("Failed to write long-term public key: %v", err)
-		}
-
-		// Unlock the vault
-		vlt.Unlock(ltIdentity)
-
-		// Create a passphrase unlocker first (to have current unlocker)
-		passphraseBuffer := memguard.NewBufferFromBytes([]byte("test-passphrase"))
-		defer passphraseBuffer.Destroy()
-		passUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
-		if err != nil {
-			t.Fatalf("Failed to create passphrase unlocker: %v", err)
-		}
-
-		// Verify passphrase unlocker was created
-		if passUnlocker == nil {
-			t.Fatal("Passphrase unlocker is nil")
-		}
-
-		// Now create a PGP unlock key (this will use our custom GPGEncryptFunc)
-		pgpUnlocker, err := secret.CreatePGPUnlocker(fs, stateDir, keyID, fingerprint)
-		if err != nil {
-			t.Fatalf("Failed to create PGP unlock key: %v", err)
-		}
-
-		// Verify the PGP unlock key was created
-		if pgpUnlocker == nil {
-			t.Fatal("PGP unlock key is nil")
-		}
-
-		// Check if the key has the correct type
-		if pgpUnlocker.GetType() != "pgp" {
-			t.Errorf("Expected PGP unlock key type 'pgp', got '%s'", pgpUnlocker.GetType())
-		}
-
-		// Check if the key ID includes the GPG fingerprint
-		if !strings.Contains(pgpUnlocker.GetID(), fingerprint) {
-			t.Errorf("PGP unlock key ID '%s' does not contain GPG fingerprint '%s'", pgpUnlocker.GetID(), fingerprint)
-		}
-
-		// Check if the key directory exists
-		unlockerDir := pgpUnlocker.GetDirectory()
-		keyExists, err := afero.DirExists(fs, unlockerDir)
-		if err != nil {
-			t.Fatalf("Failed to check if PGP key directory exists: %v", err)
-		}
-		if !keyExists {
-			t.Errorf("PGP unlock key directory does not exist: %s", unlockerDir)
-		}
-
-		// Check if required files exist
-		recipientPath := filepath.Join(unlockerDir, "pub.txt")
-		recipientExists, err := afero.Exists(fs, recipientPath)
-		if err != nil {
-			t.Fatalf("Failed to check if recipient file exists: %v", err)
-		}
-		if !recipientExists {
-			t.Errorf("PGP unlock key recipient file does not exist: %s", recipientPath)
-		}
-
-		privKeyPath := filepath.Join(unlockerDir, "priv.age.gpg")
-		privKeyExists, err := afero.Exists(fs, privKeyPath)
-		if err != nil {
-			t.Fatalf("Failed to check if private key file exists: %v", err)
-		}
-		if !privKeyExists {
-			t.Errorf("PGP unlock key private key file does not exist: %s", privKeyPath)
-		}
-
-		metadataPath := filepath.Join(unlockerDir, "unlocker-metadata.json")
-		metadataExists, err := afero.Exists(fs, metadataPath)
-		if err != nil {
-			t.Fatalf("Failed to check if metadata file exists: %v", err)
-		}
-		if !metadataExists {
-			t.Errorf("PGP unlock key metadata file does not exist: %s", metadataPath)
-		}
-
-		longtermPath := filepath.Join(unlockerDir, "longterm.age")
-		longtermExists, err := afero.Exists(fs, longtermPath)
-		if err != nil {
-			t.Fatalf("Failed to check if longterm key file exists: %v", err)
-		}
-		if !longtermExists {
-			t.Errorf("PGP unlock key longterm key file does not exist: %s", longtermPath)
-		}
-
-		// Read and verify metadata
-		metadataBytes, err := afero.ReadFile(fs, metadataPath)
-		if err != nil {
-			t.Fatalf("Failed to read metadata: %v", err)
-		}
-
-		var metadata struct {
-			ID        string    `json:"id"`
-			Type      string    `json:"type"`
-			CreatedAt time.Time `json:"createdAt"`
-			Flags     []string  `json:"flags"`
-			GPGKeyID  string    `json:"gpgKeyId"`
-		}
-
-		if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
-			t.Fatalf("Failed to parse metadata: %v", err)
-		}
-
-		if metadata.Type != "pgp" {
-			t.Errorf("Expected metadata type 'pgp', got '%s'", metadata.Type)
-		}
-
-		if metadata.GPGKeyID != fingerprint {
-			t.Errorf("Expected GPG fingerprint '%s', got '%s'", fingerprint, metadata.GPGKeyID)
-		}
+		testCreatePGPUnlocker(t, fs, stateDir, vaultName, keyID, fingerprint)
 	})
 
 	// Set up key directory for individual tests
 	unlockerDir := filepath.Join(tempDir, "unlocker")
-	if err := os.MkdirAll(unlockerDir, secret.DirPerms); err != nil {
+
+	err = os.MkdirAll(unlockerDir, secret.DirPerms)
+	if err != nil {
 		t.Fatalf("Failed to create unlocker directory: %v", err)
 	}
 
 	// Set up test metadata
 	metadata := secret.UnlockerMetadata{
-		Type:      "pgp",
+		Type:      pgpUnlockerType,
 		CreatedAt: time.Now(),
 		Flags:     []string{"gpg", "encrypted"},
 	}
@@ -402,105 +300,337 @@ Passphrase: ` + testPassphrase + `
 
 	// Test getting GPG key ID
 	t.Run("GetGPGKeyID", func(t *testing.T) {
-		// Create PGP metadata with GPG key ID
-		type PGPUnlockerMetadata struct {
-			secret.UnlockerMetadata
-			GPGKeyID string `json:"gpgKeyId"`
-		}
-
-		pgpMetadata := PGPUnlockerMetadata{
-			UnlockerMetadata: metadata,
-			GPGKeyID:         fingerprint,
-		}
-
-		// Write metadata file
-		metadataPath := filepath.Join(unlockerDir, "unlocker-metadata.json")
-		metadataBytes, err := json.MarshalIndent(pgpMetadata, "", "  ")
-		if err != nil {
-			t.Fatalf("Failed to marshal metadata: %v", err)
-		}
-		if err := afero.WriteFile(fs, metadataPath, metadataBytes, secret.FilePerms); err != nil {
-			t.Fatalf("Failed to write metadata: %v", err)
-		}
-
-		// Get GPG key ID
-		retrievedKeyID, err := unlocker.GetGPGKeyID()
-		if err != nil {
-			t.Fatalf("Failed to get GPG key ID: %v", err)
-		}
-
-		// Verify key ID (should be the fingerprint)
-		if retrievedKeyID != fingerprint {
-			t.Errorf("Expected GPG fingerprint '%s', got '%s'", fingerprint, retrievedKeyID)
-		}
+		testGetGPGKeyID(t, fs, unlocker, unlockerDir, metadata, fingerprint)
 	})
 
 	// Test getting identity from PGP unlocker
 	t.Run("GetIdentity", func(t *testing.T) {
-		// Generate an age identity for testing
-		ageIdentity, err := age.GenerateX25519Identity()
-		if err != nil {
-			t.Fatalf("Failed to generate age identity: %v", err)
-		}
-
-		// Write the recipient
-		recipientPath := filepath.Join(unlockerDir, "pub.txt")
-		if err := afero.WriteFile(fs, recipientPath, []byte(ageIdentity.Recipient().String()), secret.FilePerms); err != nil {
-			t.Fatalf("Failed to write recipient: %v", err)
-		}
-
-		// GPG encrypt the private key using our custom encrypt function
-		privKeyBuffer := memguard.NewBufferFromBytes([]byte(ageIdentity.String()))
-		defer privKeyBuffer.Destroy()
-		encryptedOutput, err := secret.GPGEncryptFunc(privKeyBuffer, keyID)
-		if err != nil {
-			t.Fatalf("Failed to encrypt with GPG: %v", err)
-		}
-
-		// Write the encrypted data to a file
-		encryptedPath := filepath.Join(unlockerDir, "priv.age.gpg")
-		if err := afero.WriteFile(fs, encryptedPath, encryptedOutput, secret.FilePerms); err != nil {
-			t.Fatalf("Failed to write encrypted private key: %v", err)
-		}
-
-		// Now try to get the identity - this will use our custom GPGDecryptFunc
-		identity, err := unlocker.GetIdentity()
-		if err != nil {
-			t.Fatalf("Failed to get identity: %v", err)
-		}
-
-		// Verify the identity matches
-		expectedPubKey := ageIdentity.Recipient().String()
-		actualPubKey := identity.Recipient().String()
-		if actualPubKey != expectedPubKey {
-			t.Errorf("Expected public key '%s', got '%s'", expectedPubKey, actualPubKey)
-		}
+		testPGPUnlockerGetIdentity(t, fs, unlocker, unlockerDir, keyID)
 	})
 
 	// Test removing the unlocker
 	t.Run("RemoveUnlocker", func(t *testing.T) {
-		// Ensure unlocker directory exists before removal
-		keyExists, err := afero.DirExists(fs, unlockerDir)
-		if err != nil {
-			t.Fatalf("Failed to check if unlocker directory exists: %v", err)
-		}
-		if !keyExists {
-			t.Fatalf("Unlocker directory does not exist: %s", unlockerDir)
-		}
-
-		// Remove unlocker
-		err = unlocker.Remove()
-		if err != nil {
-			t.Fatalf("Failed to remove unlocker: %v", err)
-		}
-
-		// Verify directory is gone
-		keyExists, err = afero.DirExists(fs, unlockerDir)
-		if err != nil {
-			t.Fatalf("Failed to check if unlocker directory exists: %v", err)
-		}
-		if keyExists {
-			t.Errorf("Unlocker directory still exists after removal: %s", unlockerDir)
-		}
+		testRemovePGPUnlocker(t, fs, unlocker, unlockerDir)
 	})
 }
+
+// testCreatePGPUnlocker creates a vault with a passphrase unlocker, then a
+// PGP unlocker for the GPG key keyID, and checks the PGP unlocker's files
+// and metadata.
+func testCreatePGPUnlocker(
+	t *testing.T, fs afero.Fs, stateDir, vaultName, keyID, fingerprint string,
+) {
+	t.Helper()
+
+	// Set a limited test timeout to avoid hanging
+	timer := time.AfterFunc(30*time.Second, func() {
+		t.Fatalf("Test timed out after 30 seconds")
+	})
+	defer timer.Stop()
+
+	// Create a test vault directory structure
+	vlt, err := vault.CreateVault(fs, stateDir, vaultName)
+	if err != nil {
+		t.Fatalf("Failed to create vault: %v", err)
+	}
+
+	// Set the current vault
+	err = vault.SelectVault(fs, stateDir, vaultName)
+	if err != nil {
+		t.Fatalf("Failed to select vault: %v", err)
+	}
+
+	// Derive long-term key from mnemonic
+	ltIdentity, err := agehd.DeriveIdentity(testMnemonic, 0)
+	if err != nil {
+		t.Fatalf("Failed to derive long-term key: %v", err)
+	}
+
+	// Get the vault directory
+	vaultDir, err := vlt.GetDirectory()
+	if err != nil {
+		t.Fatalf("Failed to get vault directory: %v", err)
+	}
+
+	// Write long-term public key
+	ltPubKeyPath := filepath.Join(vaultDir, "pub.age")
+
+	err = afero.WriteFile(fs, ltPubKeyPath,
+		[]byte(ltIdentity.Recipient().String()), secret.FilePerms)
+	if err != nil {
+		t.Fatalf("Failed to write long-term public key: %v", err)
+	}
+
+	// Unlock the vault
+	vlt.Unlock(ltIdentity)
+
+	// Create a passphrase unlocker first (to have current unlocker)
+	passphraseBuffer := memguard.NewBufferFromBytes([]byte("test-passphrase"))
+	defer passphraseBuffer.Destroy()
+
+	passUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
+	if err != nil {
+		t.Fatalf("Failed to create passphrase unlocker: %v", err)
+	}
+
+	// Verify passphrase unlocker was created
+	if passUnlocker == nil {
+		t.Fatal("Passphrase unlocker is nil")
+	}
+
+	// Now create a PGP unlock key (this will use our custom GPGEncryptFunc)
+	pgpUnlocker, err := secret.CreatePGPUnlocker(fs, stateDir, keyID, fingerprint)
+	if err != nil {
+		t.Fatalf("Failed to create PGP unlock key: %v", err)
+	}
+
+	// Verify the PGP unlock key was created
+	if pgpUnlocker == nil {
+		t.Fatal("PGP unlock key is nil")
+	}
+
+	// Check if the key has the correct type
+	if pgpUnlocker.GetType() != pgpUnlockerType {
+		t.Errorf("Expected PGP unlock key type 'pgp', got '%s'", pgpUnlocker.GetType())
+	}
+
+	// Check if the key ID includes the GPG fingerprint
+	if !strings.Contains(pgpUnlocker.GetID(), fingerprint) {
+		t.Errorf("PGP unlock key ID '%s' does not contain GPG fingerprint '%s'",
+			pgpUnlocker.GetID(), fingerprint)
+	}
+
+	checkPGPUnlockerFiles(t, fs, pgpUnlocker.GetDirectory())
+	checkPGPUnlockerMetadata(t, fs, pgpUnlocker.GetDirectory(), fingerprint)
+}
+
+// checkPGPUnlockerFiles checks that the PGP unlocker in unlockerDir has all
+// its files.
+func checkPGPUnlockerFiles(t *testing.T, fs afero.Fs, unlockerDir string) {
+	t.Helper()
+
+	// Check if the key directory exists
+	keyExists, err := afero.DirExists(fs, unlockerDir)
+	if err != nil {
+		t.Fatalf("Failed to check if PGP key directory exists: %v", err)
+	}
+
+	if !keyExists {
+		t.Errorf("PGP unlock key directory does not exist: %s", unlockerDir)
+	}
+
+	// Check if required files exist
+	recipientPath := filepath.Join(unlockerDir, "pub.txt")
+
+	recipientExists, err := afero.Exists(fs, recipientPath)
+	if err != nil {
+		t.Fatalf("Failed to check if recipient file exists: %v", err)
+	}
+
+	if !recipientExists {
+		t.Errorf("PGP unlock key recipient file does not exist: %s", recipientPath)
+	}
+
+	privKeyPath := filepath.Join(unlockerDir, "priv.age.gpg")
+
+	privKeyExists, err := afero.Exists(fs, privKeyPath)
+	if err != nil {
+		t.Fatalf("Failed to check if private key file exists: %v", err)
+	}
+
+	if !privKeyExists {
+		t.Errorf("PGP unlock key private key file does not exist: %s", privKeyPath)
+	}
+
+	metadataPath := filepath.Join(unlockerDir, unlockerMetadataFile)
+
+	metadataExists, err := afero.Exists(fs, metadataPath)
+	if err != nil {
+		t.Fatalf("Failed to check if metadata file exists: %v", err)
+	}
+
+	if !metadataExists {
+		t.Errorf("PGP unlock key metadata file does not exist: %s", metadataPath)
+	}
+
+	longtermPath := filepath.Join(unlockerDir, "longterm.age")
+
+	longtermExists, err := afero.Exists(fs, longtermPath)
+	if err != nil {
+		t.Fatalf("Failed to check if longterm key file exists: %v", err)
+	}
+
+	if !longtermExists {
+		t.Errorf("PGP unlock key longterm key file does not exist: %s", longtermPath)
+	}
+}
+
+// checkPGPUnlockerMetadata checks that the metadata of the PGP unlocker in
+// unlockerDir names its type and the GPG key by fingerprint.
+func checkPGPUnlockerMetadata(
+	t *testing.T, fs afero.Fs, unlockerDir, fingerprint string,
+) {
+	t.Helper()
+
+	// Read and verify metadata
+	metadataPath := filepath.Join(unlockerDir, unlockerMetadataFile)
+
+	metadataBytes, err := afero.ReadFile(fs, metadataPath)
+	if err != nil {
+		t.Fatalf("Failed to read metadata: %v", err)
+	}
+
+	var metadata struct {
+		ID        string    `json:"id"`
+		Type      string    `json:"type"`
+		CreatedAt time.Time `json:"createdAt"`
+		Flags     []string  `json:"flags"`
+		GPGKeyID  string    `json:"gpgKeyId"`
+	}
+
+	err = json.Unmarshal(metadataBytes, &metadata)
+	if err != nil {
+		t.Fatalf("Failed to parse metadata: %v", err)
+	}
+
+	if metadata.Type != pgpUnlockerType {
+		t.Errorf("Expected metadata type 'pgp', got '%s'", metadata.Type)
+	}
+
+	if metadata.GPGKeyID != fingerprint {
+		t.Errorf("Expected GPG fingerprint '%s', got '%s'", fingerprint, metadata.GPGKeyID)
+	}
+}
+
+// testGetGPGKeyID writes PGP unlocker metadata holding the GPG fingerprint
+// into unlockerDir and checks that unlocker reads it back.
+func testGetGPGKeyID(
+	t *testing.T, fs afero.Fs, unlocker *secret.PGPUnlocker,
+	unlockerDir string, metadata secret.UnlockerMetadata, fingerprint string,
+) {
+	t.Helper()
+
+	// Create PGP metadata with GPG key ID
+	type PGPUnlockerMetadata struct {
+		secret.UnlockerMetadata
+
+		GPGKeyID string `json:"gpgKeyId"`
+	}
+
+	pgpMetadata := PGPUnlockerMetadata{
+		UnlockerMetadata: metadata,
+		GPGKeyID:         fingerprint,
+	}
+
+	// Write metadata file
+	metadataPath := filepath.Join(unlockerDir, unlockerMetadataFile)
+
+	metadataBytes, err := json.MarshalIndent(pgpMetadata, "", "  ")
+	if err != nil {
+		t.Fatalf("Failed to marshal metadata: %v", err)
+	}
+
+	err = afero.WriteFile(fs, metadataPath, metadataBytes, secret.FilePerms)
+	if err != nil {
+		t.Fatalf("Failed to write metadata: %v", err)
+	}
+
+	// Get GPG key ID
+	retrievedKeyID, err := unlocker.GetGPGKeyID()
+	if err != nil {
+		t.Fatalf("Failed to get GPG key ID: %v", err)
+	}
+
+	// Verify key ID (should be the fingerprint)
+	if retrievedKeyID != fingerprint {
+		t.Errorf("Expected GPG fingerprint '%s', got '%s'", fingerprint, retrievedKeyID)
+	}
+}
+
+// testPGPUnlockerGetIdentity writes an age identity encrypted to the GPG key
+// keyID into unlockerDir and checks that unlocker decrypts it.
+func testPGPUnlockerGetIdentity(
+	t *testing.T, fs afero.Fs, unlocker *secret.PGPUnlocker,
+	unlockerDir, keyID string,
+) {
+	t.Helper()
+
+	// Generate an age identity for testing
+	ageIdentity, err := age.GenerateX25519Identity()
+	if err != nil {
+		t.Fatalf("Failed to generate age identity: %v", err)
+	}
+
+	// Write the recipient
+	recipientPath := filepath.Join(unlockerDir, "pub.txt")
+
+	err = afero.WriteFile(fs, recipientPath,
+		[]byte(ageIdentity.Recipient().String()), secret.FilePerms)
+	if err != nil {
+		t.Fatalf("Failed to write recipient: %v", err)
+	}
+
+	// GPG encrypt the private key using our custom encrypt function
+	privKeyBuffer := memguard.NewBufferFromBytes([]byte(ageIdentity.String()))
+	defer privKeyBuffer.Destroy()
+
+	encryptedOutput, err := secret.GPGEncryptFunc(privKeyBuffer, keyID)
+	if err != nil {
+		t.Fatalf("Failed to encrypt with GPG: %v", err)
+	}
+
+	// Write the encrypted data to a file
+	encryptedPath := filepath.Join(unlockerDir, "priv.age.gpg")
+
+	err = afero.WriteFile(fs, encryptedPath, encryptedOutput, secret.FilePerms)
+	if err != nil {
+		t.Fatalf("Failed to write encrypted private key: %v", err)
+	}
+
+	// Now try to get the identity - this will use our custom GPGDecryptFunc
+	identity, err := unlocker.GetIdentity()
+	if err != nil {
+		t.Fatalf("Failed to get identity: %v", err)
+	}
+
+	// Verify the identity matches
+	expectedPubKey := ageIdentity.Recipient().String()
+	actualPubKey := identity.Recipient().String()
+
+	if actualPubKey != expectedPubKey {
+		t.Errorf("Expected public key '%s', got '%s'", expectedPubKey, actualPubKey)
+	}
+}
+
+// testRemovePGPUnlocker removes unlocker and checks that unlockerDir is gone.
+func testRemovePGPUnlocker(
+	t *testing.T, fs afero.Fs, unlocker *secret.PGPUnlocker, unlockerDir string,
+) {
+	t.Helper()
+
+	// Ensure unlocker directory exists before removal
+	keyExists, err := afero.DirExists(fs, unlockerDir)
+	if err != nil {
+		t.Fatalf("Failed to check if unlocker directory exists: %v", err)
+	}
+
+	if !keyExists {
+		t.Fatalf("Unlocker directory does not exist: %s", unlockerDir)
+	}
+
+	// Remove unlocker
+	err = unlocker.Remove()
+	if err != nil {
+		t.Fatalf("Failed to remove unlocker: %v", err)
+	}
+
+	// Verify directory is gone
+	keyExists, err = afero.DirExists(fs, unlockerDir)
+	if err != nil {
+		t.Fatalf("Failed to check if unlocker directory exists: %v", err)
+	}
+
+	if keyExists {
+		t.Errorf("Unlocker directory still exists after removal: %s", unlockerDir)
+	}
+}

internal/secret/pgpunlocker.go

@@ -209,20 +209,21 @@ func (p *PGPUnlocker) GetGPGKeyID() (string, error) {
 }
 
 // generatePGPUnlockerName generates a unique name for the PGP unlocker
-// based on hostname and time
+// based on hostname and date
 func generatePGPUnlockerName() (string, error) {
 	hostname, err := os.Hostname()
 	if err != nil {
 		return "", fmt.Errorf("failed to get hostname: %w", err)
 	}
 
-	enrollmentTime := time.Now().UTC().Format(UnlockerTimeFormat)
+	// Format: hostname-pgp-YYYY-MM-DD
+	enrollmentDate := time.Now().Format("2006-01-02")
 
-	return fmt.Sprintf("%s-pgp-%s", hostname, enrollmentTime), nil
+	return fmt.Sprintf("%s-pgp-%s", hostname, enrollmentDate), nil
 }
 
 // pgpUnlockerDir returns the current vault and the directory in it for a
-// new PGP unlocker, named after the host and the time.
+// new PGP unlocker, named after the host and the day.
 //
 //nolint:ireturn // the vault is only available behind VaultInterface
 func pgpUnlockerDir(
@@ -276,7 +277,7 @@ func CreatePGPUnlocker(
 	// Step 2: Encrypt the long-term private key to the new keypair, and the
 	// keypair's private key to the GPG key
 	encryptedLtPrivKey, encryptedAgePrivKey, err := encryptPGPUnlockerKeys(
-		vault, ageIdentity, gpgKeyID)
+		fs, vault, ageIdentity, gpgKeyID)
 	if err != nil {
 		return nil, err
 	}
@@ -315,15 +316,14 @@ func CreatePGPUnlocker(
 // to the new PGP unlocker's age keypair, and that keypair's private key
 // encrypted to the GPG key gpgKeyID.
 func encryptPGPUnlockerKeys(
-	vault VaultInterface, ageIdentity *age.X25519Identity, gpgKeyID string,
+	fs afero.Fs, vault VaultInterface,
+	ageIdentity *age.X25519Identity, gpgKeyID string,
 ) ([]byte, []byte, error) {
-	// From the mnemonic or the current unlocker, as for a passphrase unlocker
-	ltIdentity, err := vault.GetOrDeriveLongTermKey()
+	// Get or derive the long-term private key
+	ltPrivKeyData, err := getLongTermPrivateKey(fs, vault)
 	if err != nil {
-		return nil, nil, fmt.Errorf("failed to get long-term key: %w", err)
+		return nil, nil, err
 	}
-
-	ltPrivKeyData := memguard.NewBufferFromBytes([]byte(ltIdentity.String()))
 	defer ltPrivKeyData.Destroy()
 
 	encryptedLtPrivKey, err := EncryptToRecipient(

internal/secret/pgpunlocker_test.go

@@ -7,7 +7,6 @@ import (
 
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
-	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -41,7 +40,9 @@ func installFakeGPG(t *testing.T) {
 // TestCreatePGPUnlockerFailureWritesNothing makes CreatePGPUnlocker fail at
 // getting the vault's long-term key, which used to come after part of the
 // unlocker was written, and asserts that nothing is written. Getting the key
-// fails because there is no mnemonic and no current unlocker.
+// fails because on macOS there is no mnemonic and no current unlocker, and
+// on every other platform it always fails
+// (https://git.eeqj.de/sneak/secret/issues/88).
 func TestCreatePGPUnlockerFailureWritesNothing(t *testing.T) {
 	installFakeGPG(t)
 	t.Setenv(secret.EnvMnemonic, "")
@@ -64,38 +65,3 @@ func TestCreatePGPUnlockerFailureWritesNothing(t *testing.T) {
 	require.NoError(t, err)
 	assert.Empty(t, dirNames(t, base, filepath.Join(vaultDir, "unlockers.d")))
 }
-
-// TestPGPUnlockerAddedTwiceKeepsFirst adds two PGP unlockers one right after
-// the other, so on the same host and day, and checks that the second gets a
-// directory of its own and leaves the first one's files as they were.
-// CreatePGPUnlocker does not check whether the GPG key already has an
-// unlocker, so the test key serves for both.
-func TestPGPUnlockerAddedTwiceKeepsFirst(t *testing.T) {
-	installFakeGPG(t)
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-
-	original := secret.GPGEncryptFunc
-
-	t.Cleanup(func() { secret.GPGEncryptFunc = original })
-
-	// Stands in for gpg, which the test does not have: "encrypts" by copying
-	secret.GPGEncryptFunc = func(data *memguard.LockedBuffer, _ string) ([]byte, error) {
-		return []byte(data.String()), nil
-	}
-
-	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testVaultStateDir, testVaultName)
-	require.NoError(t, err)
-
-	first, err := secret.CreatePGPUnlocker(
-		fs, testVaultStateDir, testGPGKeyID, testGPGFingerprint)
-	require.NoError(t, err)
-
-	firstFiles := dirFiles(t, fs, first.GetDirectory())
-
-	second, err := secret.CreatePGPUnlocker(
-		fs, testVaultStateDir, testGPGKeyID, testGPGFingerprint)
-	require.NoError(t, err)
-	assert.NotEqual(t, first.GetDirectory(), second.GetDirectory())
-	assert.Equal(t, firstFiles, dirFiles(t, fs, first.GetDirectory()))
-}

internal/secret/secret.go

@@ -35,7 +35,6 @@ type VaultInterface interface {
 	GetName() string
 	GetFilesystem() afero.Fs
 	GetCurrentUnlocker() (Unlocker, error)
-	GetOrDeriveLongTermKey() (*age.X25519Identity, error)
 	CreatePassphraseUnlocker(
 		passphrase *memguard.LockedBuffer) (*PassphraseUnlocker, error)
 }

internal/secret/secret_test.go

@@ -107,10 +107,6 @@ func (m *MockVault) GetCurrentUnlocker() (Unlocker, error) {
 	return nil, errNotImplementedInMock
 }
 
-func (m *MockVault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
-	return nil, errNotImplementedInMock
-}
-
 func (m *MockVault) CreatePassphraseUnlocker(
 	_ *memguard.LockedBuffer,
 ) (*PassphraseUnlocker, error) {

internal/secret/seunlocker_darwin.go

@@ -1,14 +1,15 @@
 //go:build darwin
-// +build darwin
 
 package secret
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"os"
 	"path/filepath"
+	"runtime"
 	"time"
 
 	"filippo.io/age"
@@ -29,9 +30,12 @@ const (
 	seLongtermFilename = "longterm.age.se"
 )
 
+var errNotMacOS = errors.New("keychain unlockers are only supported on macOS")
+
 // SecureEnclaveUnlockerMetadata extends UnlockerMetadata with SE-specific data.
 type SecureEnclaveUnlockerMetadata struct {
 	UnlockerMetadata
+
 	SEKeyLabel string `json:"seKeyLabel"`
 	SEKeyHash  string `json:"seKeyHash"`
 }
@@ -43,6 +47,19 @@ type SecureEnclaveUnlocker struct {
 	fs        afero.Fs
 }
 
+// NewSecureEnclaveUnlocker creates a new SecureEnclaveUnlocker instance.
+func NewSecureEnclaveUnlocker(
+	fs afero.Fs,
+	directory string,
+	metadata UnlockerMetadata,
+) *SecureEnclaveUnlocker {
+	return &SecureEnclaveUnlocker{
+		Directory: directory,
+		Metadata:  metadata,
+		fs:        fs,
+	}
+}
+
 // GetIdentity implements Unlocker interface for SE-based unlockers.
 // Decrypts the vault's long-term private key directly using the Secure Enclave.
 func (s *SecureEnclaveUnlocker) GetIdentity() (*age.X25519Identity, error) {
@@ -58,6 +75,7 @@ func (s *SecureEnclaveUnlocker) GetIdentity() (*age.X25519Identity, error) {
 
 	// Read ECIES-encrypted long-term private key from disk
 	encryptedPath := filepath.Join(s.Directory, seLongtermFilename)
+
 	encryptedData, err := afero.ReadFile(s.fs, encryptedPath)
 	if err != nil {
 		return nil, fmt.Errorf(
@@ -140,7 +158,9 @@ func (s *SecureEnclaveUnlocker) Remove() error {
 
 	if seKeyHash != "" {
 		Debug("Deleting SE key", "hash", seKeyHash)
-		if err := macse.DeleteKey(seKeyHash); err != nil {
+
+		err = macse.DeleteKey(seKeyHash)
+		if err != nil {
 			Debug("Failed to delete SE key", "error", err, "hash", seKeyHash)
 
 			return fmt.Errorf("failed to delete SE key: %w", err)
@@ -148,7 +168,9 @@ func (s *SecureEnclaveUnlocker) Remove() error {
 	}
 
 	Debug("Removing SE unlocker directory", "directory", s.Directory)
-	if err := RemoveDirAtomic(s.fs, s.Directory); err != nil {
+
+	err = RemoveDirAtomic(s.fs, s.Directory)
+	if err != nil {
 		return fmt.Errorf("failed to remove SE unlocker directory: %w", err)
 	}
 
@@ -158,34 +180,24 @@ func (s *SecureEnclaveUnlocker) Remove() error {
 }
 
 // getSEKeyInfo reads the SE key label and hash from metadata.
-func (s *SecureEnclaveUnlocker) getSEKeyInfo() (label string, hash string, err error) {
+func (s *SecureEnclaveUnlocker) getSEKeyInfo() (string, string, error) {
 	metadataPath := filepath.Join(s.Directory, "unlocker-metadata.json")
+
 	metadataData, err := afero.ReadFile(s.fs, metadataPath)
 	if err != nil {
 		return "", "", fmt.Errorf("failed to read SE metadata: %w", err)
 	}
 
 	var seMetadata SecureEnclaveUnlockerMetadata
-	if err := json.Unmarshal(metadataData, &seMetadata); err != nil {
+
+	err = json.Unmarshal(metadataData, &seMetadata)
+	if err != nil {
 		return "", "", fmt.Errorf("failed to parse SE metadata: %w", err)
 	}
 
 	return seMetadata.SEKeyLabel, seMetadata.SEKeyHash, nil
 }
 
-// NewSecureEnclaveUnlocker creates a new SecureEnclaveUnlocker instance.
-func NewSecureEnclaveUnlocker(
-	fs afero.Fs,
-	directory string,
-	metadata UnlockerMetadata,
-) *SecureEnclaveUnlocker {
-	return &SecureEnclaveUnlocker{
-		Directory: directory,
-		Metadata:  metadata,
-		fs:        fs,
-	}
-}
-
 // generateSEKeyLabel generates a unique label for the SE CTK identity.
 func generateSEKeyLabel(vaultName string) (string, error) {
 	hostname, err := os.Hostname()
@@ -193,17 +205,27 @@ func generateSEKeyLabel(vaultName string) (string, error) {
 		return "", fmt.Errorf("failed to get hostname: %w", err)
 	}
 
-	enrollmentTime := time.Now().UTC().Format(UnlockerTimeFormat)
+	enrollmentDate := time.Now().UTC().Format("2006-01-02")
 
 	return fmt.Sprintf(
 		"%s.%s-%s-%s",
 		seKeyLabelPrefix,
 		vaultName,
 		hostname,
-		enrollmentTime,
+		enrollmentDate,
 	), nil
 }
 
+// checkMacOSAvailable verifies that we're running on macOS. The keychain
+// unlocker uses it too.
+func checkMacOSAvailable() error {
+	if runtime.GOOS != "darwin" {
+		return fmt.Errorf("%w, current OS: %s", errNotMacOS, runtime.GOOS)
+	}
+
+	return nil
+}
+
 // CreateSecureEnclaveUnlocker creates a new SE unlocker.
 // The vault's long-term private key is encrypted directly by the Secure Enclave
 // using ECIES. No intermediate age keypair is used.
@@ -211,7 +233,8 @@ func CreateSecureEnclaveUnlocker(
 	fs afero.Fs,
 	stateDir string,
 ) (*SecureEnclaveUnlocker, error) {
-	if err := checkMacOSAvailable(); err != nil {
+	err := checkMacOSAvailable()
+	if err != nil {
 		return nil, err
 	}
 
@@ -228,6 +251,7 @@ func CreateSecureEnclaveUnlocker(
 
 	// Step 1: Create P-256 key in the Secure Enclave via sc_auth
 	Debug("Creating Secure Enclave key", "label", seKeyLabel)
+
 	_, seKeyHash, err := macse.CreateKey(seKeyLabel)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create SE key: %w", err)
@@ -260,7 +284,7 @@ func CreateSecureEnclaveUnlocker(
 		return nil, fmt.Errorf("failed to get vault directory: %w", err)
 	}
 
-	unlockerDirName := fmt.Sprintf("se-%s", filepath.Base(seKeyLabel))
+	unlockerDirName := "se-" + filepath.Base(seKeyLabel)
 	unlockerDir := filepath.Join(vaultDir, "unlockers.d", unlockerDirName)
 
 	seMetadata := SecureEnclaveUnlockerMetadata{
@@ -280,20 +304,7 @@ func CreateSecureEnclaveUnlocker(
 
 	// Step 5: Write the SE-encrypted long-term key, then the metadata
 	err = WriteDir(fs, unlockerDir, func(dir string) error {
-		ltKeyPath := filepath.Join(dir, seLongtermFilename)
-		if err := WriteFileAtomic(fs, ltKeyPath, encryptedLtKey); err != nil {
-			return fmt.Errorf(
-				"failed to write SE-encrypted long-term key: %w",
-				err,
-			)
-		}
-
-		metadataPath := filepath.Join(dir, "unlocker-metadata.json")
-		if err := WriteFileAtomic(fs, metadataPath, metadataBytes); err != nil {
-			return fmt.Errorf("failed to write metadata: %w", err)
-		}
-
-		return nil
+		return writeSEUnlockerFiles(fs, dir, encryptedLtKey, metadataBytes)
 	})
 	if err != nil {
 		return nil, err
@@ -306,6 +317,29 @@ func CreateSecureEnclaveUnlocker(
 	}, nil
 }
 
+// writeSEUnlockerFiles writes the files of a new SE unlocker into dir: the
+// SE-encrypted long-term key, then the metadata.
+func writeSEUnlockerFiles(
+	fs afero.Fs, dir string, encryptedLtKey, metadataBytes []byte,
+) error {
+	err := WriteFileAtomic(fs, filepath.Join(dir, seLongtermFilename),
+		encryptedLtKey)
+	if err != nil {
+		return fmt.Errorf(
+			"failed to write SE-encrypted long-term key: %w",
+			err,
+		)
+	}
+
+	err = WriteFileAtomic(fs,
+		filepath.Join(dir, "unlocker-metadata.json"), metadataBytes)
+	if err != nil {
+		return fmt.Errorf("failed to write metadata: %w", err)
+	}
+
+	return nil
+}
+
 // getLongTermKeyForSE retrieves the vault's long-term private key
 // either from the mnemonic env var or by unlocking via the current unlocker.
 func getLongTermKeyForSE(
@@ -321,13 +355,16 @@ func getLongTermKeyForSE(
 		}
 
 		metadataPath := filepath.Join(vaultDir, "vault-metadata.json")
+
 		metadataBytes, err := afero.ReadFile(fs, metadataPath)
 		if err != nil {
 			return nil, fmt.Errorf("failed to read vault metadata: %w", err)
 		}
 
 		var metadata VaultMetadata
-		if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
+
+		err = json.Unmarshal(metadataBytes, &metadata)
+		if err != nil {
 			return nil, fmt.Errorf("failed to parse vault metadata: %w", err)
 		}
 
@@ -336,7 +373,6 @@ func getLongTermKeyForSE(
 			envMnemonic,
 			metadata.DerivationIndex,
 		)
-
 		if err != nil {
 			return nil, fmt.Errorf(
 				"failed to derive long-term key from mnemonic: %w",
@@ -365,6 +401,7 @@ func getLongTermKeyForSE(
 		currentUnlocker.GetDirectory(),
 		"longterm.age",
 	)
+
 	encryptedLtKey, err := afero.ReadFile(fs, longtermPath)
 	if err != nil {
 		return nil, fmt.Errorf(

internal/secret/seunlocker_test.go

@@ -1,6 +1,6 @@
 //go:build darwin
-// +build darwin
 
+//nolint:testpackage // white-box test of unexported Secure Enclave helpers
 package secret
 
 import (
@@ -13,12 +13,14 @@ import (
 )
 
 func TestNewSecureEnclaveUnlocker(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	dir := "/tmp/test-se-unlocker"
 	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
+		Type:      seUnlockerType,
 		CreatedAt: time.Date(2026, 1, 15, 10, 30, 0, 0, time.UTC),
-		Flags:     []string{"secure-enclave", "macos"},
+		Flags:     []string{seUnlockerType, "macos"},
 	}
 
 	unlocker := NewSecureEnclaveUnlocker(fs, dir, metadata)
@@ -35,9 +37,11 @@ func TestNewSecureEnclaveUnlocker(t *testing.T) {
 }
 
 func TestSecureEnclaveUnlockerImplementsInterface(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
+		Type:      seUnlockerType,
 		CreatedAt: time.Now().UTC(),
 	}
 
@@ -48,9 +52,11 @@ func TestSecureEnclaveUnlockerImplementsInterface(t *testing.T) {
 }
 
 func TestSecureEnclaveUnlockerGetIDFormat(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
+		Type:      seUnlockerType,
 		CreatedAt: time.Date(2026, 3, 10, 14, 30, 0, 0, time.UTC),
 	}
 
@@ -63,6 +69,8 @@ func TestSecureEnclaveUnlockerGetIDFormat(t *testing.T) {
 }
 
 func TestGenerateSEKeyLabel(t *testing.T) {
+	t.Parallel()
+
 	label, err := generateSEKeyLabel("test-vault")
 	require.NoError(t, err)
 
@@ -72,6 +80,8 @@ func TestGenerateSEKeyLabel(t *testing.T) {
 }
 
 func TestSecureEnclaveUnlockerGetIdentityMissingFile(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	dir := "/tmp/test-se-unlocker-missing"
 
@@ -84,10 +94,12 @@ func TestSecureEnclaveUnlockerGetIdentityMissingFile(t *testing.T) {
 		"seKeyLabel": "berlin.sneak.app.secret.se.test",
 		"seKeyHash": "abc123"
 	}`
-	require.NoError(t, afero.WriteFile(fs, dir+"/unlocker-metadata.json", []byte(metadataJSON), FilePerms))
+	require.NoError(t, afero.WriteFile(
+		fs, dir+"/unlocker-metadata.json", []byte(metadataJSON), FilePerms,
+	))
 
 	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
+		Type:      seUnlockerType,
 		CreatedAt: time.Date(2026, 1, 15, 10, 30, 0, 0, time.UTC),
 	}
 
@@ -96,6 +108,6 @@ func TestSecureEnclaveUnlockerGetIdentityMissingFile(t *testing.T) {
 	// GetIdentity should fail because the encrypted longterm key file is missing
 	identity, err := unlocker.GetIdentity()
 	assert.Nil(t, identity)
-	assert.Error(t, err)
+	require.Error(t, err)
 	assert.Contains(t, err.Error(), "failed to read SE-encrypted long-term key")
 }

internal/secret/validation_darwin_test.go

@@ -1,4 +1,4 @@
-//go:build darwin
+//go:build darwin && cgo
 
 package secret
 

internal/secret/version_test.go

@@ -87,10 +87,6 @@ func (m *MockVersionVault) GetCurrentUnlocker() (secret.Unlocker, error) {
 	return nil, errNotImplementedInMock
 }
 
-func (m *MockVersionVault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
-	return nil, errNotImplementedInMock
-}
-
 func (m *MockVersionVault) CreatePassphraseUnlocker(
 	_ *memguard.LockedBuffer,
 ) (*secret.PassphraseUnlocker, error) {

internal/vault/unlockers.go

@@ -2,10 +2,8 @@ package vault
 
 import (
 	"encoding/json"
-	"errors"
 	"fmt"
 	"log/slog"
-	"os"
 	"path/filepath"
 	"strings"
 	"time"
@@ -103,7 +101,7 @@ func (v *Vault) GetCurrentUnlocker() (secret.Unlocker, error) {
 
 // resolveUnlockerDirectory reads the current-unlocker file to get the
 // unlocker directory path
-// The file contains just the name of the unlocker's directory in unlockers.d
+// The file contains just the unlocker name (e.g., "passphrase")
 func (v *Vault) resolveUnlockerDirectory(currentUnlockerPath string) (string, error) {
 	secret.Debug("Reading current-unlocker file", "path", currentUnlockerPath)
 
@@ -341,10 +339,7 @@ func (v *Vault) SelectUnlocker(unlockerID string) error {
 	return nil
 }
 
-// CreatePassphraseUnlocker creates a new passphrase-protected unlocker in a
-// directory of its own, makes it the current unlocker, and only then removes
-// the vault's other passphrase unlockers: a vault keeps one. A crash at any
-// point leaves a complete current unlocker, the old one or the new.
+// CreatePassphraseUnlocker creates a new passphrase-protected unlocker
 // The passphrase must be provided as a LockedBuffer for security
 func (v *Vault) CreatePassphraseUnlocker(
 	passphrase *memguard.LockedBuffer,
@@ -356,23 +351,13 @@ func (v *Vault) CreatePassphraseUnlocker(
 
 	// We need to get the long-term key (either from memory if unlocked, or
 	// derive it). Getting it before anything is written means failing to
-	// get it changes nothing.
+	// get it changes nothing, even when replacing the current unlocker.
 	ltIdentity, err := v.GetOrDeriveLongTermKey()
 	if err != nil {
 		return nil, fmt.Errorf("failed to get long-term key: %w", err)
 	}
 
-	unlockersDir := filepath.Join(vaultDir, "unlockers.d")
-
-	// The passphrase unlockers the new one replaces
-	oldDirs, err := v.passphraseUnlockerDirs(unlockersDir)
-	if err != nil {
-		return nil, err
-	}
-
-	createdAt := time.Now()
-	unlockerDir := filepath.Join(unlockersDir, unlockerTypePassphrase+"-"+
-		createdAt.UTC().Format(secret.UnlockerTimeFormat))
+	unlockerDir := filepath.Join(vaultDir, "unlockers.d", unlockerTypePassphrase)
 
 	// Generate new age keypair for unlocker
 	unlockerIdentity, err := age.GenerateX25519Identity()
@@ -392,7 +377,7 @@ func (v *Vault) CreatePassphraseUnlocker(
 
 	metadata := UnlockerMetadata{
 		Type:      unlockerTypePassphrase,
-		CreatedAt: createdAt,
+		CreatedAt: time.Now(),
 		Flags:     []string{},
 	}
 
@@ -410,54 +395,16 @@ func (v *Vault) CreatePassphraseUnlocker(
 		return nil, err
 	}
 
-	// Select the new unlocker by its directory, not by its ID: an old
-	// passphrase unlocker created in the same minute has the same ID.
-	currentUnlockerPath := filepath.Join(vaultDir, "current-unlocker")
+	// Create the unlocker instance
+	unlocker := secret.NewPassphraseUnlocker(v.fs, unlockerDir, metadata)
 
-	err = secret.WriteFileAtomic(v.fs, currentUnlockerPath,
-		[]byte(filepath.Base(unlockerDir)))
+	// Select this unlocker as current
+	err = v.SelectUnlocker(unlocker.GetID())
 	if err != nil {
 		return nil, fmt.Errorf("failed to select new unlocker: %w", err)
 	}
 
-	for _, oldDir := range oldDirs {
-		err = secret.RemoveDirAtomic(v.fs, oldDir)
-		if err != nil {
-			return nil, fmt.Errorf(
-				"created and selected the new passphrase unlocker: %w", err)
-		}
-	}
-
-	return secret.NewPassphraseUnlocker(v.fs, unlockerDir, metadata), nil
-}
-
-// passphraseUnlockerDirs returns the directories in unlockersDir that hold
-// passphrase unlockers. A directory ListUnlockers skips is left out, with the
-// same warning.
-func (v *Vault) passphraseUnlockerDirs(unlockersDir string) ([]string, error) {
-	files, err := afero.ReadDir(v.fs, unlockersDir)
-	if errors.Is(err, os.ErrNotExist) {
-		return nil, nil
-	}
-
-	if err != nil {
-		return nil, fmt.Errorf("failed to read unlockers directory: %w", err)
-	}
-
-	var dirs []string
-
-	for _, file := range files {
-		if !file.IsDir() {
-			continue
-		}
-
-		metadata, ok := v.readUnlockerMetadataOrWarn(unlockersDir, file.Name())
-		if ok && metadata.Type == unlockerTypePassphrase {
-			dirs = append(dirs, filepath.Join(unlockersDir, file.Name()))
-		}
-	}
-
-	return dirs, nil
+	return unlocker, nil
 }
 
 // readUnlockerMetadata reads and parses the unlocker-metadata.json file in

script/check

@@ -1,7 +1,6 @@
 #!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
-# Generic: usually needs no adaptation.
+# script/check: run all checks (test, lint, lint-darwin, fmt-check). Our
+# own extension to scripts-to-rule-them-all. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -9,6 +8,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 main() {
     "$SCRIPT_DIR/test"
     "$SCRIPT_DIR/lint"
+    "$SCRIPT_DIR/lint-darwin"
     "$SCRIPT_DIR/fmt-check"
 }
 

script/lint-darwin

@@ -0,0 +1,25 @@
+#!/bin/sh
+# script/lint-darwin: type-check (go vet) and lint the code as a macOS
+# build compiles it, from Linux, in docker only. CI runs on Linux, which
+# never compiles the files built only for macOS. Builds the lint-darwin
+# stage of Dockerfile.lint, rebuilt on every run as script/lint does.
+#
+# Cgo is off: compiling cgo code for macOS needs Apple's SDK headers. That
+# leaves out the files built only with cgo on macOS: the keychain unlocker
+# (keychainunlocker.go and its tests) and the Secure Enclave bindings
+# (internal/macse). Nothing on Linux checks those.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build \
+        --progress=plain \
+        --target lint-darwin \
+        --no-cache-filter=lint-darwin \
+        --output=type=cacheonly \
+        -f Dockerfile.lint .
+}
+
+main "$@"