The keychain and Secure Enclave unlockers were research, not part of the build: neither works without macOS code signing and entitlements, which secret does not have (#132). A macOS build still offered them in secret unlocker add, its help and its shell completion.
What the fix does
secret unlocker add takes only passphrase and pgp on every platform; keychain and secure-enclave fail as unknown types. A new test shows that, and that neither --help nor shell completion offers them.
internal/macse, the keychain and Secure Enclave files in internal/secret with their tests, and their branches in internal/vault and internal/cli are deleted. github.com/keybase/go-keychain leaves go.mod and go.sum.
README.md and the Dockerfile comments no longer mention them, and code comments that named them are trimmed. TODO.md gets a Completed Steps entry naming v1.0.0-rc1 (ef0ae90) as where the research is.
The passphrase and PGP unlockers, derived keys and stored files are unchanged.
Disclosures
Judgement call: internal/secret/derivation_index_test.go is deleted. Its only subject, getLongTermPrivateKey, lived in the keychain unlocker's file and served only these two unlockers.
Unverified: not built or run on a Mac; only the GOOS=darwin vet and lint, with cgo off, ran.
Left as is: the Status section of TODO.md still says there are no git tags, though v1.0.0-rc1 now exists.
Model: opus-5-5
**What was wrong**
The keychain and Secure Enclave unlockers were research, not part of the build: neither works without macOS code signing and entitlements, which `secret` does not have (https://git.eeqj.de/sneak/secret/issues/132). A macOS build still offered them in `secret unlocker add`, its help and its shell completion.
**What the fix does**
- `secret unlocker add` takes only `passphrase` and `pgp` on every platform; `keychain` and `secure-enclave` fail as unknown types. A new test shows that, and that neither `--help` nor shell completion offers them.
- `internal/macse`, the keychain and Secure Enclave files in `internal/secret` with their tests, and their branches in `internal/vault` and `internal/cli` are deleted. `github.com/keybase/go-keychain` leaves `go.mod` and `go.sum`.
- `README.md` and the `Dockerfile` comments no longer mention them, and code comments that named them are trimmed. `TODO.md` gets a Completed Steps entry naming `v1.0.0-rc1` (`ef0ae90`) as where the research is.
The passphrase and PGP unlockers, derived keys and stored files are unchanged.
**Disclosures**
- Judgement call: `internal/secret/derivation_index_test.go` is deleted. Its only subject, `getLongTermPrivateKey`, lived in the keychain unlocker's file and served only these two unlockers.
- Unverified: not built or run on a Mac; only the `GOOS=darwin` vet and lint, with cgo off, ran.
- Left as is: the Status section of `TODO.md` still says there are no git tags, though `v1.0.0-rc1` now exists.
Model: opus-5-5
Neither unlocker works without macOS code signing and entitlements, which
secret does not have, so both were research and leave the build.
`secret unlocker add` takes only passphrase and pgp on every platform;
keychain and secure-enclave fail as unknown types and are gone from
--help and shell completion. internal/macse, their files in
internal/secret with their tests, and their branches in internal/vault
and internal/cli are deleted; github.com/keybase/go-keychain leaves
go.mod and go.sum. README and Dockerfile comments no longer mention
them. The research stays at ef0ae90, tagged v1.0.0-rc1.
Judgement call: derivation_index_test.go goes with getLongTermPrivateKey,
its only subject, which only these two unlockers used.
Unverified: not built or run on a Mac; only the GOOS=darwin vet and lint ran.
Model: opus-5-5
Passes review: the keychain and Secure Enclave unlockers are gone as #132 defines, with nothing else changed.
Model: opus-5-5
Passes review: the keychain and Secure Enclave unlockers are gone as https://git.eeqj.de/sneak/secret/issues/132 defines, with nothing else changed.
Model: opus-5-5
clawbot
merged commit 2d6675a452 into next2026-10-13 00:39:36 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
What was wrong
The keychain and Secure Enclave unlockers were research, not part of the build: neither works without macOS code signing and entitlements, which
secretdoes not have (#132). A macOS build still offered them insecret unlocker add, its help and its shell completion.What the fix does
secret unlocker addtakes onlypassphraseandpgpon every platform;keychainandsecure-enclavefail as unknown types. A new test shows that, and that neither--helpnor shell completion offers them.internal/macse, the keychain and Secure Enclave files ininternal/secretwith their tests, and their branches ininternal/vaultandinternal/cliare deleted.github.com/keybase/go-keychainleavesgo.modandgo.sum.README.mdand theDockerfilecomments no longer mention them, and code comments that named them are trimmed.TODO.mdgets a Completed Steps entry namingv1.0.0-rc1(ef0ae90) as where the research is.The passphrase and PGP unlockers, derived keys and stored files are unchanged.
Disclosures
internal/secret/derivation_index_test.gois deleted. Its only subject,getLongTermPrivateKey, lived in the keychain unlocker's file and served only these two unlockers.GOOS=darwinvet and lint, with cgo off, ran.TODO.mdstill says there are no git tags, thoughv1.0.0-rc1now exists.Model: opus-5-5
Passes review: the keychain and Secure Enclave unlockers are gone as #132 defines, with nothing else changed.
Model: opus-5-5