Two keychain or Secure Enclave unlockers added in the same minute share an ID #98

New Issue

2026-10-04T15:15:39+02:00

clawbot commented

2026-10-04 15:15:39 +02:00

With #71 fixed, a second keychain or Secure Enclave unlocker added on the same host and day no longer replaces the first: it is added beside it. Their IDs are still the creation time to the minute plus the host name, so two added within one minute get the same ID. unlocker select and unlocker remove then act on whichever sorts first, the older one, and so does the selection unlocker add makes right after adding: the new unlocker is added, but the older one stays current.

Found by reading the code; macOS-only, not reproduced.

Model: opus-5-5

With https://git.eeqj.de/sneak/secret/issues/71 fixed, a second keychain or Secure Enclave unlocker added on the same host and day no longer replaces the first: it is added beside it. Their IDs are still the creation time to the minute plus the host name, so two added within one minute get the same ID. `unlocker select` and `unlocker remove` then act on whichever sorts first, the older one, and so does the selection `unlocker add` makes right after adding: the new unlocker is added, but the older one stays current. Found by reading the code; macOS-only, not reproduced. Model: opus-5-5

clawbot referenced this issue

2026-10-04 15:15:49 +02:00

Give every new unlocker a directory of its own (closes #71) #99

clawbot referenced this issue

2026-10-04 15:15:56 +02:00

Replacing an unlocker is not atomic: a crash part-way leaves it unable to open the vault #71

clawbot referenced this issue from a commit

2026-10-04 20:18:51 +02:00

Make an unlocker's ID the name of its directory (closes #98)

clawbot referenced a pull request that will close this issue

2026-10-04 20:21:07 +02:00

Make an unlocker's ID the name of its directory (closes #98) #109

clawbot commented

2026-10-04 20:21:12 +02:00

Every unlocker's ID is now the name of its directory in unlockers.d, which is unique in its vault. unlocker select, unlocker remove and the selection unlocker add makes now act on the unlocker named, however close together two were added. This applies to all four types: PGP IDs, which were pgp- and the key's fingerprint, change too. Adding a second PGP unlocker for the same key is still refused. The keychain and Secure Enclave changes were type-checked but not run.

#109

Model: opus-5-5

Every unlocker's ID is now the name of its directory in `unlockers.d`, which is unique in its vault. `unlocker select`, `unlocker remove` and the selection `unlocker add` makes now act on the unlocker named, however close together two were added. This applies to all four types: PGP IDs, which were `pgp-` and the key's fingerprint, change too. Adding a second PGP unlocker for the same key is still refused. The keychain and Secure Enclave changes were type-checked but not run. https://git.eeqj.de/sneak/secret/pulls/109 Model: opus-5-5

clawbot referenced this issue from a commit

2026-10-04 21:05:44 +02:00

Make an unlocker's ID the name of its directory (closes #98)

clawbot closed this issue

2026-10-04 21:25:00 +02:00

clawbot referenced this issue from a commit

2026-10-04 21:25:00 +02:00

Make an unlocker's ID the name of its directory (closes #98)

Sign in to join this conversation.