More

.github/workflows/nightly.yml

@@ -1,49 +0,0 @@
-name: Nightly
-
-on: 
-  schedule: 
-    - cron: "0 8 * * *"
-jobs:
-  build:
-    runs-on: macos-11.0
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v2
-    - name: Setup Signing
-      env: 
-        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
-        SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
-        HOST_PROFILE_DATA: ${{ secrets.HOST_PROFILE_DATA }}
-        AGENT_PROFILE_DATA: ${{ secrets.AGENT_PROFILE_DATA }}
-        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
-        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-      run: ./.github/scripts/signing.sh
-    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_13.2.1.app
-    - name: Update Build Number
-      env:
-        RUN_ID: ${{ github.run_id }}
-      run: |
-            sed -i '' -e "s/GITHUB_CI_VERSION/0.0.0/g" Sources/Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
-            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
-    - name: Build
-      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
-    - name: Create ZIPs
-      run: |
-            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
-            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
-    - name: Notarize
-      env: 
-        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
-    - name: Document SHAs
-      run: |
-            shasum -a 512 Secretive.zip
-            shasum -a 512 Archive.zip
-    - name: Upload App to Artifacts
-      uses: actions/upload-artifact@v1
-      with:
-        name: Secretive.zip
-        path: Secretive.zip

APP_CONFIG.md

@@ -51,30 +51,6 @@ Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
 
 Log out and log in again before launching Cyberduck.
 
-## GitKraken
-
-Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
-
-```
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>link-ssh-auth-sock</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>/bin/sh</string>
-    <string>-c</string>
-    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
-  </array>
-  <key>RunAtLoad</key>
-  <true/>
-</dict>
-</plist>
-```
-
-Log out and log in again before launching Gitkraken. Then enable "Use local SSH agent in GitKraken Preferences (Located under Preferences -> SSH)
 
 # The app I use isn't listed here!
 

FAQ.md

@@ -26,11 +26,7 @@ Please run `ssh -Tv git@github.com` in your terminal and paste the output in a [
 
 ### How do I tell SSH to use a specific key?
 
-Beginning with Secretive 2.2, every secret has an automatically generated public key file representation on disk, and the path to it is listed under "Public Key Path" in Secretive. You can specify that you want to use that key in your `~/.ssh/config`.  [This ServerFault answer](https://serverfault.com/a/295771) has more details on setting that up.
+You can create a `mykey.pub` (where `mykey` is the name of your key) in your `~/.ssh/` directory with the contents of your public key, and specify that you want to use that key in your `~/.ssh/config`.  [This ServerFault answer](https://serverfault.com/a/295771) has more details on setting that up
-
-### Can I use Secretive for SSH Agent Forwarding?
-
-Yes, you can! Once you've set up Secretive, just add `ForwardAgent yes` to the hosts you want to forward to in your SSH config file. Afterwards, any use of one of your SSH keys on the remote host must be authenticated through Secretive.
 
 ### Why should I trust you?
 
@@ -44,10 +40,6 @@ Awesome! Just bear in mind that because an app only has access to the keychain i
 
 Secretive checks in with GitHub's releases API to check if there's a new version of Secretive available. You can audit the source code for this feature [here](https://github.com/maxgoedjen/secretive/blob/main/Sources/Packages/Sources/Brief/Updater.swift).
 
-### How do I uninstall Secretive?
-
-Drag Secretive.app to the trash and remove `~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent`. `SecretAgent` may continue running until you quit it or reboot.
-
 ### I have a security issue
 
 Please contact [max.goedjen@gmail.com](mailto:max.goedjen@gmail.com) with a subject containing "SECRETIVE SECURITY" immediately with details, and I'll address the issue and credit you ASAP.

README.md

@@ -16,13 +16,13 @@ The most common setup for SSH keys is just keeping them on disk, guarded by prop
 
 If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed.
 
-<img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID" width="400">
+<img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID">
 
 ### Notifications
 
 Secretive also notifies you whenever your keys are accessed, so you're never caught off guard.
 
-<img src="/.github/readme/notification.png" alt="Screenshot of Secretive notifying the user" width="600">
+<img src="/.github/readme/notification.png" alt="Screenshot of Secretive notifying the user">
 
 ### Support for Smart Cards Too!
 

Sources/Packages/Package.swift

@@ -18,9 +18,6 @@ let package = Package(
         .library(
             name: "SmartCardSecretKit",
             targets: ["SmartCardSecretKit"]),
-        .library(
-            name: "ProxyAgentSecretKit",
-            targets: ["ProxyAgentSecretKit"]),
         .library(
             name: "SecretAgentKit",
             targets: ["SecretAgentKit"]),
@@ -50,10 +47,6 @@ let package = Package(
             name: "SmartCardSecretKit",
             dependencies: ["SecretKit"]
         ),
-        .target(
-            name: "ProxyAgentSecretKit",
-            dependencies: ["SecretKit", "SecretAgentKit"]
-        ),
         .target(
             name: "SecretAgentKit",
             dependencies: ["SecretKit", "SecretAgentKitHeaders"]

Sources/Packages/Sources/Brief/Release.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// A release is a representation of a downloadable update.
-public struct Release: Codable {
+public struct Release: Codable, Sendable {
 
     /// The user-facing name of the release. Typically "Secretive 1.2.3"
     public let name: String
@@ -30,6 +30,9 @@ public struct Release: Codable {
 
 }
 
+// TODO: REMOVE WHEN(?) URL GAINS NATIVE CONFORMANCE
+extension URL: @unchecked Sendable {}
+
 extension Release: Identifiable {
 
     public var id: String {

Sources/Packages/Sources/Brief/SemVer.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// A representation of a Semantic Version.
-public struct SemVer {
+public struct SemVer: Sendable {
 
     /// The SemVer broken into an array of integers.
     let versionNumbers: [Int]

Sources/Packages/Sources/Brief/Updater.swift

@@ -2,53 +2,59 @@ import Foundation
 import Combine
 
 /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
-public class Updater: ObservableObject, UpdaterProtocol {
+public actor Updater: ObservableObject, UpdaterProtocol {
 
-    @Published public var update: Release?
+    @MainActor @Published public var update: Release?
     public let testBuild: Bool
 
     /// The current OS version.
     private let osVersion: SemVer
     /// The current version of the app that is running.
     private let currentVersion: SemVer
+    /// The timer responsible for checking for updates regularly.
+    private var timer: Timer? = nil
 
     /// Initializes an Updater.
     /// - Parameters:
-    ///   - checkOnLaunch: A boolean describing whether the Updater should check for available updates on launch.
-    ///   - checkFrequency: The interval at which the Updater should check for updates. Subject to a tolerance of 1 hour.
     ///   - osVersion: The current OS version.
     ///   - currentVersion: The current version of the app that is running.
-    public init(checkOnLaunch: Bool, checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value, osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion), currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")) {
+    public init(osVersion: SemVer = SemVer(ProcessInfo.processInfo.operatingSystemVersion), currentVersion: SemVer = SemVer(Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "0.0.0")) {
         self.osVersion = osVersion
         self.currentVersion = currentVersion
         testBuild = currentVersion == SemVer("0.0.0")
-        if checkOnLaunch {
+    }
-            // Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet.
+
-            checkForUpdates()
+    /// Begins checking for updates with the specified frequency.
+    /// - Parameter checkFrequency: The interval at which the Updater should check for updates. Subject to a tolerance of 1 hour.
+    public func beginChecking(checkFrequency: TimeInterval = Measurement(value: 24, unit: UnitDuration.hours).converted(to: .seconds).value) {
+        timer?.invalidate()
+        timer = Timer.scheduledTimer(withTimeInterval: checkFrequency, repeats: true) { _ in
+            Task {
+                await self.checkForUpdates()
+            }
         }
-        let timer = Timer.scheduledTimer(withTimeInterval: checkFrequency, repeats: true) { _ in
+        timer?.tolerance = 60*60
-            self.checkForUpdates()
+    }
-        }
+
-        timer.tolerance = 60*60
+    /// Ends checking for updates.
+    public func stopChecking() {
+        timer?.invalidate()
+        timer = nil
     }
 
     /// Manually trigger an update check.
-    public func checkForUpdates() {
+    public func checkForUpdates() async {
-        URLSession.shared.dataTask(with: Constants.updateURL) { data, _, _ in
+        guard let (data, _) = try? await URLSession.shared.data(from: Constants.updateURL),
-            guard let data = data else { return }
+              let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
-            guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
+        await evaluate(releases: releases)
-            self.evaluate(releases: releases)
-        }.resume()
     }
 
     /// Ignores a specified release. `update` will be nil if the user has ignored the latest available release.
     /// - Parameter release: The release to ignore.
-    public func ignore(release: Release) {
+    public func ignore(release: Release) async {
         guard !release.critical else { return }
         defaults.set(true, forKey: release.name)
-        DispatchQueue.main.async {
+        await setUpdate(update: update)
-            self.update = nil
-        }
     }
 
 }
@@ -57,7 +63,7 @@ extension Updater {
 
     /// Evaluates the available downloadable releases, and selects the newest non-prerelease release that the user is able to run.
     /// - Parameter releases: An array of ``Release`` objects.
-    func evaluate(releases: [Release]) {
+    func evaluate(releases: [Release]) async {
         guard let release = releases
                 .sorted()
                 .reversed()
@@ -67,12 +73,14 @@ extension Updater {
         guard !release.prerelease else { return }
         let latestVersion = SemVer(release.name)
         if latestVersion > currentVersion {
-            DispatchQueue.main.async {
+            await setUpdate(update: update)
-                self.update = release
-            }
         }
     }
 
+    @MainActor private func setUpdate(update: Release?) {
+        self.update = update
+    }
+
     /// Checks whether the user has ignored a release.
     /// - Parameter release: The release to check.
     /// - Returns: A boolean describing whether the user has ignored the release. Will always be false if the release is critical.
@@ -95,3 +103,21 @@ extension Updater {
     }
 
 }
+
+@available(macOS, deprecated: 12)
+ extension URLSession {
+
+     // Backport for macOS 11
+     func data(from url: URL) async throws -> (Data, URLResponse) {
+         try await withCheckedThrowingContinuation { continuation in
+             URLSession.shared.dataTask(with: url) { data, response, error in
+                 guard let data = data, let response = response else {
+                     continuation.resume(throwing: error ?? NSError(domain: NSURLErrorDomain, code: NSURLErrorUnknown, userInfo: nil))
+                     return
+                 }
+                 continuation.resume(returning: (data, response))
+             }
+         }
+     }
+
+ }

Sources/Packages/Sources/Brief/UpdaterProtocol.swift

@@ -4,9 +4,9 @@ import Foundation
 public protocol UpdaterProtocol: ObservableObject {
 
     /// The latest update
-    var update: Release? { get }
+    @MainActor var update: Release? { get }
     /// A boolean describing whether or not the current build of the app is a "test" build (ie, a debug build or otherwise special build)
-    var testBuild: Bool { get }
+    @MainActor var testBuild: Bool { get }
 
 }
 

Sources/Packages/Sources/ProxyAgentSecretKit/ProxyAgent.swift

@@ -1,2 +0,0 @@
-/// Namespace for the Proxy Agent implementations.
-public enum ProxyAgent {}

Sources/Packages/Sources/ProxyAgentSecretKit/ProxyAgentSecret.swift

@@ -1,19 +0,0 @@
-import Foundation
-import Combine
-import SecretKit
-
-extension ProxyAgent {
-
-    /// An implementation of Secret backed by a Smart Card.
-    public struct Secret: SecretKit.Secret {
-
-        public let id: Data
-        public let name: String
-        public let algorithm: Algorithm
-        public let keySize: Int
-        public let requiresAuthentication: Bool = false
-        public let publicKey: Data
-
-    }
-
-}

Sources/Packages/Sources/ProxyAgentSecretKit/ProxyAgentStore.swift

@@ -1,59 +0,0 @@
-import Foundation
-import Security
-import CryptoTokenKit
-import LocalAuthentication
-import SecretKit
-
-extension ProxyAgent {
-
-    /// An implementation of Store backed by a Proxy Agent.
-    public class Store: SecretStore {
-
-        @Published public var isAvailable: Bool = true
-        public let id = UUID()
-        public private(set) var name = NSLocalizedString("Proxy SSH Agent", comment: "Proxy SSH Agent")
-        @Published public private(set) var secrets: [Secret] = []
-        private let agentPath: String
-
-        /// Initializes a Store.
-        public init(path: String) {
-            agentPath = path
-            secrets.append(Secret(id: "hello".data(using: .utf8)!, name: "Test", algorithm: .ellipticCurve, keySize: 256, publicKey: Data(base64Encoded: "AAAAC3NzaC1lZDI1NTE5AAAAIINQz8WohBS46ICEUtkJ/vdxJPM63T5Dy4bQC35JVgGR")!))
-        }
-
-        // MARK: Public API
-
-        public func create(name: String) throws {
-            fatalError("Keys must be created on the smart card.")
-        }
-
-        public func delete(secret: Secret) throws {
-            fatalError("Keys must be deleted on the smart card.")
-        }
-
-        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
-            fatalError()
-        }
-
-        public func existingPersistedAuthenticationContext(secret: ProxyAgent.Secret) -> PersistedAuthenticationContext? {
-            nil
-        }
-
-        public func persistAuthentication(secret: ProxyAgent.Secret, forDuration: TimeInterval) throws {
-        }
-
-    }
-
-}
-
-extension ProxyAgent.Store {
-
-}
-
-extension ProxyAgent {
-
-    /// A signing-related error.
-    public struct SigningError: Error {
-    }
-
-}

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -30,23 +30,20 @@ extension Agent {
     /// - Parameters:
     ///   - reader: A ``FileHandleReader`` to read the content of the request.
     ///   - writer: A ``FileHandleWriter`` to write the response to.
-    /// - Return value: 
+    public func handle(reader: FileHandleReader, writer: FileHandleWriter) {
-    ///   - Boolean if data could be read
-    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) -> Bool {
         Logger().debug("Agent handling new data")
         let data = Data(reader.availableData)
-        guard data.count > 4 else { return false}
+        guard data.count > 4 else { return }
         let requestTypeInt = data[4]
         guard let requestType = SSHAgent.RequestType(rawValue: requestTypeInt) else {
             writer.write(OpenSSHKeyWriter().lengthAndData(of: SSHAgent.ResponseType.agentFailure.data))
             Logger().debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
-            return true
+            return
         }
         Logger().debug("Agent handling request of type \(requestType.debugDescription)")
         let subData = Data(data[5...])
         let response = handle(requestType: requestType, data: subData, reader: reader)
         writer.write(response)
-        return true
     }
 
     func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) -> Data {
@@ -113,7 +110,7 @@ extension Agent {
 
         let dataToSign = reader.readNextChunk()
         let signed = try store.sign(data: dataToSign, with: secret, for: provenance)
-        let derSignature = signed
+        let derSignature = signed.data
 
         let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
 
@@ -154,7 +151,7 @@ extension Agent {
         signedData.append(writer.lengthAndData(of: sub))
 
         if let witness = witness {
-            try witness.witness(accessTo: secret, from: store, by: provenance)
+            try witness.witness(accessTo: secret, from: store, by: provenance, requiredAuthentication: signed.requiredAuthentication)
         }
 
         Logger().debug("Agent signed request")

Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift

@@ -17,6 +17,7 @@ public protocol SigningWitness {
     ///   - secret: The `Secret` that will was used to sign the request.
     ///   - store: The `Store` that signed the request..
     ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws
+    ///   - requiredAuthentication: A boolean describing whether or not authentication was required for the request.
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) throws
 
 }

Sources/Packages/Sources/SecretAgentKit/SocketController.swift

@@ -9,9 +9,7 @@ public class SocketController {
     /// The active SocketPort.
     private var port: SocketPort?
     /// A handler that will be notified when a new read/write handle is available.
-    /// False if no data could be read
+    public var handler: ((FileHandleReader, FileHandleWriter) -> Void)?
-    public var handler: ((FileHandleReader, FileHandleWriter) -> Bool)?
-
 
     /// Initializes a socket controller with a specified path.
     /// - Parameter path: The path to use as a socket.
@@ -67,7 +65,7 @@ public class SocketController {
     @objc func handleConnectionAccept(notification: Notification) {
         Logger().debug("Socket controller accepted connection")
         guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { return }
-        _ = handler?(new, new)
+        handler?(new, new)
         new.waitForDataInBackgroundAndNotify()
         fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
     }
@@ -78,12 +76,7 @@ public class SocketController {
         Logger().debug("Socket controller has new data available")
         guard let new = notification.object as? FileHandle else { return }
         Logger().debug("Socket controller received new file handle")
-        if((handler?(new, new)) == true) {
+        handler?(new, new)
-            Logger().debug("Socket controller handled data, wait for more data")
-            new.waitForDataInBackgroundAndNotify()
-        } else {
-            Logger().debug("Socket controller called with empty data, socked closed")
-        }
     }
 
 }

Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md

@@ -27,8 +27,5 @@ SecretKit is a collection of protocols describing secrets and stores.
 
 ### Signing Process
 
+- ``SignedData``
 - ``SigningRequestProvenance``
-
-### Authentication Persistence
-
-- ``PersistedAuthenticationContext``

Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift

@@ -9,7 +9,6 @@ public struct AnySecret: Secret {
     private let _name: () -> String
     private let _algorithm: () -> Algorithm
     private let _keySize: () -> Int
-    private let _requiresAuthentication: () -> Bool
     private let _publicKey: () -> Data
 
     public init<T>(_ secret: T) where T: Secret {
@@ -20,7 +19,6 @@ public struct AnySecret: Secret {
             _name = secret._name
             _algorithm = secret._algorithm
             _keySize = secret._keySize
-            _requiresAuthentication = secret._requiresAuthentication
             _publicKey = secret._publicKey
         } else {
             base = secret as Any
@@ -29,7 +27,6 @@ public struct AnySecret: Secret {
             _name = { secret.name }
             _algorithm = { secret.algorithm }
             _keySize = { secret.keySize }
-            _requiresAuthentication = { secret.requiresAuthentication }
             _publicKey = { secret.publicKey }
         }
     }
@@ -50,10 +47,6 @@ public struct AnySecret: Secret {
         _keySize()
     }
 
-    public var requiresAuthentication: Bool {
-        _requiresAuthentication()
-    }
-
     public var publicKey: Data {
         _publicKey()
     }

Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift

@@ -9,8 +9,7 @@ public class AnySecretStore: SecretStore {
     private let _id: () -> UUID
     private let _name: () -> String
     private let _secrets: () -> [AnySecret]
-    private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data
+    private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> SignedData
-    private let _existingPersistedAuthenticationContext: (AnySecret) -> PersistedAuthenticationContext?
     private let _persistAuthentication: (AnySecret, TimeInterval) throws -> Void
 
     private var sink: AnyCancellable?
@@ -22,7 +21,6 @@ public class AnySecretStore: SecretStore {
         _id = { secretStore.id }
         _secrets = { secretStore.secrets.map { AnySecret($0) } }
         _sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
-        _existingPersistedAuthenticationContext = { secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
         _persistAuthentication = { try secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
         sink = secretStore.objectWillChange.sink { _ in
             self.objectWillChange.send()
@@ -45,14 +43,10 @@ public class AnySecretStore: SecretStore {
         return _secrets()
     }
 
-    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> Data {
+    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> SignedData {
         try _sign(data, secret, provenance)
     }
 
-    public func existingPersistedAuthenticationContext(secret: AnySecret) -> PersistedAuthenticationContext? {
-        _existingPersistedAuthenticationContext(secret)
-    }
-
     public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) throws {
         try _persistAuthentication(secret, duration)
     }

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift

@@ -64,10 +64,6 @@ extension OpenSSHKeyWriter {
         switch algorithm {
         case .ellipticCurve:
             return "ecdsa-sha2-nistp" + String(describing: length)
-        case .rsa:
-            return "ssh-rsa"
-        case .ed25519:
-            return "ssh-ed25519"
         }
     }
 
@@ -80,11 +76,6 @@ extension OpenSSHKeyWriter {
         switch algorithm {
         case .ellipticCurve:
             return "nistp" + String(describing: length)
-        // TODO: VERIFY
-        case .rsa:
-            return "rsa"
-        case .ed25519:
-            return "ed25519"
         }
     }
 

Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift

@@ -6,7 +6,6 @@ public class PublicKeyFileStoreController {
 
     private let logger = Logger()
     private let directory: String
-    private let keyWriter = OpenSSHKeyWriter()
 
     /// Initializes a PublicKeyFileStoreController.
     public init(homeDirectory: String) {
@@ -22,6 +21,7 @@ public class PublicKeyFileStoreController {
             try? FileManager.default.removeItem(at: URL(fileURLWithPath: directory))
         }
         try? FileManager.default.createDirectory(at: URL(fileURLWithPath: directory), withIntermediateDirectories: false, attributes: nil)
+        let keyWriter = OpenSSHKeyWriter()
         for secret in secrets {
             let path = path(for: secret)
             guard let data = keyWriter.openSSHString(secret: secret).data(using: .utf8) else { continue }
@@ -35,8 +35,7 @@ public class PublicKeyFileStoreController {
     /// - Returns: The path to the Secret's public key.
     /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
     public func path<SecretType: Secret>(for secret: SecretType) -> String {
-        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        directory.appending("/").appending("\(secret.name.replacingOccurrences(of: " ", with: "-")).pub")
-        return directory.appending("/").appending("\(minimalHex).pub")
     }
 
 }

Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift

@@ -1,9 +0,0 @@
-import Foundation
-
-/// Protocol describing a persisted authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time.
-public protocol PersistedAuthenticationContext {
-    /// Whether the context remains valid.
-    var valid: Bool { get }
-    /// The date at which the authorization expires and the context becomes invalid.
-    var expiration: Date { get }
-}

Sources/Packages/Sources/SecretKit/Types/Secret.swift

@@ -9,8 +9,6 @@ public protocol Secret: Identifiable, Hashable {
     var algorithm: Algorithm { get }
     /// The key size for the secret.
     var keySize: Int { get }
-    /// Whether the secret requires authentication before use.
-    var requiresAuthentication: Bool { get }
     /// The public key data for the secret.
     var publicKey: Data { get }
 
@@ -19,8 +17,6 @@ public protocol Secret: Identifiable, Hashable {
 /// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported.
 public enum Algorithm: Hashable {
 
-    case rsa
-    case ed25519
     case ellipticCurve
 
     /// Initializes the Algorithm with a secAttr representation of an algorithm.

Sources/Packages/Sources/SecretKit/Types/SecretStore.swift

@@ -20,14 +20,8 @@ public protocol SecretStore: ObservableObject, Identifiable {
     ///   - data: The data to sign.
     ///   - secret: The ``Secret`` to sign with.
     ///   - provenance: A ``SigningRequestProvenance`` describing where the request came from.
-    /// - Returns: The signed data.
+    /// - Returns: A ``SignedData`` object, containing the signature and metadata about the signature process.
-    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data
+    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> SignedData
-
-    /// Checks to see if there is currently a valid persisted authentication for a given secret.
-    /// - Parameters:
-    ///   - secret: The ``Secret`` to check if there is a persisted authentication for.
-    /// - Returns: A persisted authentication context, if a valid one exists.
-    func existingPersistedAuthenticationContext(secret: SecretType) -> PersistedAuthenticationContext?
 
     /// Persists user authorization for access to a secret.
     /// - Parameters:
@@ -62,9 +56,6 @@ public protocol SecretStoreModifiable: SecretStore {
 
 extension NSNotification.Name {
 
-    // Distributed notification that keys were modified out of process (ie, that the management tool added/removed secrets)
     public static let secretStoreUpdated = NSNotification.Name("com.maxgoedjen.Secretive.secretStore.updated")
-    // Internal notification that keys were reloaded from the backing store.
-    public static let secretStoreReloaded = NSNotification.Name("com.maxgoedjen.Secretive.secretStore.reloaded")
 
 }

Sources/Packages/Sources/SecretKit/Types/SignedData.swift

@@ -0,0 +1,20 @@
+import Foundation
+
+/// Describes the output of a sign request.
+public struct SignedData {
+
+    /// The signed data.
+    public let data: Data
+    /// A boolean describing whether authentication was required during the signature process.
+    public let requiredAuthentication: Bool
+
+    /// Initializes a new SignedData.
+    /// - Parameters:
+    ///   - data: The signed data.
+    ///   - requiredAuthentication: A boolean describing whether authentication was required during the signature process.
+    public init(data: Data, requiredAuthentication: Bool) {
+        self.data = data
+        self.requiredAuthentication = requiredAuthentication
+    }
+
+}

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveSecret.swift

@@ -11,7 +11,6 @@ extension SecureEnclave {
         public let name: String
         public let algorithm = Algorithm.ellipticCurve
         public let keySize = 256
-        public let requiresAuthentication: Bool
         public let publicKey: Data
 
     }

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift

@@ -24,7 +24,7 @@ extension SecureEnclave {
         /// Initializes a Store.
         public init() {
             DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { _ in
-                self.reloadSecrets(notifyAgent: false)
+                self.reloadSecrets(notify: false)
             }
             loadSecrets()
         }
@@ -100,7 +100,7 @@ extension SecureEnclave {
             reloadSecrets()
         }
         
-        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> SignedData {
             let context: LAContext
             if let existing = persistedAuthenticationContexts[secret], existing.valid {
                 context = existing.context
@@ -131,15 +131,16 @@ extension SecureEnclave {
             let key = untypedSafe as! SecKey
             var signError: SecurityError?
 
+            let signingStartTime = Date()
             guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
                 throw SigningError(error: signError)
             }
-            return signature as Data
+            let signatureDuration = Date().timeIntervalSince(signingStartTime)
-        }
+            // Hack to determine if the user had to authenticate to sign.
+            // Since there's now way to inspect SecAccessControl to determine (afaict).
+            let requiredAuthentication = signatureDuration > Constants.unauthenticatedThreshold
 
-        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
+            return SignedData(data: signature as Data, requiredAuthentication: requiredAuthentication)
-            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
-            return persisted
         }
 
         public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) throws {
@@ -170,19 +171,18 @@ extension SecureEnclave {
 extension SecureEnclave.Store {
 
     /// Reloads all secrets from the store.
-    /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
+    /// - Parameter notify: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
-    private func reloadSecrets(notifyAgent: Bool = true) {
+    private func reloadSecrets(notify: Bool = true) {
         secrets.removeAll()
         loadSecrets()
-        NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
+        if notify {
-        if notifyAgent {
+            DistributedNotificationCenter.default().post(name: .secretStoreUpdated, object: nil)
-            DistributedNotificationCenter.default().postNotificationName(.secretStoreUpdated, object: nil, deliverImmediately: true)
         }
     }
 
     /// Loads all secrets from the store.
     private func loadSecrets() {
-        let publicAttributes = [
+        let attributes = [
             kSecClass: kSecClassKey,
             kSecAttrKeyType: SecureEnclave.Constants.keyType,
             kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
@@ -191,46 +191,16 @@ extension SecureEnclave.Store {
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
             ] as CFDictionary
-        var publicUntyped: CFTypeRef?
+        var untyped: CFTypeRef?
-        SecItemCopyMatching(publicAttributes, &publicUntyped)
+        SecItemCopyMatching(attributes, &untyped)
-        guard let publicTyped = publicUntyped as? [[CFString: Any]] else { return }
+        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let privateAttributes = [
+        let wrapped: [SecureEnclave.Secret] = typed.map {
-            kSecClass: kSecClassKey,
-            kSecAttrKeyType: SecureEnclave.Constants.keyType,
-            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
-            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-            kSecReturnRef: true,
-            kSecMatchLimit: kSecMatchLimitAll,
-            kSecReturnAttributes: true
-            ] as CFDictionary
-        var privateUntyped: CFTypeRef?
-        SecItemCopyMatching(privateAttributes, &privateUntyped)
-        guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
-        let privateMapped = privateTyped.reduce(into: [:] as [Data: [CFString: Any]]) { partialResult, next in
-            let id = next[kSecAttrApplicationLabel] as! Data
-            partialResult[id] = next
-        }
-        let authNotRequiredAccessControl: SecAccessControl =
-            SecAccessControlCreateWithFlags(kCFAllocatorDefault,
-                                            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
-                                            [.privateKeyUsage],
-                                            nil)!
-
-        let wrapped: [SecureEnclave.Secret] = publicTyped.map {
             let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
             let id = $0[kSecAttrApplicationLabel] as! Data
             let publicKeyRef = $0[kSecValueRef] as! SecKey
             let publicKeyAttributes = SecKeyCopyAttributes(publicKeyRef) as! [CFString: Any]
             let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            let privateKey = privateMapped[id]
+            return SecureEnclave.Secret(id: id, name: name, publicKey: publicKey)
-            let requiresAuth: Bool
-            if let authRequirements = privateKey?[kSecAttrAccessControl] {
-                // Unfortunately we can't inspect the access control object directly, but it does behave predicatable with equality.
-                requiresAuth = authRequirements as! SecAccessControl != authNotRequiredAccessControl
-            } else {
-                requiresAuth = false
-            }
-            return SecureEnclave.Secret(id: id, name: name, requiresAuthentication: requiresAuth, publicKey: publicKey)
         }
         secrets.append(contentsOf: wrapped)
     }
@@ -293,7 +263,7 @@ extension SecureEnclave {
 extension SecureEnclave {
 
     /// A context describing a persisted authentication.
-    private struct PersistentAuthenticationContext: PersistedAuthenticationContext {
+    private struct PersistentAuthenticationContext {
 
         /// The Secret to persist authentication for.
         let secret: Secret
@@ -301,7 +271,7 @@ extension SecureEnclave {
         let context: LAContext
         /// An expiration date for the context.
         /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
-        let monotonicExpiration: UInt64
+        let expiration: UInt64
 
         /// Initializes a context.
         /// - Parameters:
@@ -312,18 +282,12 @@ extension SecureEnclave {
             self.secret = secret
             self.context = context
             let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
-            self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
+            self.expiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
         }
 
         /// A boolean describing whether or not the context is still valid.
         var valid: Bool {
-            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
+            clock_gettime_nsec_np(CLOCK_MONOTONIC) < expiration
-        }
-
-        var expiration: Date {
-            let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
-            let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
-            return Date(timeIntervalSinceNow: remainingInSeconds)
         }
     }
 

Sources/Packages/Sources/SmartCardSecretKit/SmartCardSecret.swift

@@ -11,7 +11,6 @@ extension SmartCard {
         public let name: String
         public let algorithm: Algorithm
         public let keySize: Int
-        public let requiresAuthentication: Bool = false
         public let publicKey: Data
 
     }

Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift

@@ -44,7 +44,7 @@ extension SmartCard {
             fatalError("Keys must be deleted on the smart card.")
         }
 
-        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> SignedData {
             guard let tokenID = tokenID else { fatalError() }
             let context = LAContext()
             context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
@@ -79,11 +79,7 @@ extension SmartCard {
             guard let signature = SecKeyCreateSignature(key, signatureAlgorithm, data as CFData, &signError) else {
                 throw SigningError(error: signError)
             }
-            return signature as Data
+            return SignedData(data: signature as Data, requiredAuthentication: false)
-        }
-
-        public func existingPersistedAuthenticationContext(secret: SmartCard.Secret) -> PersistedAuthenticationContext? {
-            nil
         }
 
         public func persistAuthentication(secret: SmartCard.Secret, forDuration: TimeInterval) throws {

Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift

@@ -49,7 +49,7 @@ extension Stub {
             print("Public Key OpenSSH: \(OpenSSHKeyWriter().openSSHString(secret: secret))")
         }
 
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> SignedData {
             guard !shouldThrow else {
                 throw NSError(domain: "test", code: 0, userInfo: nil)
             }
@@ -68,11 +68,7 @@ extension Stub {
             default:
                 fatalError()
             }
-            return SecKeyCreateSignature(privateKey, signatureAlgorithm, data as CFData, nil)! as Data
+            return SignedData(data: SecKeyCreateSignature(privateKey, signatureAlgorithm, data as CFData, nil)! as Data, requiredAuthentication: false)
-        }
-
-        public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {
-            nil
         }
 
         public func persistAuthentication(secret: Stub.Secret, forDuration duration: TimeInterval) throws {
@@ -92,7 +88,6 @@ extension Stub {
 
         let keySize: Int
         let publicKey: Data
-        let requiresAuthentication = false
         let privateKey: Data
 
         init(keySize: Int, publicKey: Data, privateKey: Data) {

Sources/Packages/Tests/SecretAgentKitTests/StubWitness.swift

@@ -17,7 +17,7 @@ func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: A
         }
     }
 
-func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
+func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) throws {
         witness(secret, provenance)
     }
 

Sources/SecretAgent/AppDelegate.swift

@@ -16,7 +16,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         list.add(store: SmartCard.Store())
         return list
     }()
-    private let updater = Updater(checkOnLaunch: false)
+    private let updater = Updater()
     private let notifier = Notifier()
     private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
     private lazy var agent: Agent = {
@@ -33,15 +33,15 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         DispatchQueue.main.async {
             self.socketController.handler = self.agent.handle(reader:writer:)
         }
-        NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in
+        DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { [self] _ in
             try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
         }
         try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
         notifier.prompt()
-        updateSink = updater.$update.sink { update in
+//        updateSink = updater.$update.sink { update in
-            guard let update = update else { return }
+//            guard let update = update else { return }
-            self.notifier.notify(update: update, ignore: self.updater.ignore(release:))
+//            self.notifier.notify(update: update, ignore: self.updater.ignore(release:))
-        }
+//        }
     }
 
 }

Sources/SecretAgent/Notifier.swift

@@ -57,7 +57,7 @@ class Notifier {
         notificationCenter.requestAuthorization(options: .alert) { _, _ in }
     }
 
-    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) {
+    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) {
         notificationDelegate.pendingPersistableSecrets[secret.id.description] = secret
         notificationDelegate.pendingPersistableStores[store.id.description] = store
         let notificationCenter = UNUserNotificationCenter.current()
@@ -69,7 +69,7 @@ class Notifier {
         if #available(macOS 12.0, *) {
             notificationContent.interruptionLevel = .timeSensitive
         }
-        if secret.requiresAuthentication && store.existingPersistedAuthenticationContext(secret: secret) == nil {
+        if requiredAuthentication {
             notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
         }
         if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
@@ -106,8 +106,8 @@ extension Notifier: SigningWitness {
     func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
     }
 
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) throws {
-        notify(accessTo: secret, from: store, by: provenance)
+        notify(accessTo: secret, from: store, by: provenance, requiredAuthentication: requiredAuthentication)
     }
 
 }

Sources/Secretive.xcodeproj/project.pbxproj

@@ -47,8 +47,6 @@
 		50A3B79124026B7600D209EA /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79024026B7600D209EA /* Assets.xcassets */; };
 		50A3B79424026B7600D209EA /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79324026B7600D209EA /* Preview Assets.xcassets */; };
 		50A3B79724026B7600D209EA /* Main.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 50A3B79524026B7600D209EA /* Main.storyboard */; };
-		50A63F6B27E7DC5700085D7B /* ProxyAgentSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 50A63F6A27E7DC5700085D7B /* ProxyAgentSecretKit */; };
-		50A63F6D27E7E04800085D7B /* ProxyAgentSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 50A63F6C27E7E04800085D7B /* ProxyAgentSecretKit */; };
 		50B8550D24138C4F009958AC /* DeleteSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50B8550C24138C4F009958AC /* DeleteSecretView.swift */; };
 		50BB046B2418AAAE00D6E079 /* EmptyStoreView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */; };
 		50C385A52407A76D00AF2719 /* SecretDetailView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50C385A42407A76D00AF2719 /* SecretDetailView.swift */; };
@@ -156,7 +154,6 @@
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				50A63F6D27E7E04800085D7B /* ProxyAgentSecretKit in Frameworks */,
 				5003EF3B278005E800DF2006 /* SecretKit in Frameworks */,
 				501421622781262300BBAA70 /* Brief in Frameworks */,
 				5003EF5F2780081600DF2006 /* SecureEnclaveSecretKit in Frameworks */,
@@ -177,7 +174,6 @@
 			files = (
 				5003EF3D278005F300DF2006 /* Brief in Frameworks */,
 				5003EF632780081B00DF2006 /* SecureEnclaveSecretKit in Frameworks */,
-				50A63F6B27E7DC5700085D7B /* ProxyAgentSecretKit in Frameworks */,
 				5003EF652780081B00DF2006 /* SmartCardSecretKit in Frameworks */,
 				5003EF3F278005F300DF2006 /* SecretAgentKit in Frameworks */,
 				5003EF41278005FA00DF2006 /* SecretKit in Frameworks */,
@@ -349,7 +345,6 @@
 				5003EF5E2780081600DF2006 /* SecureEnclaveSecretKit */,
 				5003EF602780081600DF2006 /* SmartCardSecretKit */,
 				501421612781262300BBAA70 /* Brief */,
-				50A63F6C27E7E04800085D7B /* ProxyAgentSecretKit */,
 			);
 			productName = Secretive;
 			productReference = 50617D7F23FCE48E0099B055 /* Secretive.app */;
@@ -393,7 +388,6 @@
 				5003EF40278005FA00DF2006 /* SecretKit */,
 				5003EF622780081B00DF2006 /* SecureEnclaveSecretKit */,
 				5003EF642780081B00DF2006 /* SmartCardSecretKit */,
-				50A63F6A27E7DC5700085D7B /* ProxyAgentSecretKit */,
 			);
 			productName = SecretAgent;
 			productReference = 50A3B78A24026B7500D209EA /* SecretAgent.app */;
@@ -1027,14 +1021,6 @@
 			isa = XCSwiftPackageProductDependency;
 			productName = Brief;
 		};
-		50A63F6A27E7DC5700085D7B /* ProxyAgentSecretKit */ = {
-			isa = XCSwiftPackageProductDependency;
-			productName = ProxyAgentSecretKit;
-		};
-		50A63F6C27E7E04800085D7B /* ProxyAgentSecretKit */ = {
-			isa = XCSwiftPackageProductDependency;
-			productName = ProxyAgentSecretKit;
-		};
 /* End XCSwiftPackageProductDependency section */
 	};
 	rootObject = 50617D7723FCE48D0099B055 /* Project object */;

Sources/Secretive/App.swift

@@ -16,6 +16,7 @@ struct Secretive: App {
     }()
     private let agentStatusChecker = AgentStatusChecker()
     private let justUpdatedChecker = JustUpdatedChecker()
+    private let updater = Updater()
 
     @AppStorage("defaultsHasRunSetup") var hasRunSetup = false
     @State private var showingSetup = false
@@ -25,11 +26,15 @@ struct Secretive: App {
         WindowGroup {
             ContentView<Updater, AgentStatusChecker>(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup)
                 .environmentObject(storeList)
-                .environmentObject(Updater(checkOnLaunch: hasRunSetup))
+                .environmentObject(updater)
                 .environmentObject(agentStatusChecker)
                 .onAppear {
                     if !hasRunSetup {
                         showingSetup = true
+                    } else {
+                        Task { [updater] in
+                            await updater.checkForUpdates()
+                        }
                     }
                 }
                 .onReceive(NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)) { _ in

Sources/Secretive/Preview Content/PreviewStore.swift

@@ -11,7 +11,6 @@ extension Preview {
         let name: String
         let algorithm = Algorithm.ellipticCurve
         let keySize = 256
-        let requiresAuthentication: Bool = false
         let publicKey = UUID().uuidString.data(using: .utf8)!
 
     }
@@ -36,12 +35,8 @@ extension Preview {
             self.secrets.append(contentsOf: new)
         }
 
-        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
+        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> SignedData {
-            return data
+            return SignedData(data: data, requiredAuthentication: false)
-        }
-
-        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
-            nil
         }
 
         func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws {

Sources/Secretive/Views/ContentView.swift

@@ -32,9 +32,6 @@ struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentSt
             appPathNotice
             newItem
         }
-        .sheet(isPresented: $runningSetup) {
-            SetupView(visible: $runningSetup, setupComplete: $hasRunSetup)
-        }
     }
 
 }
@@ -68,11 +65,11 @@ extension ContentView {
                         .font(.headline)
                         .foregroundColor(.white)
                 })
-                .background(color)
+                    .background(color)
-                .cornerRadius(5)
+                    .cornerRadius(5)
-                .popover(item: $selectedUpdate, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) { update in
+                    .popover(item: $selectedUpdate, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) { update in
-                    UpdateDetailView(update: update)
+                        UpdateDetailView(update: update)
-                }
+                    }
             )
         }
     }
@@ -88,11 +85,11 @@ extension ContentView {
                 }, label: {
                     Image(systemName: "plus")
                 })
-                .popover(isPresented: $showingCreation, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
+                    .popover(isPresented: $showingCreation, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
-                    if let modifiable = storeList.modifiableStore {
+                        if let modifiable = storeList.modifiableStore {
-                        CreateSecretView(store: modifiable, showing: $showingCreation)
+                            CreateSecretView(store: modifiable, showing: $showingCreation)
+                        }
                     }
-                }
 
             )
         }
@@ -116,12 +113,15 @@ extension ContentView {
                             .font(.headline)
                             .foregroundColor(.white)
                         })
-                        .background(Color.orange)
+                            .background(Color.orange)
-                        .cornerRadius(5)
+                            .cornerRadius(5)
                     } else {
                         EmptyView()
                     }
                 }
+                    .sheet(isPresented: $runningSetup) {
+                        SetupView(visible: $runningSetup, setupComplete: $hasRunSetup)
+                    }
             )
         }
     }
@@ -142,19 +142,19 @@ extension ContentView {
                     .font(.headline)
                     .foregroundColor(.white)
                 })
-                .background(Color.orange)
+                    .background(Color.orange)
-                .cornerRadius(5)
+                    .cornerRadius(5)
-                .popover(isPresented: $showingAppPathNotice, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
+                    .popover(isPresented: $showingAppPathNotice, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
-                    VStack {
+                        VStack {
-                        Image(systemName: "exclamationmark.triangle")
+                            Image(systemName: "exclamationmark.triangle")
-                            .resizable()
+                                .resizable()
-                            .aspectRatio(contentMode: .fit)
+                                .aspectRatio(contentMode: .fit)
-                            .frame(width: 64)
+                                .frame(width: 64)
-                        Text("Secretive needs to be in your Applications folder to work properly. Please move it and relaunch.")
+                            Text("Secretive needs to be in your Applications folder to work properly. Please move it and relaunch.")
-                            .frame(maxWidth: 300)
+                                .frame(maxWidth: 300)
+                        }
+                        .padding()
                     }
-                    .padding()
-                }
             )
         }
     }

Sources/Secretive/Views/SecretListItemView.swift

@@ -20,15 +20,7 @@ struct SecretListItemView: View {
         )
 
         return NavigationLink(destination: SecretDetailView(secret: secret), tag: secret.id, selection: $activeSecret) {
-            if secret.requiresAuthentication {
+            Text(secret.name)
-                HStack {
-                    Text(secret.name)
-                    Spacer()
-                    Image(systemName: "lock")
-                }
-            } else {
-                Text(secret.name)
-            }
         }.contextMenu {
             if store is AnySecretStoreModifiable {
                 Button(action: { isRenaming = true }) {

Sources/Secretive/Views/UpdateView.swift

@@ -18,7 +18,9 @@ struct UpdateDetailView<UpdaterType: Updater>: View {
             HStack {
                 if !update.critical {
                     Button("Ignore") {
-                        updater.ignore(release: update)
+                        Task { [updater, update] in
+                            await updater.ignore(release: update)
+                        }
                     }
                     Spacer()
                 }