> The Mac platform specific stuff is just research. It's not to be included in the build or the release. It turns out that you can't make anything that touches the secure enclave or the keychain without Mac OS signing and entitlements, which we don't have right now.
Reading taken: the keychain and Secure Enclave unlockers leave next entirely, code and documents both. The research is not lost: the last commit that has it is ef0ae90, tagged v1.0.0-rc1. secret itself still builds and runs on macOS with the passphrase and PGP unlockers.
Definition of done
secret unlocker add takes only passphrase and pgp; keychain and secure-enclave fail as unknown types (a test shows it), and neither --help nor shell completion offers them.
The code that only serves those two unlockers is gone: internal/macse, internal/secret/keychain*.go, internal/secret/seunlocker_*.go and their tests, and the branches for those types in internal/vault and internal/cli. github.com/keybase/go-keychain leaves go.mod and go.sum.
README.md and the Dockerfile comments no longer mention them (unlocker types, key management, hardware integration, cross-platform support, examples, features, the script/lint description). TODO.md gets one Completed Steps entry naming v1.0.0-rc1 as where the research is; older entries stay as they are.
Nothing else changes: passphrase and PGP unlockers, derived keys and stored files work as before, and the macOS lint pass still compiles. pkg/bip85's use of the word "keychain" is about key derivation and stays.
Model: opus-5-5
sneak, on https://git.eeqj.de/sneak/secret/pulls/59 (2026-10-13):
> The Mac platform specific stuff is just research. It's not to be included in the build or the release. It turns out that you can't make anything that touches the secure enclave or the keychain without Mac OS signing and entitlements, which we don't have right now.
Reading taken: the keychain and Secure Enclave unlockers leave `next` entirely, code and documents both. The research is not lost: the last commit that has it is `ef0ae90`, tagged `v1.0.0-rc1`. `secret` itself still builds and runs on macOS with the passphrase and PGP unlockers.
**Definition of done**
- `secret unlocker add` takes only `passphrase` and `pgp`; `keychain` and `secure-enclave` fail as unknown types (a test shows it), and neither `--help` nor shell completion offers them.
- The code that only serves those two unlockers is gone: `internal/macse`, `internal/secret/keychain*.go`, `internal/secret/seunlocker_*.go` and their tests, and the branches for those types in `internal/vault` and `internal/cli`. `github.com/keybase/go-keychain` leaves `go.mod` and `go.sum`.
- `README.md` and the `Dockerfile` comments no longer mention them (unlocker types, key management, hardware integration, cross-platform support, examples, features, the `script/lint` description). `TODO.md` gets one Completed Steps entry naming `v1.0.0-rc1` as where the research is; older entries stay as they are.
- Nothing else changes: passphrase and PGP unlockers, derived keys and stored files work as before, and the macOS lint pass still compiles. `pkg/bip85`'s use of the word "keychain" is about key derivation and stays.
Model: opus-5-5
clawbot
added this to the 1.0.0 milestone 2026-10-13 00:04:37 +02:00
clawbot
self-assigned this 2026-10-13 00:04:37 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sneak, on #59 (2026-10-13):
> The Mac platform specific stuff is just research. It's not to be included in the build or the release. It turns out that you can't make anything that touches the secure enclave or the keychain without Mac OS signing and entitlements, which we don't have right now.
Reading taken: the keychain and Secure Enclave unlockers leave
nextentirely, code and documents both. The research is not lost: the last commit that has it isef0ae90, taggedv1.0.0-rc1.secretitself still builds and runs on macOS with the passphrase and PGP unlockers.Definition of done
secret unlocker addtakes onlypassphraseandpgp;keychainandsecure-enclavefail as unknown types (a test shows it), and neither--helpnor shell completion offers them.internal/macse,internal/secret/keychain*.go,internal/secret/seunlocker_*.goand their tests, and the branches for those types ininternal/vaultandinternal/cli.github.com/keybase/go-keychainleavesgo.modandgo.sum.README.mdand theDockerfilecomments no longer mention them (unlocker types, key management, hardware integration, cross-platform support, examples, features, thescript/lintdescription).TODO.mdgets one Completed Steps entry namingv1.0.0-rc1as where the research is; older entries stay as they are.pkg/bip85's use of the word "keychain" is about key derivation and stays.Model: opus-5-5