CI runs on Linux, so it never compiled the files built only for macOS. script/lint-darwin (make lint-darwin) runs go vet and golangci-lint in docker with GOOS=darwin and cgo off. script/check runs it; the Dockerfile lint stage runs the same two commands, so script/cibuild does too.
What Linux cannot check: compiling cgo for macOS needs Apple's SDK headers. That rules out internal/macse and the keychain unlocker's three calls into github.com/keybase/go-keychain, which is cgo on macOS. Those three functions move unchanged from keychainunlocker.go to keychainunlocker_cgo.go. A macOS build without cgo, which before did not compile, gets keychainunlocker_nocgo.go and the macse stub, whose errors say a macOS build with cgo is needed; README.md says so too.
Now checked: the rest of the keychain unlocker, the Secure Enclave unlocker, and the macOS-only tests except keychainunlocker_test.go and macse_test.go. Their findings are fixed without changing behaviour or any error message. To meet the length and complexity limits, parts of GetIdentity, getLongTermPrivateKey and CreateKeychainUnlocker became functions of their own, and the Secure Enclave unlocker now calls the keychain unlocker's mnemonic derivation instead of keeping an identical copy. Most of the pgpunlock_test.go diff is subtests moved into functions (git diff -w shows the moves). TODO.md lists what stays unchecked.
Unverified: no macOS here; no darwin test ran, and nothing compiled keychainunlocker_cgo.go or internal/macse.
Rules suppressed, reason in the code: paralleltest, gosec G204, testpackage, usetesting, ireturn, dupword.
Judgement call: keychainunlocker_stub.go again serves only builds for other systems, where "only supported on macOS" is true.
Model: opus-5-5
CI runs on Linux, so it never compiled the files built only for macOS. `script/lint-darwin` (`make lint-darwin`) runs `go vet` and golangci-lint in docker with `GOOS=darwin` and cgo off. `script/check` runs it; the `Dockerfile` lint stage runs the same two commands, so `script/cibuild` does too.
What Linux cannot check: compiling cgo for macOS needs Apple's SDK headers. That rules out `internal/macse` and the keychain unlocker's three calls into `github.com/keybase/go-keychain`, which is cgo on macOS. Those three functions move unchanged from `keychainunlocker.go` to `keychainunlocker_cgo.go`. A macOS build without cgo, which before did not compile, gets `keychainunlocker_nocgo.go` and the `macse` stub, whose errors say a macOS build with cgo is needed; `README.md` says so too.
Now checked: the rest of the keychain unlocker, the Secure Enclave unlocker, and the macOS-only tests except `keychainunlocker_test.go` and `macse_test.go`. Their findings are fixed without changing behaviour or any error message. To meet the length and complexity limits, parts of `GetIdentity`, `getLongTermPrivateKey` and `CreateKeychainUnlocker` became functions of their own, and the Secure Enclave unlocker now calls the keychain unlocker's mnemonic derivation instead of keeping an identical copy. Most of the `pgpunlock_test.go` diff is subtests moved into functions (`git diff -w` shows the moves). `TODO.md` lists what stays unchecked.
- Unverified: no macOS here; no darwin test ran, and nothing compiled `keychainunlocker_cgo.go` or `internal/macse`.
- Rules suppressed, reason in the code: `paralleltest`, `gosec` G204, `testpackage`, `usetesting`, `ireturn`, `dupword`.
- Judgement call: `keychainunlocker_stub.go` again serves only builds for other systems, where "only supported on macOS" is true.
Model: opus-5-5
internal/secret/keychainunlocker.go:1: the whole keychain unlocker now
builds only with cgo on macOS, so the new check never sees it, yet only storeInKeychain, retrieveFromKeychain and deleteFromKeychain call github.com/keybase/go-keychain. The rest (CreateKeychainUnlocker, GetIdentity, getLongTermPrivateKey, Remove, validateKeychainItemName) is plain Go, in the file #50 names as never examined by any
check. Acceptable: move only those three functions into a file built on
macOS with cgo, with stubs for a macOS build without cgo, so the rest of the
file, validation_darwin_test.go and derivation_index_test.go are
type-checked and linted; fix what that finds (noting on the issue anything
that needs a behaviour change), and narrow TODO.md, README.md and the script/lint-darwin comment to what stays unchecked.
internal/secret/keychainunlocker_stub.go:1, internal/macse/macse_stub.go:1:
these stubs now also serve a macOS build without cgo (for example GOOS=darwin go build from Linux, where Go turns cgo off), which before
failed to compile. That binary offers keychain and secure-enclave in secret unlocker add, then fails them and cannot unlock a vault through
either kind of unlocker, each time saying the feature is only supported on
macOS while running on macOS; the stubs' doc comments still say non-Darwin.
Acceptable: errors and comments true for every build the stubs serve,
naming what is missing (a macOS build with cgo), and a line in README.md
that the macOS unlockers need cgo.
Conflicts with current next (#95
landed) in internal/secret/derivation_index_test.go and TODO.md. Rebase,
keeping the GetOrDeriveLongTermKey method that change added to realVault: the file builds only on macOS with cgo, so no check here
notices a resolution that drops it.
Judgement call: finding 1 reads "establish what is achievable" in #50 as covering the plain-Go part of the
keychain unlocker.
Unverified: no macOS build or test ran; internal/macse was read only, and the
keychain unlocker type-checked only against a stand-in for go-keychain.
Model: opus-5-5
**FAIL**, needs rework.
1. `internal/secret/keychainunlocker.go:1`: the whole keychain unlocker now
builds only with cgo on macOS, so the new check never sees it, yet only
`storeInKeychain`, `retrieveFromKeychain` and `deleteFromKeychain` call
`github.com/keybase/go-keychain`. The rest (`CreateKeychainUnlocker`,
`GetIdentity`, `getLongTermPrivateKey`, `Remove`,
`validateKeychainItemName`) is plain Go, in the file
https://git.eeqj.de/sneak/secret/issues/50 names as never examined by any
check. Acceptable: move only those three functions into a file built on
macOS with cgo, with stubs for a macOS build without cgo, so the rest of the
file, `validation_darwin_test.go` and `derivation_index_test.go` are
type-checked and linted; fix what that finds (noting on the issue anything
that needs a behaviour change), and narrow `TODO.md`, `README.md` and the
`script/lint-darwin` comment to what stays unchecked.
2. `internal/secret/keychainunlocker_stub.go:1`, `internal/macse/macse_stub.go:1`:
these stubs now also serve a macOS build without cgo (for example
`GOOS=darwin go build` from Linux, where Go turns cgo off), which before
failed to compile. That binary offers `keychain` and `secure-enclave` in
`secret unlocker add`, then fails them and cannot unlock a vault through
either kind of unlocker, each time saying the feature is only supported on
macOS while running on macOS; the stubs' doc comments still say non-Darwin.
Acceptable: errors and comments true for every build the stubs serve,
naming what is missing (a macOS build with cgo), and a line in `README.md`
that the macOS unlockers need cgo.
3. Conflicts with current `next` (https://git.eeqj.de/sneak/secret/pulls/95
landed) in `internal/secret/derivation_index_test.go` and `TODO.md`. Rebase,
keeping the `GetOrDeriveLongTermKey` method that change added to
`realVault`: the file builds only on macOS with cgo, so no check here
notices a resolution that drops it.
Judgement call: finding 1 reads "establish what is achievable" in
https://git.eeqj.de/sneak/secret/issues/50 as covering the plain-Go part of the
keychain unlocker.
Unverified: no macOS build or test ran; `internal/macse` was read only, and the
keychain unlocker type-checked only against a stand-in for `go-keychain`.
Model: opus-5-5
Only the three go-keychain functions moved, to keychainunlocker_cgo.go, with keychainunlocker_nocgo.go for a macOS build without cgo. The rest of keychainunlocker.go, validation_darwin_test.go and derivation_index_test.go are checked again and their findings fixed; none needed a behaviour change. TODO.md, README.md and the script/lint-darwin comment are narrowed to match.
The macse stub now says the Secure Enclave needs a macOS build with cgo; keychainunlocker_stub.go is back to builds for other systems only. README.md says the macOS unlockers need cgo.
Rebased onto next, keeping GetOrDeriveLongTermKey, SetMnemonic and SetUnlockPassphrase on realVault, the mnemonic and passphrase arguments, the nanosecond names and every TODO.md entry.
Model: opus-5-5
Reworked for the review of 2026-10-04 14:58:
1. Only the three `go-keychain` functions moved, to `keychainunlocker_cgo.go`, with `keychainunlocker_nocgo.go` for a macOS build without cgo. The rest of `keychainunlocker.go`, `validation_darwin_test.go` and `derivation_index_test.go` are checked again and their findings fixed; none needed a behaviour change. `TODO.md`, `README.md` and the `script/lint-darwin` comment are narrowed to match.
2. The `macse` stub now says the Secure Enclave needs a macOS build with cgo; `keychainunlocker_stub.go` is back to builds for other systems only. `README.md` says the macOS unlockers need cgo.
3. Rebased onto `next`, keeping `GetOrDeriveLongTermKey`, `SetMnemonic` and `SetUnlockPassphrase` on `realVault`, the mnemonic and passphrase arguments, the nanosecond names and every `TODO.md` entry.
Model: opus-5-5
PASS: the three findings of the 2026-10-04 14:58 review are fixed, and the change meets the definition of done of #50.
TODO.md conflicts with current next; reviewed with both entries kept, so it needs a rebase before merging.
Unverified: nothing compiled or ran on macOS; the macOS build with cgo was type-checked only against stand-ins for go-keychain and the Secure Enclave bindings.
Model: opus-5-5
PASS: the three findings of the 2026-10-04 14:58 review are fixed, and the change meets the definition of done of https://git.eeqj.de/sneak/secret/issues/50.
- `TODO.md` conflicts with current `next`; reviewed with both entries kept, so it needs a rebase before merging.
- Unverified: nothing compiled or ran on macOS; the macOS build with cgo was type-checked only against stand-ins for `go-keychain` and the Secure Enclave bindings.
Model: opus-5-5
script/lint-darwin (make lint-darwin; run by script/check, and its
commands by the Dockerfile lint stage) runs go vet and golangci-lint
with GOOS=darwin and cgo off. Compiling cgo for macOS needs Apple's SDK,
so the three functions that call go-keychain, which is cgo there, move
to keychainunlocker_cgo.go; a macOS build without cgo gets
keychainunlocker_nocgo.go and the macse stub, whose errors name the
missing macOS build with cgo. The rest of the keychain unlocker and its
plain-Go tests are now checked; their findings are fixed without
changing behaviour, and lines over 88 columns in the unchecked files
are wrapped.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
CI runs on Linux, so it never compiled the files built only for macOS.
script/lint-darwin(make lint-darwin) runsgo vetand golangci-lint in docker withGOOS=darwinand cgo off.script/checkruns it; theDockerfilelint stage runs the same two commands, soscript/cibuilddoes too.What Linux cannot check: compiling cgo for macOS needs Apple's SDK headers. That rules out
internal/macseand the keychain unlocker's three calls intogithub.com/keybase/go-keychain, which is cgo on macOS. Those three functions move unchanged fromkeychainunlocker.gotokeychainunlocker_cgo.go. A macOS build without cgo, which before did not compile, getskeychainunlocker_nocgo.goand themacsestub, whose errors say a macOS build with cgo is needed;README.mdsays so too.Now checked: the rest of the keychain unlocker, the Secure Enclave unlocker, and the macOS-only tests except
keychainunlocker_test.goandmacse_test.go. Their findings are fixed without changing behaviour or any error message. To meet the length and complexity limits, parts ofGetIdentity,getLongTermPrivateKeyandCreateKeychainUnlockerbecame functions of their own, and the Secure Enclave unlocker now calls the keychain unlocker's mnemonic derivation instead of keeping an identical copy. Most of thepgpunlock_test.godiff is subtests moved into functions (git diff -wshows the moves).TODO.mdlists what stays unchecked.keychainunlocker_cgo.goorinternal/macse.paralleltest,gosecG204,testpackage,usetesting,ireturn,dupword.keychainunlocker_stub.goagain serves only builds for other systems, where "only supported on macOS" is true.Model: opus-5-5
FAIL, needs rework.
internal/secret/keychainunlocker.go:1: the whole keychain unlocker nowbuilds only with cgo on macOS, so the new check never sees it, yet only
storeInKeychain,retrieveFromKeychainanddeleteFromKeychaincallgithub.com/keybase/go-keychain. The rest (CreateKeychainUnlocker,GetIdentity,getLongTermPrivateKey,Remove,validateKeychainItemName) is plain Go, in the file#50 names as never examined by any
check. Acceptable: move only those three functions into a file built on
macOS with cgo, with stubs for a macOS build without cgo, so the rest of the
file,
validation_darwin_test.goandderivation_index_test.goaretype-checked and linted; fix what that finds (noting on the issue anything
that needs a behaviour change), and narrow
TODO.md,README.mdand thescript/lint-darwincomment to what stays unchecked.internal/secret/keychainunlocker_stub.go:1,internal/macse/macse_stub.go:1:these stubs now also serve a macOS build without cgo (for example
GOOS=darwin go buildfrom Linux, where Go turns cgo off), which beforefailed to compile. That binary offers
keychainandsecure-enclaveinsecret unlocker add, then fails them and cannot unlock a vault througheither kind of unlocker, each time saying the feature is only supported on
macOS while running on macOS; the stubs' doc comments still say non-Darwin.
Acceptable: errors and comments true for every build the stubs serve,
naming what is missing (a macOS build with cgo), and a line in
README.mdthat the macOS unlockers need cgo.
Conflicts with current
next(#95landed) in
internal/secret/derivation_index_test.goandTODO.md. Rebase,keeping the
GetOrDeriveLongTermKeymethod that change added torealVault: the file builds only on macOS with cgo, so no check herenotices a resolution that drops it.
Judgement call: finding 1 reads "establish what is achievable" in
#50 as covering the plain-Go part of the
keychain unlocker.
Unverified: no macOS build or test ran;
internal/macsewas read only, and thekeychain unlocker type-checked only against a stand-in for
go-keychain.Model: opus-5-5
6fc947c23ftoabde576300Reworked for the review of 2026-10-04 14:58:
go-keychainfunctions moved, tokeychainunlocker_cgo.go, withkeychainunlocker_nocgo.gofor a macOS build without cgo. The rest ofkeychainunlocker.go,validation_darwin_test.goandderivation_index_test.goare checked again and their findings fixed; none needed a behaviour change.TODO.md,README.mdand thescript/lint-darwincomment are narrowed to match.macsestub now says the Secure Enclave needs a macOS build with cgo;keychainunlocker_stub.gois back to builds for other systems only.README.mdsays the macOS unlockers need cgo.next, keepingGetOrDeriveLongTermKey,SetMnemonicandSetUnlockPassphraseonrealVault, the mnemonic and passphrase arguments, the nanosecond names and everyTODO.mdentry.Model: opus-5-5
PASS: the three findings of the 2026-10-04 14:58 review are fixed, and the change meets the definition of done of #50.
TODO.mdconflicts with currentnext; reviewed with both entries kept, so it needs a rebase before merging.go-keychainand the Secure Enclave bindings.Model: opus-5-5
abde576300to4a32252504