A failed keychain or Secure Enclave unlocker add leaves its keychain item or Secure Enclave key behind #89

New Issue

2026-10-04T10:32:12+02:00

clawbot commented

2026-10-04 10:32:12 +02:00

A failed keychain or Secure Enclave unlocker add can leave something behind outside the unlocker directory:

Secure Enclave: CreateSecureEnclaveUnlocker (internal/secret/seunlocker_darwin.go) creates the Secure Enclave key first. If getting the long-term key fails after that (for example a wrong passphrase for the current unlocker), or anything later does, the key stays in the Secure Enclave with nothing referring to it. macse.DeleteKey exists.
Keychain: CreateKeychainUnlocker (internal/secret/keychainunlocker.go) stores the keychain item before writing the metadata file. If that write, or moving the finished unlocker into place, fails, the item stays in the keychain. deleteFromKeychain exists.

Found while working on #48, which makes such a failure leave no unlocker directory.

Definition of done

A failed add deletes the Secure Enclave key or keychain item it created, with a failure to delete it reported along with the original error.
TODO.md updated in the same commit.

Model: opus-5-5

A failed keychain or Secure Enclave unlocker add can leave something behind outside the unlocker directory: - Secure Enclave: `CreateSecureEnclaveUnlocker` (`internal/secret/seunlocker_darwin.go`) creates the Secure Enclave key first. If getting the long-term key fails after that (for example a wrong passphrase for the current unlocker), or anything later does, the key stays in the Secure Enclave with nothing referring to it. `macse.DeleteKey` exists. - Keychain: `CreateKeychainUnlocker` (`internal/secret/keychainunlocker.go`) stores the keychain item before writing the metadata file. If that write, or moving the finished unlocker into place, fails, the item stays in the keychain. `deleteFromKeychain` exists. Found while working on https://git.eeqj.de/sneak/secret/issues/48, which makes such a failure leave no unlocker directory. ## Definition of done - A failed add deletes the Secure Enclave key or keychain item it created, with a failure to delete it reported along with the original error. - `TODO.md` updated in the same commit. Model: opus-5-5

clawbot referenced this issue

2026-10-04 10:54:00 +02:00

Leave no partial unlocker directory when adding an unlocker fails (closes #48) #90

clawbot referenced this issue

2026-10-04 10:54:08 +02:00

CreatePGPUnlocker leaves a partial unlocker directory on disk when fingerprint resolution fails #48

clawbot referenced this issue from a commit

2026-10-04 18:52:48 +02:00

Delete the keychain item or Secure Enclave key of a failed unlocker add (closes #89)

clawbot referenced a pull request that will close this issue

2026-10-04 19:11:04 +02:00

Delete the keychain item or Secure Enclave key of a failed unlocker add (closes #89) #106

clawbot commented

2026-10-04 19:11:10 +02:00

Built in #106. A Secure Enclave unlocker add now gets the long-term key before it creates the Secure Enclave key. If anything after that fails, it deletes the key. A keychain unlocker add now stores the keychain item only after the unlocker's files are written. If moving the unlocker into place then fails, it deletes the item. If a delete fails, that error is reported along with the original one. All of this code builds only on macOS, so it has been type-checked from Linux but never run.

Model: opus-5-5

Built in https://git.eeqj.de/sneak/secret/pulls/106. A Secure Enclave unlocker add now gets the long-term key before it creates the Secure Enclave key. If anything after that fails, it deletes the key. A keychain unlocker add now stores the keychain item only after the unlocker's files are written. If moving the unlocker into place then fails, it deletes the item. If a delete fails, that error is reported along with the original one. All of this code builds only on macOS, so it has been type-checked from Linux but never run. Model: opus-5-5

clawbot referenced this issue

2026-10-04 19:33:00 +02:00

Delete the keychain item or Secure Enclave key of a failed unlocker add (closes #89) #106

clawbot referenced this issue from a commit

2026-10-04 19:46:58 +02:00

Delete the keychain item or Secure Enclave key of a failed unlocker add (closes #89)

clawbot referenced this issue

2026-10-04 20:03:32 +02:00

Delete the keychain item or Secure Enclave key of a failed unlocker add (closes #89) #106

clawbot closed this issue

2026-10-04 20:08:00 +02:00

clawbot referenced this issue from a commit