Bug: Non-darwin KeychainUnlocker stub panics instead of returning errors #7

New Issue

2026-02-08T21:02:23+01:00

clawbot commented

2026-02-08 21:02:23 +01:00

Bug

In internal/secret/keychainunlocker_stub.go (non-darwin build), all methods including NewKeychainUnlocker, GetType(), GetID(), etc. call panic() instead of returning errors:

func NewKeychainUnlocker(fs afero.Fs, directory string, metadata UnlockerMetadata) *KeychainUnlocker {
    panic("keychain unlockers are only supported on macOS")
}

This is a crash bug on Linux/Windows. The code paths in vault/unlockers.go GetCurrentUnlocker() and findUnlockerByID() call NewKeychainUnlocker when they encounter a keychain-type unlocker in metadata:

case "keychain":
    unlocker = secret.NewKeychainUnlocker(v.fs, unlockerDir, metadata)

If a vault is synced from macOS to Linux (which is a valid use case since vaults are just files), and the vault has a keychain unlocker, any operation that lists or resolves unlockers will panic and crash instead of gracefully skipping or returning an error.

Impact

Cross-platform vault portability is broken
Program crashes instead of showing a helpful error
secret unlocker list crashes on Linux if any keychain unlocker exists

Fix

Stub methods should return errors instead of panicking. NewKeychainUnlocker should return a valid struct whose methods return appropriate errors.

## Bug In `internal/secret/keychainunlocker_stub.go` (non-darwin build), all methods including `NewKeychainUnlocker`, `GetType()`, `GetID()`, etc. call `panic()` instead of returning errors: ```go func NewKeychainUnlocker(fs afero.Fs, directory string, metadata UnlockerMetadata) *KeychainUnlocker { panic("keychain unlockers are only supported on macOS") } ``` This is a **crash bug** on Linux/Windows. The code paths in `vault/unlockers.go` `GetCurrentUnlocker()` and `findUnlockerByID()` call `NewKeychainUnlocker` when they encounter a keychain-type unlocker in metadata: ```go case "keychain": unlocker = secret.NewKeychainUnlocker(v.fs, unlockerDir, metadata) ``` If a vault is synced from macOS to Linux (which is a valid use case since vaults are just files), and the vault has a keychain unlocker, any operation that lists or resolves unlockers will **panic and crash** instead of gracefully skipping or returning an error. ## Impact - Cross-platform vault portability is broken - Program crashes instead of showing a helpful error - `secret unlocker list` crashes on Linux if any keychain unlocker exists ## Fix Stub methods should return errors instead of panicking. `NewKeychainUnlocker` should return a valid struct whose methods return appropriate errors.

clawbot referenced a pull request that will close this issue

2026-02-08 21:06:05 +01:00

Non-darwin KeychainUnlocker stub returns errors instead of panicking (closes #7) #12

sneak closed this issue

2026-02-09 02:20:14 +01:00

sneak referenced this issue from a commit

2026-02-09 02:20:15 +01:00

Merge pull request 'Non-darwin KeychainUnlocker stub returns errors instead of panicking (closes #7)' (#12) from clawbot/secret:fix/issue-7 into main

Sign in to join this conversation.