Move file

.github/workflows/add-to-project.yml

@@ -10,7 +10,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.1
+      - uses: actions/add-to-project@v0.0.3
         with:
           project-url: https://github.com/users/maxgoedjen/projects/1
           github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/nightly.yml

@@ -5,11 +5,10 @@ on:
     - cron: "0 8 * * *"
 jobs:
   build:
-#     runs-on: macOS-latest
+    runs-on: macOS-latest
-    runs-on: macos-15
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v2
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -20,7 +19,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
     - name: Update Build Number
       env:
         RUN_ID: ${{ github.run_id }}
@@ -48,7 +47,7 @@ jobs:
             shasum -a 256 Secretive.zip
             shasum -a 256 Archive.zip
     - name: Upload App to Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v1
       with:
         name: Secretive.zip
         path: Secretive.zip

.github/workflows/release.yml

@@ -6,11 +6,10 @@ on:
       - '*'
 jobs:
   test:
-#     runs-on: macOS-latest
+    runs-on: macOS-latest
-    runs-on: macos-15
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v1
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -21,18 +20,17 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
     - name: Test
       run: |
             pushd Sources/Packages
             swift test
             popd
   build:
-#     runs-on: macOS-latest
+    runs-on: macOS-latest
-    runs-on: macos-15
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v2
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -43,7 +41,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
     - name: Update Build Number
       env:
         TAG_NAME: ${{ github.ref }}
@@ -107,12 +105,12 @@ jobs:
         asset_name: Secretive.zip
         asset_content_type: application/zip
     - name: Upload App to Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v1
       with:
         name: Secretive.zip
         path: Secretive.zip
     - name: Upload Archive to Artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v1
       with:
         name: Xcode_Archive.zip
         path: Archive.zip

.github/workflows/test.yml

@@ -3,13 +3,12 @@ name: Test
 on: [push, pull_request]
 jobs:
   test:
-#     runs-on: macOS-latest
+    runs-on: macOS-latest
-    runs-on: macos-15
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v2
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
     - name: Test
       run: |
             pushd Sources/Packages

CONTRIBUTING.md

@@ -14,10 +14,6 @@ Secretive is designed to be easily auditable by people who are considering using
 
 All contributors must abide by the [Code of Conduct](CODE_OF_CONDUCT.md)
 
-## Localization
-
-If you'd like to contribute a translation, please see [Localizing](LOCALIZING.md) to get started.
-
 ## Credits
 
 If you make a material contribution to the app, please add yourself to the end of the [credits](https://github.com/maxgoedjen/secretive/blob/main/Secretive/Credits.rtf).

FAQ.md

@@ -32,10 +32,6 @@ Try running the "Setup Secretive" process by clicking on "Help", then "Setup Sec
 
 Beginning with Secretive 2.2, every secret has an automatically generated public key file representation on disk, and the path to it is listed under "Public Key Path" in Secretive. You can specify that you want to use that key in your `~/.ssh/config`.  [This ServerFault answer](https://serverfault.com/a/295771) has more details on setting that up.
 
-### How can I generate an RSA key?
-
-The Mac's Secure Enclave only supports 256-bit EC keys, so inherently Secretive cannot support generating RSA keys.
-
 ### Can I use Secretive for SSH Agent Forwarding?
 
 Yes, you can! Once you've set up Secretive, just add `ForwardAgent yes` to the hosts you want to forward to in your SSH config file. Afterwards, any use of one of your SSH keys on the remote host must be authenticated through Secretive.

LOCALIZING.md

@@ -1,37 +0,0 @@
-# Localizing Secretive
-
-If you speak another language, and would like to help translate Secretive to support that language, we'd love your help!
-
-## Getting Started
-
-### Download Xcode
-
-Download the latest version of Xcode (at minimum, Xcode 15) from [Apple](http://developer.apple.com/download/applications/).
-
-### Clone Secretive
-
-Clone Secretive using [these instructions from GitHub](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository).
-
-### Open Secretive
-
-Open [Sources/Secretive.xcodeproj](Sources/Secretive.xcodeproj) in Xcode.
-
-### Translate
-
-Navigate to [Secretive/Localizable](Sources/Secretive/Localizable.xcstrings). 
-
-<img src="/.github/readme/localize_sidebar.png" alt="Screenshot of Xcode navigating to the Localizable file" width="300">
-
-If your language already has an in-progress localization, select it from the list. If it isn't there, hit the "+" button and choose your language from the list.
-
-<img src="/.github/readme/localize_add.png" alt="Screenshot of Xcode adding a new language" width="600">
-
-Start translating! You'll see a list of english phrases, and a space to add a translation of your language.
-
-### Create a Pull Request
-
-Push your changes and open a pull request. 
-
-### Questions
-
-Please open an issue if you have a question about translating the app. I'm more than happy to clarify any terms that are ambiguous or confusing. Thanks for contributing!

README.md

@@ -3,10 +3,7 @@
 
 Secretive is an app for storing and managing SSH keys in the Secure Enclave. It is inspired by the [sekey project](https://github.com/sekey/sekey), but rewritten in Swift with no external dependencies and with a handy native management app.
 
-<picture>
+<img src="/.github/readme/app.png" alt="Screenshot of Secretive" width="600">
-  <source media="(prefers-color-scheme: dark)" srcset="/.github/readme/app-dark.png">
-  <img src="/.github/readme/app-light.png" alt="Screenshot of Secretive" width="600">
-</picture>
 
 
 ## Why?
@@ -17,7 +14,7 @@ The most common setup for SSH keys is just keeping them on disk, guarded by prop
 
 ### Access Control
 
-If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your keys so that they require Touch ID (or Watch) authentication before they're accessed.
+If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed.
 
 <img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID" width="400">
 

Sources/Packages/Package.swift

@@ -1,4 +1,4 @@
-// swift-tools-version:6.0
+// swift-tools-version:5.5
 // The swift-tools-version declares the minimum version of Swift required to build this package.
 
 import PackageDescription
@@ -6,7 +6,7 @@ import PackageDescription
 let package = Package(
     name: "SecretivePackages",
     platforms: [
-        .macOS(.v15)
+        .macOS(.v11)
     ],
     products: [
         .library(
@@ -33,28 +33,23 @@ let package = Package(
     targets: [
         .target(
             name: "SecretKit",
-            dependencies: [],
+            dependencies: []
-            swiftSettings: swiftSettings
         ),
         .testTarget(
             name: "SecretKitTests",
-            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
+            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"]
-            swiftSettings: swiftSettings
         ),
         .target(
             name: "SecureEnclaveSecretKit",
-            dependencies: ["SecretKit"],
+            dependencies: ["SecretKit"]
-            swiftSettings: swiftSettings
         ),
         .target(
             name: "SmartCardSecretKit",
-            dependencies: ["SecretKit"],
+            dependencies: ["SecretKit"]
-            swiftSettings: swiftSettings
         ),
         .target(
             name: "SecretAgentKit",
-            dependencies: ["SecretKit", "SecretAgentKitHeaders"],
+            dependencies: ["SecretKit", "SecretAgentKitHeaders"]
-            swiftSettings: swiftSettings
         ),
         .systemLibrary(
             name: "SecretAgentKitHeaders"
@@ -73,10 +68,3 @@ let package = Package(
         ),
     ]
 )
-
-var swiftSettings: [PackageDescription.SwiftSetting] {
-    [
-        .swiftLanguageMode(.v6),
-        .unsafeFlags(["-warnings-as-errors"])
-    ]
-}

Sources/Packages/Sources/Brief/Release.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// A release is a representation of a downloadable update.
-public struct Release: Codable, Sendable {
+public struct Release: Codable {
 
     /// The user-facing name of the release. Typically "Secretive 1.2.3"
     public let name: String

Sources/Packages/Sources/Brief/SemVer.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// A representation of a Semantic Version.
-public struct SemVer: Sendable {
+public struct SemVer {
 
     /// The SemVer broken into an array of integers.
     let versionNumbers: [Int]

Sources/Packages/Sources/Brief/Updater.swift

@@ -1,14 +1,10 @@
 import Foundation
-import Observation
+import Combine
-import Synchronization
 
 /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
-@Observable public final class Updater: UpdaterProtocol, ObservableObject, Sendable {
+public class Updater: ObservableObject, UpdaterProtocol {
 
-    public var update: Release? {
+    @Published public var update: Release?
-        _update.withLock { $0 }
-    }
-    private let _update: Mutex<Release?> = .init(nil)
     public let testBuild: Bool
 
     /// The current OS version.
@@ -28,34 +24,30 @@ import Synchronization
         testBuild = currentVersion == SemVer("0.0.0")
         if checkOnLaunch {
             // Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet.
-            Task {
+            checkForUpdates()
-                await checkForUpdates()
-            }
         }
-        Task {
+        let timer = Timer.scheduledTimer(withTimeInterval: checkFrequency, repeats: true) { _ in
-            while !Task.isCancelled {
+            self.checkForUpdates()
-                try? await Task.sleep(for: .seconds(Int(checkFrequency)))
-                await checkForUpdates()
-            }
         }
+        timer.tolerance = 60*60
     }
 
     /// Manually trigger an update check.
-    public func checkForUpdates() async {
+    public func checkForUpdates() {
-        guard let (data, _) = try? await URLSession.shared.data(from: Constants.updateURL) else { return }
+        URLSession.shared.dataTask(with: Constants.updateURL) { data, _, _ in
-        guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
+            guard let data = data else { return }
-        await evaluate(releases: releases)
+            guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return }
+            self.evaluate(releases: releases)
+        }.resume()
     }
 
     /// Ignores a specified release. `update` will be nil if the user has ignored the latest available release.
     /// - Parameter release: The release to ignore.
-    public func ignore(release: Release) async {
+    public func ignore(release: Release) {
         guard !release.critical else { return }
         defaults.set(true, forKey: release.name)
-        await MainActor.run {
+        DispatchQueue.main.async {
-            _update.withLock { value in
+            self.update = nil
-                value = nil
-            }
         }
     }
 
@@ -65,7 +57,7 @@ extension Updater {
 
     /// Evaluates the available downloadable releases, and selects the newest non-prerelease release that the user is able to run.
     /// - Parameter releases: An array of ``Release`` objects.
-    func evaluate(releases: [Release]) async {
+    func evaluate(releases: [Release]) {
         guard let release = releases
                 .sorted()
                 .reversed()
@@ -75,10 +67,8 @@ extension Updater {
         guard !release.prerelease else { return }
         let latestVersion = SemVer(release.name)
         if latestVersion > currentVersion {
-            await MainActor.run {
+            DispatchQueue.main.async {
-                _update.withLock { value in
+                self.update = release
-                    value = release
-                }
             }
         }
     }

Sources/Packages/Sources/Brief/UpdaterProtocol.swift

@@ -1,8 +1,7 @@
 import Foundation
-import Synchronization
 
 /// A protocol for retreiving the latest available version of an app.
-public protocol UpdaterProtocol: Observable {
+public protocol UpdaterProtocol: ObservableObject {
 
     /// The latest update
     var update: Release? { get }

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -4,15 +4,34 @@ import OSLog
 import SecretKit
 import AppKit
 
+enum OpenSSHCertificateError: Error {
+    case unsupportedType
+    case parsingFailed
+    case doesNotExist
+}
+
+extension OpenSSHCertificateError: CustomStringConvertible {
+    public var description: String {
+        switch self {
+        case .unsupportedType:
+            return "The key type was unsupported"
+        case .parsingFailed:
+            return "Failed to properly parse the SSH certificate"
+        case .doesNotExist:
+            return "Certificate does not exist"
+        }
+    }
+}
+
 /// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
-public final class Agent: Sendable {
+public class Agent {
 
     private let storeList: SecretStoreList
     private let witness: SigningWitness?
     private let writer = OpenSSHKeyWriter()
     private let requestTracer = SigningRequestTracer()
-    private let certificateHandler = OpenSSHCertificateHandler()
+    private let certsPath = (NSHomeDirectory() as NSString).appendingPathComponent("PublicKeys") as String
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Agent")
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent.agent", category: "")
 
     /// Initializes an agent with a store list and a witness.
     /// - Parameters:
@@ -22,7 +41,6 @@ public final class Agent: Sendable {
         logger.debug("Agent is running")
         self.storeList = storeList
         self.witness = witness
-        certificateHandler.reloadCertificates(for: storeList.allSecrets)
     }
     
 }
@@ -35,7 +53,7 @@ extension Agent {
     ///   - writer: A ``FileHandleWriter`` to write the response to.
     /// - Return value: 
     ///   - Boolean if data could be read
-    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) async -> Bool {
+    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) -> Bool {
         logger.debug("Agent handling new data")
         let data = Data(reader.availableData)
         guard data.count > 4 else { return false}
@@ -47,14 +65,14 @@ extension Agent {
         }
         logger.debug("Agent handling request of type \(requestType.debugDescription)")
         let subData = Data(data[5...])
-        let response = await handle(requestType: requestType, data: subData, reader: reader)
+        let response = handle(requestType: requestType, data: subData, reader: reader)
         writer.write(response)
         return true
     }
 
-    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) async -> Data {
+    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) -> Data {
         // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
-        await reloadSecretsIfNeccessary()
+        reloadSecretsIfNeccessary()
         var response = Data()
         do {
             switch requestType {
@@ -65,7 +83,7 @@ extension Agent {
             case .signRequest:
                 let provenance = requestTracer.provenance(from: reader)
                 response.append(SSHAgent.ResponseType.agentSignResponse.data)
-                response.append(try await sign(data: data, provenance: provenance))
+                response.append(try sign(data: data, provenance: provenance))
                 logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
             }
         } catch {
@@ -84,26 +102,28 @@ extension Agent {
     /// Lists the identities available for signing operations
     /// - Returns: An OpenSSH formatted Data payload listing the identities available for signing operations.
     func identities() -> Data {
-        let secrets = storeList.allSecrets
+        let secrets = storeList.stores.flatMap(\.secrets)
-        certificateHandler.reloadCertificates(for: secrets)
+        var count = UInt32(secrets.count).bigEndian
-        var count = secrets.count
+        let countData = Data(bytes: &count, count: UInt32.bitWidth/8)
         var keyData = Data()
 
         for secret in secrets {
-            let keyBlob = writer.data(secret: secret)
+            let keyBlob: Data
-            let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
+            let curveData: Data
+            
+            if let (certBlob, certName) = try? checkForCert(secret: secret) {
+                keyBlob = certBlob
+                curveData = certName
+            } else {
+                keyBlob = writer.data(secret: secret)
+                curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
+            }
+            
             keyData.append(writer.lengthAndData(of: keyBlob))
             keyData.append(writer.lengthAndData(of: curveData))
             
-            if let (certificateData, name) = try? certificateHandler.keyBlobAndName(for: secret) {
-                keyData.append(writer.lengthAndData(of: certificateData))
-                keyData.append(writer.lengthAndData(of: name))
-                count += 1
-            }
         }
-        logger.log("Agent enumerated \(count) identities")
+        logger.log("Agent enumerated \(secrets.count) identities")
-        var countBigEndian = UInt32(count).bigEndian
-        let countData = Data(bytes: &countBigEndian, count: UInt32.bitWidth/8)
         return countData + keyData
     }
 
@@ -112,15 +132,13 @@ extension Agent {
     ///   - data: The data to sign.
     ///   - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request.
     /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
-    func sign(data: Data, provenance: SigningRequestProvenance) async throws -> Data {
+    func sign(data: Data, provenance: SigningRequestProvenance) throws -> Data {
         let reader = OpenSSHReader(data: data)
-        let payloadHash = reader.readNextChunk()
+        var hash = reader.readNextChunk()
-        let hash: Data
+        
         // Check if hash is actually an openssh certificate and reconstruct the public key if it is
-        if let certificatePublicKey = certificateHandler.publicKeyHash(from: payloadHash) {
+        if let certPublicKey = try? getPublicKeyFromCert(certBlob: hash) {
-            hash = certificatePublicKey
+            hash = certPublicKey
-        } else {
-            hash = payloadHash
         }
         
         guard let (store, secret) = secret(matching: hash) else {
@@ -129,11 +147,11 @@ extension Agent {
         }
 
         if let witness = witness {
-            try await witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
+            try witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance)
         }
 
         let dataToSign = reader.readNextChunk()
-        let signed = try await store.sign(data: dataToSign, with: secret, for: provenance)
+        let signed = try store.sign(data: dataToSign, with: secret, for: provenance)
         let derSignature = signed
 
         let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
@@ -175,24 +193,92 @@ extension Agent {
         signedData.append(writer.lengthAndData(of: sub))
 
         if let witness = witness {
-            try await witness.witness(accessTo: secret, from: store, by: provenance)
+            try witness.witness(accessTo: secret, from: store, by: provenance)
         }
 
         logger.debug("Agent signed request")
 
         return signedData
     }
+    
+    /// Reconstructs a public key from a ``Data`` object that contains an OpenSSH certificate. Currently only ecdsa certificates are supported
+    /// - Parameter certBlock: The openssh certificate to extract the public key from
+    /// - Returns: A ``Data`` object containing the public key in OpenSSH wire format
+    func getPublicKeyFromCert(certBlob: Data) throws -> Data {
+        let reader = OpenSSHReader(data: certBlob)
+        let certType = String(decoding: reader.readNextChunk(), as: UTF8.self)
+                
+        switch certType {
+        case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
+            "ecdsa-sha2-nistp384-cert-v01@openssh.com",
+            "ecdsa-sha2-nistp521-cert-v01@openssh.com":
+            
+            _ = reader.readNextChunk() // nonce
+            let curveIdentifier = reader.readNextChunk()
+            let publicKey = reader.readNextChunk()
+            
+            if let curveType = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "").data(using: .utf8) {
+                return writer.lengthAndData(of: curveType) +
+                       writer.lengthAndData(of: curveIdentifier) +
+                       writer.lengthAndData(of: publicKey)
+            } else {
+                throw OpenSSHCertificateError.parsingFailed
+            }
+        default:
+            throw OpenSSHCertificateError.unsupportedType
+        }
+    }
+    
+    
+    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
+    /// - Parameter secret: The secret to search for a certificate with
+    /// - Returns: Two ``Data`` objects containing the certificate and certificate name respectively
+    func checkForCert(secret: AnySecret) throws -> (Data, Data) {
+        let minimalHex = writer.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        let certificatePath = certsPath.appending("/").appending("\(minimalHex)-cert.pub")
+        
+        if FileManager.default.fileExists(atPath: certificatePath) {
+            logger.debug("Found certificate for \(secret.name)")
+            do {
+                let certContent = try String(contentsOfFile:certificatePath, encoding: .utf8)
+                let certElements = certContent.trimmingCharacters(in: .whitespacesAndNewlines).components(separatedBy: " ")
+                
+                if certElements.count >= 2 {
+                    if let certDecoded = Data(base64Encoded: certElements[1] as String) {
+                        if certElements.count >= 3 {
+                            if let certName = certElements[2].data(using: .utf8) {
+                                return (certDecoded, certName)
+                            } else if let certName = secret.name.data(using: .utf8) {
+                                logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
+                                return (certDecoded, certName)
+                            } else {
+                                throw OpenSSHCertificateError.parsingFailed
+                            }
+                        }
+                    } else {
+                        logger.warning("Certificate found for \(secret.name) but failed to decode base64 key")
+                        throw OpenSSHCertificateError.parsingFailed
+                    }
+                }
+            } catch {
+                logger.warning("Certificate found for \(secret.name) but failed to load")
+                throw OpenSSHCertificateError.parsingFailed
+            }
+        }
+        
+        throw OpenSSHCertificateError.doesNotExist
+    }
 
 }
 
 extension Agent {
 
     /// Gives any store with no loaded secrets a chance to reload.
-    func reloadSecretsIfNeccessary() async {
+    func reloadSecretsIfNeccessary() {
         for store in storeList.stores {
             if store.secrets.isEmpty {
                 logger.debug("Store \(store.name, privacy: .public) has no loaded secrets. Reloading.")
-                await store.reloadSecrets()
+                store.reloadSecrets()
             }
         }
     }
@@ -222,7 +308,6 @@ extension Agent {
         case unhandledType
         case noMatchingKey
         case unsupportedKeyType
-        case notOpenSSHCertificate
     }
 
 }

Sources/Packages/Sources/SecretAgentKit/FileHandleProtocols.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// Protocol abstraction of the reading aspects of FileHandle.
-public protocol FileHandleReader: Sendable {
+public protocol FileHandleReader {
 
     /// Gets data that is available for reading.
     var availableData: Data { get }
@@ -13,7 +13,7 @@ public protocol FileHandleReader: Sendable {
 }
 
 /// Protocol abstraction of the writing aspects of FileHandle.
-public protocol FileHandleWriter: Sendable {
+public protocol FileHandleWriter {
 
     /// Writes data to the handle.
     func write(_ data: Data)

Sources/Packages/Sources/SecretAgentKit/SSHAgentProtocol.swift

@@ -1,11 +1,11 @@
 import Foundation
 
-/// A namespace for the SSH Agent Protocol, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
+/// A namespace for the SSH Agent Protocol, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html
 public enum SSHAgent {}
 
 extension SSHAgent {
 
-    /// The type of the SSH Agent Request, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
+    /// The type of the SSH Agent Request, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html#rfc.section.5.1
     public enum RequestType: UInt8, CustomDebugStringConvertible {
 
         case requestIdentities = 11
@@ -21,11 +21,10 @@ extension SSHAgent {
         }
     }
 
-    /// The type of the SSH Agent Response, as described in https://datatracker.ietf.org/doc/html/draft-miller-ssh-agent#section-5.1
+    /// The type of the SSH Agent Response, as described in https://tools.ietf.org/id/draft-miller-ssh-agent-01.html#rfc.section.5.1
     public enum ResponseType: UInt8, CustomDebugStringConvertible {
         
         case agentFailure = 5
-        case agentSuccess = 6
         case agentIdentitiesAnswer = 12
         case agentSignResponse = 14
 
@@ -33,8 +32,6 @@ extension SSHAgent {
             switch self {
             case .agentFailure:
                 return "AgentFailure"
-            case .agentSuccess:
-                return "AgentSuccess"
             case .agentIdentitiesAnswer:
                 return "AgentIdentitiesAnswer"
             case .agentSignResponse:

Sources/Packages/Sources/SecretAgentKit/Sendability.swift

@@ -1,11 +0,0 @@
-import Foundation
-
-struct UncheckedSendable<T>: @unchecked Sendable {
-
-    let value: T
-
-    init(_ value: T) {
-        self.value = value
-    }
-
-}

Sources/Packages/Sources/SecretAgentKit/SigningRequestTracer.swift

@@ -60,10 +60,7 @@ extension SigningRequestTracer {
     func iconURL(for pid: Int32) -> URL? {
         do {
             if let app = NSRunningApplication(processIdentifier: pid), let icon = app.icon?.tiffRepresentation {
-                let temporaryURL = URL(fileURLWithPath: (NSTemporaryDirectory() as NSString).appendingPathComponent("\(app.bundleIdentifier ?? UUID().uuidString).png"))
+                let temporaryURL = URL(fileURLWithPath: (NSTemporaryDirectory() as NSString).appendingPathComponent("\(UUID().uuidString).png"))
-                if FileManager.default.fileExists(atPath: temporaryURL.path) {
-                    return temporaryURL
-                }
                 let bitmap = NSBitmapImageRep(data: icon)
                 try bitmap?.representation(using: .png, properties: [:])?.write(to: temporaryURL)
                 return temporaryURL

Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift

@@ -2,7 +2,7 @@ import Foundation
 import SecretKit
 
 /// A protocol that allows conformers to be notified of access to secrets, and optionally prevent access.
-public protocol SigningWitness: Sendable {
+public protocol SigningWitness {
 
     /// A ridiculously named method that notifies the callee that a signing operation is about to be performed using a secret. The callee may `throw` an `Error` to prevent access from occurring.
     /// - Parameters:
@@ -10,13 +10,13 @@ public protocol SigningWitness: Sendable {
     ///   - store: The `Store` being asked to sign the request..
     ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
     ///   - Note: This method being called does not imply that the requst has been authorized. If a secret requires authentication, authentication will still need to be performed by the user before the request will be performed. If the user declines or fails to authenticate, the request will fail.
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws
 
     /// Notifies the callee that a signing operation has been performed for a given secret.
     /// - Parameters:
     ///   - secret: The `Secret` that will was used to sign the request.
     ///   - store: The `Store` that signed the request..
     ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws
 
 }

Sources/Packages/Sources/SecretAgentKit/SocketController.swift

@@ -2,7 +2,7 @@ import Foundation
 import OSLog
 
 /// A controller that manages socket configuration and request dispatching.
-public final class SocketController {
+public class SocketController {
 
     /// The active FileHandle.
     private var fileHandle: FileHandle?
@@ -10,24 +10,22 @@ public final class SocketController {
     private var port: SocketPort?
     /// A handler that will be notified when a new read/write handle is available.
     /// False if no data could be read
-    public var handler: (@Sendable (FileHandleReader, FileHandleWriter) async -> Bool)?
+    public var handler: ((FileHandleReader, FileHandleWriter) -> Bool)?
-    /// Logger.
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "SocketController")
 
 
     /// Initializes a socket controller with a specified path.
     /// - Parameter path: The path to use as a socket.
     public init(path: String) {
-        logger.debug("Socket controller setting up at \(path)")
+        Logger().debug("Socket controller setting up at \(path)")
         if let _ = try? FileManager.default.removeItem(atPath: path) {
-            logger.debug("Socket controller removed existing socket")
+            Logger().debug("Socket controller removed existing socket")
         }
         let exists = FileManager.default.fileExists(atPath: path)
         assert(!exists)
-        logger.debug("Socket controller path is clear")
+        Logger().debug("Socket controller path is clear")
         port = socketPort(at: path)
         configureSocket(at: path)
-        logger.debug("Socket listening at \(path)")
+        Logger().debug("Socket listening at \(path)")
     }
 
     /// Configures the socket and a corresponding FileHandle.
@@ -37,7 +35,7 @@ public final class SocketController {
         fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
         NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionAccept(notification:)), name: .NSFileHandleConnectionAccepted, object: nil)
         NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionDataAvailable(notification:)), name: .NSFileHandleDataAvailable, object: nil)
-        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.Mode.common])
+        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
     }
 
     /// Creates a SocketPort for a path.
@@ -67,45 +65,25 @@ public final class SocketController {
     /// Handles a new connection being accepted, invokes the handler, and prepares to accept new connections.
     /// - Parameter notification: A `Notification` that triggered the call.
     @objc func handleConnectionAccept(notification: Notification) {
-        logger.debug("Socket controller accepted connection")
+        Logger().debug("Socket controller accepted connection")
         guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { return }
-        Task { [handler, fileHandle] in
+        _ = handler?(new, new)
-            _ = await handler?(new, new)
+        new.waitForDataInBackgroundAndNotify()
-            await new.waitForDataInBackgroundAndNotifyOnMainActor()
+        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
-            await fileHandle?.acceptConnectionInBackgroundAndNotifyOnMainActor()
-        }
     }
 
     /// Handles a new connection providing data and invokes the handler callback.
     /// - Parameter notification: A `Notification` that triggered the call.
     @objc func handleConnectionDataAvailable(notification: Notification) {
-        logger.debug("Socket controller has new data available")
+        Logger().debug("Socket controller has new data available")
         guard let new = notification.object as? FileHandle else { return }
-        logger.debug("Socket controller received new file handle")
+        Logger().debug("Socket controller received new file handle")
-        Task { [handler, logger = UncheckedSendable(logger)] in
+        if((handler?(new, new)) == true) {
-            if((await handler?(new, new)) == true) {
+            Logger().debug("Socket controller handled data, wait for more data")
-                logger.value.debug("Socket controller handled data, wait for more data")
+            new.waitForDataInBackgroundAndNotify()
-                await new.waitForDataInBackgroundAndNotifyOnMainActor()
+        } else {
-            } else {
+            Logger().debug("Socket controller called with empty data, socked closed")
-                logger.value.debug("Socket controller called with empty data, socked closed")
-            }
         }
     }
 
 }
-
-extension FileHandle {
-    
-    /// Ensures waitForDataInBackgroundAndNotify will be called on the main actor.
-    @MainActor func waitForDataInBackgroundAndNotifyOnMainActor() {
-        waitForDataInBackgroundAndNotify()
-    }
-
-
-    /// Ensures acceptConnectionInBackgroundAndNotify will be called on the main actor.
-    /// - Parameter modes: the runloop modes to use.
-    @MainActor func acceptConnectionInBackgroundAndNotifyOnMainActor(forModes modes: [RunLoop.Mode]? = [RunLoop.Mode.common]) {
-        acceptConnectionInBackgroundAndNotify(forModes: modes)
-    }
-
-}

Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md

@@ -32,9 +32,3 @@ SecretKit is a collection of protocols describing secrets and stores.
 ### Authentication Persistence
 
 - ``PersistedAuthenticationContext``
-
-### Errors
-
-- ``KeychainError``
-- ``SigningError``
-- ``SecurityError``

Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// Type eraser for Secret.
-public struct AnySecret: Secret, @unchecked Sendable {
+public struct AnySecret: Secret {
 
     let base: Any
     private let hashable: AnyHashable

Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift

@@ -2,18 +2,19 @@ import Foundation
 import Combine
 
 /// Type eraser for SecretStore.
-public class AnySecretStore: SecretStore, @unchecked Sendable {
+public class AnySecretStore: SecretStore {
 
     let base: Any
-    private let _isAvailable: @Sendable () -> Bool
+    private let _isAvailable: () -> Bool
-    private let _id: @Sendable () -> UUID
+    private let _id: () -> UUID
-    private let _name: @Sendable () -> String
+    private let _name: () -> String
-    private let _secrets: @Sendable () -> [AnySecret]
+    private let _secrets: () -> [AnySecret]
-    private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance) async throws -> Data
+    private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data
-    private let _verify: @Sendable (Data, Data, AnySecret) async throws -> Bool
+    private let _existingPersistedAuthenticationContext: (AnySecret) -> PersistedAuthenticationContext?
-    private let _existingPersistedAuthenticationContext: @Sendable (AnySecret) async -> PersistedAuthenticationContext?
+    private let _persistAuthentication: (AnySecret, TimeInterval) throws -> Void
-    private let _persistAuthentication: @Sendable (AnySecret, TimeInterval) async throws -> Void
+    private let _reloadSecrets: () -> Void
-    private let _reloadSecrets: @Sendable () async -> Void
+
+    private var sink: AnyCancellable?
 
     public init<SecretStoreType>(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore {
         base = secretStore
@@ -21,11 +22,13 @@ public class AnySecretStore: SecretStore, @unchecked Sendable {
         _name = { secretStore.name }
         _id = { secretStore.id }
         _secrets = { secretStore.secrets.map { AnySecret($0) } }
-        _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
+        _sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
-        _verify = { try await secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) }
+        _existingPersistedAuthenticationContext = { secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
-        _existingPersistedAuthenticationContext = { await secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
+        _persistAuthentication = { try secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
-        _persistAuthentication = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
+        _reloadSecrets = { secretStore.reloadSecrets() }
-        _reloadSecrets = { await secretStore.reloadSecrets() }
+        sink = secretStore.objectWillChange.sink { _ in
+            self.objectWillChange.send()
+        }
     }
 
     public var isAvailable: Bool {
@@ -44,51 +47,47 @@ public class AnySecretStore: SecretStore, @unchecked Sendable {
         return _secrets()
     }
 
-    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) async throws -> Data {
+    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> Data {
-        try await _sign(data, secret, provenance)
+        try _sign(data, secret, provenance)
     }
 
-    public func verify(signature: Data, for data: Data, with secret: AnySecret) async throws -> Bool {
+    public func existingPersistedAuthenticationContext(secret: AnySecret) -> PersistedAuthenticationContext? {
-        try await _verify(signature, data, secret)
+        _existingPersistedAuthenticationContext(secret)
     }
 
-    public func existingPersistedAuthenticationContext(secret: AnySecret) async -> PersistedAuthenticationContext? {
+    public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) throws {
-        await _existingPersistedAuthenticationContext(secret)
+        try _persistAuthentication(secret, duration)
     }
 
-    public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) async throws {
+    public func reloadSecrets() {
-        try await _persistAuthentication(secret, duration)
+        _reloadSecrets()
-    }
-
-    public func reloadSecrets() async {
-        await _reloadSecrets()
     }
 
 }
 
-public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable, @unchecked Sendable {
+public class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable {
 
-    private let _create: @Sendable (String, Bool) async throws -> Void
+    private let _create: (String, Bool) throws -> Void
-    private let _delete: @Sendable (AnySecret) async throws -> Void
+    private let _delete: (AnySecret) throws -> Void
-    private let _update: @Sendable (AnySecret, String) async throws -> Void
+    private let _update: (AnySecret, String) throws -> Void
 
     public init<SecretStoreType>(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable {
-        _create = { try await secretStore.create(name: $0, requiresAuthentication: $1) }
+        _create = { try secretStore.create(name: $0, requiresAuthentication: $1) }
-        _delete = { try await secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
+        _delete = { try secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) }
-        _update = { try await secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) }
+        _update = { try secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) }
         super.init(secretStore)
     }
 
-    public func create(name: String, requiresAuthentication: Bool) async throws {
+    public func create(name: String, requiresAuthentication: Bool) throws {
-        try await _create(name, requiresAuthentication)
+        try _create(name, requiresAuthentication)
     }
 
-    public func delete(secret: AnySecret) async throws {
+    public func delete(secret: AnySecret) throws {
-        try await _delete(secret)
+        try _delete(secret)
     }
 
-    public func update(secret: AnySecret, name: String) async throws {
+    public func update(secret: AnySecret, name: String) throws {
-        try await _update(secret, name)
+        try _update(secret, name)
     }
 
 }

Sources/Packages/Sources/SecretKit/KeychainTypes.swift

@@ -1,71 +0,0 @@
-import Foundation
-
-public typealias SecurityError = Unmanaged<CFError>
-
-/// Wraps a Swift dictionary in a CFDictionary.
-/// - Parameter dictionary: The Swift dictionary to wrap.
-/// - Returns: A CFDictionary containing the keys and values.
-public func KeychainDictionary(_ dictionary: [CFString: Any]) -> CFDictionary {
-    dictionary as CFDictionary
-}
-
-public extension CFError {
-
-    /// The CFError returned when a verification operation fails.
-    static let verifyError = CFErrorCreate(nil, NSOSStatusErrorDomain as CFErrorDomain, CFIndex(errSecVerifyFailed), nil)!
-
-    /// Equality operation that only considers domain and code.
-    static func ~=(lhs: CFError, rhs: CFError) -> Bool {
-        CFErrorGetDomain(lhs) == CFErrorGetDomain(rhs) && CFErrorGetCode(lhs) == CFErrorGetCode(rhs)
-    }
-
-}
-
-/// A wrapper around an error code reported by a Keychain API.
-public struct KeychainError: Error {
-    /// The status code involved, if one was reported.
-    public let statusCode: OSStatus?
-
-    /// Initializes a KeychainError with an optional error code.
-    /// - Parameter statusCode: The status code returned by the keychain operation, if one is applicable.
-    public init(statusCode: OSStatus?) {
-        self.statusCode = statusCode
-    }
-}
-
-/// A signing-related error.
-public struct SigningError: Error {
-    /// The underlying error reported by the API, if one was returned.
-    public let error: SecurityError?
-
-    /// Initializes a SigningError with an optional SecurityError.
-    /// - Parameter statusCode: The SecurityError, if one is applicable.
-    public init(error: SecurityError?) {
-        self.error = error
-    }
-
-}
-
-public extension SecretStore {
-
-    /// Returns the appropriate keychian signature algorithm to use for a given secret.
-    /// - Parameters:
-    ///   - secret: The secret which will be used for signing.
-    ///   - allowRSA: Whether or not RSA key types should be permited.
-    /// - Returns: The appropriate algorithm.
-    func signatureAlgorithm(for secret: SecretType, allowRSA: Bool = false) -> SecKeyAlgorithm {
-        switch (secret.algorithm, secret.keySize) {
-        case (.ellipticCurve, 256):
-            return .ecdsaSignatureMessageX962SHA256
-        case (.ellipticCurve, 384):
-            return .ecdsaSignatureMessageX962SHA384
-        case (.rsa, 1024), (.rsa, 2048):
-            guard allowRSA else { fatalError() }
-            return .rsaSignatureMessagePKCS1v15SHA512
-        default:
-            fatalError()
-        }
-
-    }
-
-}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift

@@ -1,128 +0,0 @@
-import Foundation
-import OSLog
-import Synchronization
-
-/// Manages storage and lookup for OpenSSH certificates.
-public final class OpenSSHCertificateHandler: Sendable {
-
-    private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler")
-    private let writer = OpenSSHKeyWriter()
-    private let keyBlobsAndNames: Mutex<[AnySecret: (Data, Data)]> = .init([:])
-
-    /// Initializes an OpenSSHCertificateHandler.
-    public init() {
-    }
-
-    /// Reloads any certificates in the PublicKeys folder.
-    /// - Parameter secrets: the secrets to look up corresponding certificates for.
-    public func reloadCertificates(for secrets: [AnySecret]) {
-        guard publicKeyFileStoreController.hasAnyCertificates else {
-            logger.log("No certificates, short circuiting")
-            return
-        }
-        keyBlobsAndNames.withLock {
-            $0 = secrets.reduce(into: [:]) { partialResult, next in
-                partialResult[next] = try? loadKeyblobAndName(for: next)
-            }
-        }
-    }
-
-    /// Whether or not the certificate handler has a certifiicate associated with a given secret.
-    /// - Parameter secret: The secret to check for a certificate.
-    /// - Returns: A boolean describing whether or not the certificate handler has a certifiicate associated with a given secret
-    public func hasCertificate<SecretType: Secret>(for secret: SecretType) -> Bool {
-        keyBlobsAndNames.withLock {
-            $0[AnySecret(secret)] != nil
-        }
-        
-    }
-
-
-    /// Reconstructs a public key from a ``Data``, if that ``Data`` contains an OpenSSH certificate hash. Currently only ecdsa certificates are supported
-    /// - Parameter certBlock: The openssh certificate to extract the public key from
-    /// - Returns: A ``Data`` object containing the public key in OpenSSH wire format if the ``Data`` is an OpenSSH certificate hash, otherwise nil.
-    public func publicKeyHash(from hash: Data) -> Data? {
-        let reader = OpenSSHReader(data: hash)
-        let certType = String(decoding: reader.readNextChunk(), as: UTF8.self)
-
-        switch certType {
-        case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
-            "ecdsa-sha2-nistp384-cert-v01@openssh.com",
-            "ecdsa-sha2-nistp521-cert-v01@openssh.com":
-            _ = reader.readNextChunk() // nonce
-            let curveIdentifier = reader.readNextChunk()
-            let publicKey = reader.readNextChunk()
-
-            let curveType = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "").data(using: .utf8)!
-            return writer.lengthAndData(of: curveType) +
-                   writer.lengthAndData(of: curveIdentifier) +
-                   writer.lengthAndData(of: publicKey)
-        default:
-            return nil
-        }
-    }
-
-    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
-    /// - Parameter secret: The secret to search for a certificate with
-    /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
-    public func keyBlobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
-        keyBlobsAndNames.withLock {
-            $0[AnySecret(secret)]
-        }
-    }
-    
-    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
-    /// - Parameter secret: The secret to search for a certificate with
-    /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively.
-    private func loadKeyblobAndName<SecretType: Secret>(for secret: SecretType) throws -> (Data, Data)? {
-        let certificatePath = publicKeyFileStoreController.sshCertificatePath(for: secret)
-        guard FileManager.default.fileExists(atPath: certificatePath) else {
-            return nil
-        }
-
-        logger.debug("Found certificate for \(secret.name)")
-        let certContent = try String(contentsOfFile:certificatePath, encoding: .utf8)
-        let certElements = certContent.trimmingCharacters(in: .whitespacesAndNewlines).components(separatedBy: " ")
-
-        guard certElements.count >= 2 else {
-            logger.warning("Certificate found for \(secret.name) but failed to load")
-            throw OpenSSHCertificateError.parsingFailed
-        }
-        guard let certDecoded = Data(base64Encoded: certElements[1] as String)  else {
-            logger.warning("Certificate found for \(secret.name) but failed to decode base64 key")
-            throw OpenSSHCertificateError.parsingFailed
-        }
-
-        if certElements.count >= 3, let certName = certElements[2].data(using: .utf8) {
-            return (certDecoded, certName)
-        } else if let certName = secret.name.data(using: .utf8) {
-            logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
-            return (certDecoded, certName)
-        } else {
-            throw OpenSSHCertificateError.parsingFailed
-        }
-    }
-
-}
-
-extension OpenSSHCertificateHandler {
-
-    enum OpenSSHCertificateError: LocalizedError {
-        case unsupportedType
-        case parsingFailed
-        case doesNotExist
-
-        public var errorDescription: String? {
-            switch self {
-            case .unsupportedType:
-                return "The key type was unsupported"
-            case .parsingFailed:
-                return "Failed to properly parse the SSH certificate"
-            case .doesNotExist:
-                return "Certificate does not exist"
-            }
-        }
-    }
-
-}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift

@@ -2,7 +2,7 @@ import Foundation
 import CryptoKit
 
 /// Generates OpenSSH representations of Secrets.
-public struct OpenSSHKeyWriter: Sendable {
+public struct OpenSSHKeyWriter {
 
     /// Initializes the writer.
     public init() {
@@ -64,10 +64,6 @@ extension OpenSSHKeyWriter {
         switch algorithm {
         case .ellipticCurve:
             return "ecdsa-sha2-nistp" + String(describing: length)
-        case .rsa:
-            // All RSA keys use the same 512 bit hash function, per
-            // https://security.stackexchange.com/questions/255074/why-are-rsa-sha2-512-and-rsa-sha2-256-supported-but-not-reported-by-ssh-q-key
-            return "rsa-sha2-512"
         }
     }
 
@@ -80,9 +76,6 @@ extension OpenSSHKeyWriter {
         switch algorithm {
         case .ellipticCurve:
             return "nistp" + String(describing: length)
-        case .rsa:
-            // All RSA keys use the same 512 bit hash function
-            return "rsa-sha2-512"
         }
     }
 

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHReader.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// Reads OpenSSH protocol data.
-public final class OpenSSHReader {
+public class OpenSSHReader {
 
     var remaining: Data
 

Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift

@@ -2,9 +2,9 @@ import Foundation
 import OSLog
 
 /// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
-public final class PublicKeyFileStoreController: Sendable {
+public class PublicKeyFileStoreController {
 
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
+    private let logger = Logger()
     private let directory: String
     private let keyWriter = OpenSSHKeyWriter()
 
@@ -20,10 +20,8 @@ public final class PublicKeyFileStoreController: Sendable {
         logger.log("Writing public keys to disk")
         if clear {
             let validPaths = Set(secrets.map { publicKeyPath(for: $0) }).union(Set(secrets.map { sshCertificatePath(for: $0) }))
-            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory)) ?? []
+            let untracked = Set(try FileManager.default.contentsOfDirectory(atPath: directory)
-            let fullPathContents = contentsOfDirectory.map { "\(directory)/\($0)" }
+                .map { "\(directory)/\($0)" })
-
-            let untracked = Set(fullPathContents)
                 .subtracting(validPaths)
             for path in untracked {
                 try? FileManager.default.removeItem(at: URL(fileURLWithPath: path))
@@ -47,18 +45,6 @@ public final class PublicKeyFileStoreController: Sendable {
         return directory.appending("/").appending("\(minimalHex).pub")
     }
 
-    /// Short-circuit check to ship enumerating a bunch of paths if there's nothing in the cert directory.
-    public var hasAnyCertificates: Bool {
-        do {
-            return try FileManager.default
-                .contentsOfDirectory(atPath: directory)
-                .filter { $0.hasSuffix("-cert.pub") }
-                .isEmpty == false
-        } catch {
-            return false
-        }
-    }
-
     /// The path for a Secret's SSH Certificate public key.
     /// - Parameter secret: The Secret to return the path for.
     /// - Returns: The path to the SSH Certificate public key.

Sources/Packages/Sources/SecretKit/SecretStoreList.swift

@@ -1,21 +1,14 @@
 import Foundation
-import Observation
+import Combine
-import Synchronization
 
 /// A "Store Store," which holds a list of type-erased stores.
-@Observable public final class SecretStoreList: Sendable {
+public class SecretStoreList: ObservableObject {
 
     /// The Stores managed by the SecretStoreList.
-    public var stores: [AnySecretStore] {
+    @Published public var stores: [AnySecretStore] = []
-        __stores.withLock { $0 }
-    }
-    private let __stores: Mutex<[AnySecretStore]> = .init([])
-    
     /// A modifiable store, if one is available.
-    public var modifiableStore: AnySecretStoreModifiable? {
+    @Published public var modifiableStore: AnySecretStoreModifiable?
-        __modifiableStore.withLock { $0 }
+    private var sinks: [AnyCancellable] = []
-    }
-    private let __modifiableStore: Mutex<AnySecretStoreModifiable?> = .init(nil)
 
     /// Initializes a SecretStoreList.
     public init() {
@@ -23,33 +16,31 @@ import Synchronization
 
     /// Adds a non-type-erased SecretStore to the list.
     public func add<SecretStoreType: SecretStore>(store: SecretStoreType) {
-        __stores.withLock {
+        addInternal(store: AnySecretStore(store))
-            $0.append(AnySecretStore(store))
-        }
     }
 
     /// Adds a non-type-erased modifiable SecretStore.
     public func add<SecretStoreType: SecretStoreModifiable>(store: SecretStoreType) {
         let modifiable = AnySecretStoreModifiable(modifiable: store)
-        __modifiableStore.withLock {
+        modifiableStore = modifiable
-            $0 = modifiable
+        addInternal(store: modifiable)
-        }
-        __stores.withLock {
-            $0.append(modifiable)
-        }
     }
 
     /// A boolean describing whether there are any Stores available.
     public var anyAvailable: Bool {
-        __stores.withLock {
+        stores.reduce(false, { $0 || $1.isAvailable })
-            $0.reduce(false, { $0 || $1.isAvailable })
+    }
-        }
+
-    }
+}
-
+
-    public var allSecrets: [AnySecret] {
+extension SecretStoreList {
-        __stores.withLock {
+
-            $0.flatMap(\.secrets)
+    private func addInternal(store: AnySecretStore) {
-        }
+        stores.append(store)
+        let sink = store.objectWillChange.sink {
+            self.objectWillChange.send()
+        }
+        sinks.append(sink)
     }
 
 }

Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// Protocol describing a persisted authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time.
-public protocol PersistedAuthenticationContext: Sendable {
+public protocol PersistedAuthenticationContext {
     /// Whether the context remains valid.
     var valid: Bool { get }
     /// The date at which the authorization expires and the context becomes invalid.

Sources/Packages/Sources/SecretKit/Types/Secret.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// The base protocol for describing a Secret
-public protocol Secret: Identifiable, Hashable, Sendable {
+public protocol Secret: Identifiable, Hashable {
 
     /// A user-facing string identifying the Secret.
     var name: String { get }
@@ -17,10 +17,9 @@ public protocol Secret: Identifiable, Hashable, Sendable {
 }
 
 /// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported.
-public enum Algorithm: Hashable, Sendable {
+public enum Algorithm: Hashable {
 
     case ellipticCurve
-    case rsa
 
     /// Initializes the Algorithm with a secAttr representation of an algorithm.
     /// - Parameter secAttr: the secAttr, represented as an NSNumber.
@@ -29,19 +28,8 @@ public enum Algorithm: Hashable, Sendable {
         switch secAttrString {
         case kSecAttrKeyTypeEC:
             self = .ellipticCurve
-        case kSecAttrKeyTypeRSA:
-            self = .rsa
         default:
             fatalError()
         }
     }
-    
-    public var secAttrKeyType: CFString {
-        switch self {
-        case .ellipticCurve:
-            return kSecAttrKeyTypeEC
-        case .rsa:
-            return kSecAttrKeyTypeRSA
-        }
-    }
 }

Sources/Packages/Sources/SecretKit/Types/SecretStore.swift

@@ -2,7 +2,7 @@ import Foundation
 import Combine
 
 /// Manages access to Secrets, and performs signature operations on data using those Secrets.
-public protocol SecretStore: Identifiable, Sendable {
+public protocol SecretStore: ObservableObject, Identifiable {
 
     associatedtype SecretType: Secret
 
@@ -21,31 +21,23 @@ public protocol SecretStore: Identifiable, Sendable {
     ///   - secret: The ``Secret`` to sign with.
     ///   - provenance: A ``SigningRequestProvenance`` describing where the request came from.
     /// - Returns: The signed data.
-    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) async throws -> Data
+    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data
-
-    /// Verifies that a signature is valid over a specified payload.
-    /// - Parameters:
-    ///   - signature: The signature over the data.
-    ///   - data: The data to verify the signature of.
-    ///   - secret: The secret whose signature to verify.
-    /// - Returns: Whether the signature was verified.
-    func verify(signature: Data, for data: Data, with secret: SecretType) async throws -> Bool
 
     /// Checks to see if there is currently a valid persisted authentication for a given secret.
     /// - Parameters:
     ///   - secret: The ``Secret`` to check if there is a persisted authentication for.
     /// - Returns: A persisted authentication context, if a valid one exists.
-    func existingPersistedAuthenticationContext(secret: SecretType) async -> PersistedAuthenticationContext?
+    func existingPersistedAuthenticationContext(secret: SecretType) -> PersistedAuthenticationContext?
 
     /// Persists user authorization for access to a secret.
     /// - Parameters:
     ///   - secret: The ``Secret`` to persist the authorization for.
     ///   - duration: The duration that the authorization should persist for.
     ///  - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret.
-    func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) async throws
+    func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) throws
 
     /// Requests that the store reload secrets from any backing store, if neccessary.
-    func reloadSecrets() async
+    func reloadSecrets()
 
 }
 
@@ -56,18 +48,18 @@ public protocol SecretStoreModifiable: SecretStore {
     /// - Parameters:
     ///   - name: The user-facing name for the ``Secret``.
     ///   - requiresAuthentication: A boolean indicating whether or not the user will be required to authenticate before performing signature operations with the secret.
-    func create(name: String, requiresAuthentication: Bool) async throws
+    func create(name: String, requiresAuthentication: Bool) throws
 
     /// Deletes a Secret in the store.
     /// - Parameters:
     ///   - secret: The ``Secret`` to delete.
-    func delete(secret: SecretType) async throws
+    func delete(secret: SecretType) throws
 
     /// Updates the name of a Secret in the store.
     /// - Parameters:
     ///   - secret: The ``Secret`` to update.
     ///   - name: The new name for the Secret.
-    func update(secret: SecretType, name: String) async throws
+    func update(secret: SecretType, name: String) throws
 
 }
 

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift

@@ -1,41 +1,37 @@
 import Foundation
-import Observation
 import Security
-import CryptoKit
+import CryptoTokenKit
 import LocalAuthentication
 import SecretKit
-import Synchronization
 
 extension SecureEnclave {
 
     /// An implementation of Store backed by the Secure Enclave.
-    @Observable public final class Store: SecretStoreModifiable {
+    public class Store: SecretStoreModifiable {
 
         public var isAvailable: Bool {
-            CryptoKit.SecureEnclave.isAvailable
+            // For some reason, as of build time, CryptoKit.SecureEnclave.isAvailable always returns false
+            // error msg "Received error sending GET UNIQUE DEVICE command"
+            // Verify it with TKTokenWatcher manually.
+            TKTokenWatcher().tokenIDs.contains("com.apple.setoken")
         }
         public let id = UUID()
-        public let name = String(localized: "secure_enclave")
+        public let name = NSLocalizedString("Secure Enclave", comment: "Secure Enclave")
-        public var secrets: [Secret] {
+        @Published public private(set) var secrets: [Secret] = []
-            _secrets.withLock { $0 }
-        }
-        private let _secrets: Mutex<[Secret]> = .init([])
 
-        private let persistedAuthenticationContexts: Mutex<[Secret: PersistentAuthenticationContext]> = .init([:])
+        private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:]
 
         /// Initializes a Store.
         public init() {
-            Task {
+            DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { _ in
-                for await _ in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) {
+                self.reloadSecretsInternal(notifyAgent: false)
-                    await reloadSecretsInternal(notifyAgent: false)
-                }
             }
             loadSecrets()
         }
 
         // MARK: Public API
 
-        public func create(name: String, requiresAuthentication: Bool) async throws {
+        public func create(name: String, requiresAuthentication: Bool) throws {
             var accessError: SecurityError?
             let flags: SecAccessControlCreateFlags
             if requiresAuthentication {
@@ -52,7 +48,7 @@ extension SecureEnclave {
                 throw error.takeRetainedValue() as Error
             }
 
-            let attributes = KeychainDictionary([
+            let attributes = [
                 kSecAttrLabel: name,
                 kSecAttrKeyType: Constants.keyType,
                 kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
@@ -61,7 +57,7 @@ extension SecureEnclave {
                     kSecAttrIsPermanent: true,
                     kSecAttrAccessControl: access
                 ]
-            ])
+            ] as CFDictionary
 
             var createKeyError: SecurityError?
             let keypair = SecKeyCreateRandomKey(attributes, &createKeyError)
@@ -72,82 +68,49 @@ extension SecureEnclave {
                 throw KeychainError(statusCode: nil)
             }
             try savePublicKey(publicKey, name: name)
-            await reloadSecretsInternal()
+            reloadSecretsInternal()
         }
 
-        public func delete(secret: Secret) async throws {
+        public func delete(secret: Secret) throws {
-            let deleteAttributes = KeychainDictionary([
+            let deleteAttributes = [
                 kSecClass: kSecClassKey,
                 kSecAttrApplicationLabel: secret.id as CFData
-            ])
+            ] as CFDictionary
             let status = SecItemDelete(deleteAttributes)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
-            await reloadSecretsInternal()
+            reloadSecretsInternal()
         }
 
-        public func update(secret: Secret, name: String) async throws {
+        public func update(secret: Secret, name: String) throws {
-            let updateQuery = KeychainDictionary([
+            let updateQuery = [
                 kSecClass: kSecClassKey,
                 kSecAttrApplicationLabel: secret.id as CFData
-            ])
+            ] as CFDictionary
 
-            let updatedAttributes = KeychainDictionary([
+            let updatedAttributes = [
                 kSecAttrLabel: name,
-            ])
+            ] as CFDictionary
 
             let status = SecItemUpdate(updateQuery, updatedAttributes)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
             }
-            await reloadSecretsInternal()
+            reloadSecretsInternal()
         }
         
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
-            let context: Mutex<LAContext>
+            let context: LAContext
-//            if let existing = persistedAuthenticationContexts.withLock({ $0 })[secret], existing.valid {
+            if let existing = persistedAuthenticationContexts[secret], existing.valid {
-//                context = existing.context
+                context = existing.context
-//            } else {
+            } else {
                 let newContext = LAContext()
-                newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+                newContext.localizedCancelTitle = "Deny"
-                context = .init(newContext)
+                context = newContext
-//            }
-            return try context.withLock { context in
-                context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
-                let attributes = KeychainDictionary([
-                    kSecClass: kSecClassKey,
-                    kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-                    kSecAttrApplicationLabel: secret.id as CFData,
-                    kSecAttrKeyType: Constants.keyType,
-                    kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
-                    kSecAttrApplicationTag: Constants.keyTag,
-                    kSecUseAuthenticationContext: context,
-                    kSecReturnRef: true
-                ])
-                var untyped: CFTypeRef?
-                let status = SecItemCopyMatching(attributes, &untyped)
-                if status != errSecSuccess {
-                    throw KeychainError(statusCode: status)
-                }
-                guard let untypedSafe = untyped else {
-                    throw KeychainError(statusCode: errSecSuccess)
-                }
-                let key = untypedSafe as! SecKey
-                var signError: SecurityError?
-                
-                guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
-                    throw SigningError(error: signError)
-                }
-                return signature as Data
             }
-        }
+            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
-
+            let attributes = [
-        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
-            let context = LAContext()
-            context.localizedReason = String(localized: "auth_context_request_verify_description_\(secret.name)")
-            context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
-            let attributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
                 kSecAttrApplicationLabel: secret.id as CFData,
@@ -156,8 +119,7 @@ extension SecureEnclave {
                 kSecAttrApplicationTag: Constants.keyTag,
                 kSecUseAuthenticationContext: context,
                 kSecReturnRef: true
-                ])
+                ] as CFDictionary
-            var verifyError: SecurityError?
             var untyped: CFTypeRef?
             let status = SecItemCopyMatching(attributes, &untyped)
             if status != errSecSuccess {
@@ -167,47 +129,42 @@ extension SecureEnclave {
                 throw KeychainError(statusCode: errSecSuccess)
             }
             let key = untypedSafe as! SecKey
-            let verified = SecKeyVerifySignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, signature as CFData, &verifyError)
+            var signError: SecurityError?
-            if !verified, let verifyError {
+
-                if verifyError.takeUnretainedValue() ~= .verifyError {
+            guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
-                    return false
+                throw SigningError(error: signError)
-                } else {
-                    throw SigningError(error: verifyError)
-                }
             }
-            return verified
+            return signature as Data
         }
 
         public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
-            guard let persisted = persistedAuthenticationContexts.withLock({ $0 })[secret], persisted.valid else { return nil }
+            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
             return persisted
         }
 
         public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) throws {
             let newContext = LAContext()
             newContext.touchIDAuthenticationAllowableReuseDuration = duration
-            newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+            newContext.localizedCancelTitle = "Deny"
 
             let formatter = DateComponentsFormatter()
             formatter.unitsStyle = .spellOut
             formatter.allowedUnits = [.hour, .minute, .day]
 
             if let durationString = formatter.string(from: duration) {
-                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_\(secret.name)_\(durationString)")
+                newContext.localizedReason = "unlock secret \"\(secret.name)\" for \(durationString)"
             } else {
-                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_unknown_\(secret.name)")
+                newContext.localizedReason = "unlock secret \"\(secret.name)\""
             }
             newContext.evaluatePolicy(LAPolicy.deviceOwnerAuthentication, localizedReason: newContext.localizedReason) { [weak self] success, _ in
-                guard success, let self else { return }
+                guard success else { return }
                 let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration)
-                self.persistedAuthenticationContexts.withLock {
+                self?.persistedAuthenticationContexts[secret] = context
-                    $0[secret] = context
-                }
             }
         }
 
-        public func reloadSecrets() async {
+        public func reloadSecrets() {
-            await reloadSecretsInternal(notifyAgent: false)
+            reloadSecretsInternal(notifyAgent: false)
         }
 
     }
@@ -218,11 +175,9 @@ extension SecureEnclave.Store {
 
     /// Reloads all secrets from the store.
     /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
-    private func reloadSecretsInternal(notifyAgent: Bool = true) async {
+    private func reloadSecretsInternal(notifyAgent: Bool = true) {
         let before = secrets
-        _secrets.withLock {
+        secrets.removeAll()
-            $0.removeAll()
-        }
         loadSecrets()
         if secrets != before {
             NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
@@ -234,7 +189,7 @@ extension SecureEnclave.Store {
 
     /// Loads all secrets from the store.
     private func loadSecrets() {
-        let publicAttributes = KeychainDictionary([
+        let publicAttributes = [
             kSecClass: kSecClassKey,
             kSecAttrKeyType: SecureEnclave.Constants.keyType,
             kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
@@ -242,11 +197,11 @@ extension SecureEnclave.Store {
             kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
-            ])
+            ] as CFDictionary
         var publicUntyped: CFTypeRef?
         SecItemCopyMatching(publicAttributes, &publicUntyped)
         guard let publicTyped = publicUntyped as? [[CFString: Any]] else { return }
-        let privateAttributes = KeychainDictionary([
+        let privateAttributes = [
             kSecClass: kSecClassKey,
             kSecAttrKeyType: SecureEnclave.Constants.keyType,
             kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
@@ -254,7 +209,7 @@ extension SecureEnclave.Store {
             kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
-            ])
+            ] as CFDictionary
         var privateUntyped: CFTypeRef?
         SecItemCopyMatching(privateAttributes, &privateUntyped)
         guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
@@ -269,7 +224,7 @@ extension SecureEnclave.Store {
                                             nil)!
 
         let wrapped: [SecureEnclave.Secret] = publicTyped.map {
-            let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
+            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
             let id = $0[kSecAttrApplicationLabel] as! Data
             let publicKeyRef = $0[kSecValueRef] as! SecKey
             let publicKeyAttributes = SecKeyCopyAttributes(publicKeyRef) as! [CFString: Any]
@@ -284,9 +239,7 @@ extension SecureEnclave.Store {
             }
             return SecureEnclave.Secret(id: id, name: name, requiresAuthentication: requiresAuth, publicKey: publicKey)
         }
-        _secrets.withLock {
+        secrets.append(contentsOf: wrapped)
-            $0.append(contentsOf: wrapped)
-        }
     }
 
     /// Saves a public key.
@@ -294,7 +247,7 @@ extension SecureEnclave.Store {
     ///   - publicKey: The public key to save.
     ///   - name: A user-facing name for the key.
     private func savePublicKey(_ publicKey: SecKey, name: String) throws {
-        let attributes = KeychainDictionary([
+        let attributes = [
             kSecClass: kSecClassKey,
             kSecAttrKeyType: SecureEnclave.Constants.keyType,
             kSecAttrKeyClass: kSecAttrKeyClassPublic,
@@ -303,20 +256,42 @@ extension SecureEnclave.Store {
             kSecAttrIsPermanent: true,
             kSecReturnData: true,
             kSecAttrLabel: name
-            ])
+            ] as CFDictionary
         let status = SecItemAdd(attributes, nil)
         if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
+            throw SecureEnclave.KeychainError(statusCode: status)
         }
     }
 
 }
 
+extension SecureEnclave {
+
+    /// A wrapper around an error code reported by a Keychain API.
+    public struct KeychainError: Error {
+        /// The status code involved, if one was reported.
+        public let statusCode: OSStatus?
+    }
+
+    /// A signing-related error.
+    public struct SigningError: Error {
+        /// The underlying error reported by the API, if one was returned.
+        public let error: SecurityError?
+    }
+
+}
+
+extension SecureEnclave {
+
+    public typealias SecurityError = Unmanaged<CFError>
+
+}
+
 extension SecureEnclave {
 
     enum Constants {
-        static let keyTag = Data("com.maxgoedjen.secretive.secureenclave.key".utf8)
+        static let keyTag = "com.maxgoedjen.secretive.secureenclave.key".data(using: .utf8)! as CFData
-        static let keyType = kSecAttrKeyTypeECSECPrimeRandom as String
+        static let keyType = kSecAttrKeyTypeECSECPrimeRandom
         static let unauthenticatedThreshold: TimeInterval = 0.05
     }
 
@@ -325,12 +300,12 @@ extension SecureEnclave {
 extension SecureEnclave {
 
     /// A context describing a persisted authentication.
-    private final class PersistentAuthenticationContext: PersistedAuthenticationContext {
+    private struct PersistentAuthenticationContext: PersistedAuthenticationContext {
 
         /// The Secret to persist authentication for.
         let secret: Secret
         /// The LAContext used to authorize the persistent context.
-        nonisolated(unsafe) let context: LAContext
+        let context: LAContext
         /// An expiration date for the context.
         /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
         let monotonicExpiration: UInt64

Sources/Packages/Sources/SmartCardSecretKit/Documentation.docc/SmartCard.md

@@ -6,3 +6,9 @@
 
 - ``Secret``
 - ``Store``
+
+### Errors
+
+- ``KeychainError``
+- ``SigningError``
+- ``SecurityError``

Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift

@@ -1,51 +1,35 @@
 import Foundation
-import Synchronization
-import Observation
 import Security
 import CryptoTokenKit
 import LocalAuthentication
 import SecretKit
 
 extension SmartCard {
-    
-    private struct State {
-        var isAvailable = false
-        var name = String(localized: "smart_card")
-        var secrets: [Secret] = []
-        let watcher = TKTokenWatcher()
-        var tokenID: String? = nil
-    }
 
     /// An implementation of Store backed by a Smart Card.
-    @Observable public final class Store: SecretStore {
+    public class Store: SecretStore {
-
-        private let state: Mutex<State> = .init(.init())
-        public var isAvailable: Bool {
-            state.withLock { $0.isAvailable }
-        }
 
+        @Published public var isAvailable: Bool = false
         public let id = UUID()
-        public var name: String {
+        public private(set) var name = NSLocalizedString("Smart Card", comment: "Smart Card")
-            state.withLock { $0.name }
+        @Published public private(set) var secrets: [Secret] = []
-        }
+        private let watcher = TKTokenWatcher()
-        public var secrets: [Secret] {
+        private var tokenID: String?
-            state.withLock { $0.secrets }
-        }
 
         /// Initializes a Store.
         public init() {
-            state.withLock { state in
+            tokenID = watcher.nonSecureEnclaveTokens.first
-                if let tokenID = state.tokenID {
+            watcher.setInsertionHandler { string in
-                    state.isAvailable = true
+                guard self.tokenID == nil else { return }
-                    state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
+                guard !string.contains("setoken") else { return }
-                }
+
-                state.watcher.setInsertionHandler { id in
+                self.tokenID = string
-                    // Setting insertion handler will cause it to be called immediately.
+                self.reloadSecrets()
-                    // Make a thread jump so we don't hit a recursive lock attempt.
+                self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
-                    Task {
+            }
-                        self.smartcardInserted(for: id)
+            if let tokenID = tokenID {
-                    }
+                self.isAvailable = true
-                }
+                self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID)
             }
             loadSecrets()
         }
@@ -60,19 +44,19 @@ extension SmartCard {
             fatalError("Keys must be deleted on the smart card.")
         }
 
-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
-            guard let tokenID = state.withLock({ $0.tokenID }) else { fatalError() }
+            guard let tokenID = tokenID else { fatalError() }
             let context = LAContext()
-            context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
+            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
-            context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+            context.localizedCancelTitle = "Deny"
-            let attributes = KeychainDictionary([
+            let attributes = [
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
                 kSecAttrApplicationLabel: secret.id as CFData,
                 kSecAttrTokenID: tokenID,
                 kSecUseAuthenticationContext: context,
                 kSecReturnRef: true
-            ])
+            ] as CFDictionary
             var untyped: CFTypeRef?
             let status = SecItemCopyMatching(attributes, &untyped)
             if status != errSecSuccess {
@@ -83,45 +67,39 @@ extension SmartCard {
             }
             let key = untypedSafe as! SecKey
             var signError: SecurityError?
-            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, &signError) else {
+            let signatureAlgorithm: SecKeyAlgorithm
+            switch (secret.algorithm, secret.keySize) {
+            case (.ellipticCurve, 256):
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA256
+            case (.ellipticCurve, 384):
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA384
+            default:
+                fatalError()
+            }
+            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm, data as CFData, &signError) else {
                 throw SigningError(error: signError)
             }
             return signature as Data
         }
-        
-        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
-            let attributes = KeychainDictionary([
-                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
-                kSecAttrKeySizeInBits: secret.keySize,
-                kSecAttrKeyClass: kSecAttrKeyClassPublic
-            ])
-            var verifyError: SecurityError?
-            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
-            guard let untypedSafe = untyped else {
-                throw KeychainError(statusCode: errSecSuccess)
-            }
-            let key = untypedSafe as! SecKey
-            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, signature as CFData, &verifyError)
-            if !verified, let verifyError {
-                if verifyError.takeUnretainedValue() ~= .verifyError {
-                    return false
-                } else {
-                    throw SigningError(error: verifyError)
-                }
-            }
-            return verified
-        }
 
-        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
+        public func existingPersistedAuthenticationContext(secret: SmartCard.Secret) -> PersistedAuthenticationContext? {
             nil
         }
 
-        public func persistAuthentication(secret: Secret, forDuration: TimeInterval) throws {
+        public func persistAuthentication(secret: SmartCard.Secret, forDuration: TimeInterval) throws {
         }
 
         /// Reloads all secrets from the store.
         public func reloadSecrets() {
-            reloadSecretsInternal()
+            DispatchQueue.main.async {
+                self.isAvailable = self.tokenID != nil
+                let before = self.secrets
+                self.secrets.removeAll()
+                self.loadSecrets()
+                if self.secrets != before {
+                    NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
+                }
+            }
         }
 
     }
@@ -130,66 +108,47 @@ extension SmartCard {
 
 extension SmartCard.Store {
 
-    private func reloadSecretsInternal() {
-        let before = state.withLock {
-            $0.isAvailable = $0.tokenID != nil
-            let before = $0.secrets
-            $0.secrets.removeAll()
-            return before
-        }
-        self.loadSecrets()
-        if self.secrets != before {
-            NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
-        }
-    }
-
-    /// Resets the token ID and reloads secrets.
-    /// - Parameter tokenID: The ID of the token that was inserted.
-    private func smartcardInserted(for tokenID: String? = nil) {
-        state.withLock { state in
-            guard let string = state.watcher.nonSecureEnclaveTokens.first else { return }
-            guard state.tokenID == nil else { return }
-            guard !string.contains("setoken") else { return }
-            state.tokenID = string
-            state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
-            state.tokenID = string
-        }
-    }
-
     /// Resets the token ID and reloads secrets.
     /// - Parameter tokenID: The ID of the token that was removed.
     private func smartcardRemoved(for tokenID: String? = nil) {
-        state.withLock {
+        self.tokenID = nil
-            $0.tokenID = nil
-        }
         reloadSecrets()
     }
 
     /// Loads all secrets from the store.
     private func loadSecrets() {
-        guard let tokenID = state.withLock({ $0.tokenID }) else { return }
+        guard let tokenID = tokenID else { return }
 
-        let fallbackName = String(localized: "smart_card")
+        let fallbackName = NSLocalizedString("Smart Card", comment: "Smart Card")
-        state.withLock {
+        if #available(macOS 12.0, *) {
-            if let driverName = $0.watcher.tokenInfo(forTokenID: tokenID)?.driverName  {
+            if let driverName = watcher.tokenInfo(forTokenID: tokenID)?.driverName {
-                $0.name = driverName
+                name = driverName
             } else {
-                $0.name = fallbackName
+                name = fallbackName
+            }
+        } else {
+            // Hack to read name if there's only one smart card
+            let slotNames = TKSmartCardSlotManager().slotNames
+            if watcher.nonSecureEnclaveTokens.count == 1 && slotNames.count == 1 {
+                name = slotNames.first!
+            } else {
+                name = fallbackName
             }
         }
 
-        let attributes = KeychainDictionary([
+        let attributes = [
             kSecClass: kSecClassKey,
             kSecAttrTokenID: tokenID,
+            kSecAttrKeyType: kSecAttrKeyTypeEC, // Restrict to EC
             kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
-        ])
+        ] as CFDictionary
         var untyped: CFTypeRef?
         SecItemCopyMatching(attributes, &untyped)
         guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped = typed.map {
+        let wrapped: [SmartCard.Secret] = typed.map {
-            let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
+            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
             let tokenID = $0[kSecAttrApplicationLabel] as! Data
             let algorithm = Algorithm(secAttr: $0[kSecAttrKeyType] as! NSNumber)
             let keySize = $0[kSecAttrKeySizeInBits] as! Int
@@ -199,91 +158,7 @@ extension SmartCard.Store {
             let publicKey = publicKeyAttributes[kSecValueData] as! Data
             return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey)
         }
-        state.withLock {
+        secrets.append(contentsOf: wrapped)
-            $0.secrets.append(contentsOf: wrapped)
-        }
-    }
-
-}
-
-
-// MARK: Smart Card specific encryption/decryption/verification
-extension SmartCard.Store {
-
-    /// Encrypts a payload with a specified key.
-    /// - Parameters:
-    ///   - data: The payload to encrypt.
-    ///   - secret: The secret to encrypt with.
-    /// - Returns: The encrypted data.
-    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
-    public func encrypt(data: Data, with secret: SecretType) throws -> Data {
-        let context = LAContext()
-        context.localizedReason = String(localized: "auth_context_request_encrypt_description_\(secret.name)")
-        context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
-        let attributes = KeychainDictionary([
-            kSecAttrKeyType: secret.algorithm.secAttrKeyType,
-            kSecAttrKeySizeInBits: secret.keySize,
-            kSecAttrKeyClass: kSecAttrKeyClassPublic,
-            kSecUseAuthenticationContext: context
-        ])
-        var encryptError: SecurityError?
-        let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &encryptError)
-        guard let untypedSafe = untyped else {
-            throw KeychainError(statusCode: errSecSuccess)
-        }
-        let key = untypedSafe as! SecKey
-        guard let signature = SecKeyCreateEncryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
-            throw SigningError(error: encryptError)
-        }
-        return signature as Data
-    }
-
-    /// Decrypts a payload with a specified key.
-    /// - Parameters:
-    ///   - data: The payload to decrypt.
-    ///   - secret: The secret to decrypt with.
-    /// - Returns: The decrypted data.
-    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
-    public func decrypt(data: Data, with secret: SecretType) throws -> Data {
-        guard let tokenID = state.withLock({ $0.tokenID }) else { fatalError() }
-        let context = LAContext()
-        context.localizedReason = String(localized: "auth_context_request_decrypt_description_\(secret.name)")
-        context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
-        let attributes = KeychainDictionary([
-            kSecClass: kSecClassKey,
-            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
-            kSecAttrApplicationLabel: secret.id as CFData,
-            kSecAttrTokenID: tokenID,
-            kSecUseAuthenticationContext: context,
-            kSecReturnRef: true
-        ])
-        var untyped: CFTypeRef?
-        let status = SecItemCopyMatching(attributes, &untyped)
-        if status != errSecSuccess {
-            throw KeychainError(statusCode: status)
-        }
-        guard let untypedSafe = untyped else {
-            throw KeychainError(statusCode: errSecSuccess)
-        }
-        let key = untypedSafe as! SecKey
-        var encryptError: SecurityError?
-        guard let signature = SecKeyCreateDecryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
-            throw SigningError(error: encryptError)
-        }
-        return signature as Data
-    }
-
-    private func encryptionAlgorithm(for secret: SecretType) -> SecKeyAlgorithm {
-        switch (secret.algorithm, secret.keySize) {
-        case (.ellipticCurve, 256):
-            return .eciesEncryptionCofactorVariableIVX963SHA256AESGCM
-        case (.ellipticCurve, 384):
-            return .eciesEncryptionCofactorVariableIVX963SHA384AESGCM
-        case (.rsa, 1024), (.rsa, 2048):
-            return .rsaEncryptionOAEPSHA512AESGCM
-        default:
-            fatalError()
-        }
     }
 
 }
@@ -296,3 +171,25 @@ extension TKTokenWatcher {
     }
 
 }
+
+extension SmartCard {
+
+    /// A wrapper around an error code reported by a Keychain API.
+    public struct KeychainError: Error {
+        /// The status code involved.
+        public let statusCode: OSStatus
+    }
+
+    /// A signing-related error.
+    public struct SigningError: Error {
+        /// The underlying error reported by the API, if one was returned.
+        public let error: SecurityError?
+    }
+
+}
+
+extension SmartCard {
+
+    public typealias SecurityError = Unmanaged<CFError>
+
+}

Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift

@@ -1,66 +1,54 @@
-import Testing
+import XCTest
-import Foundation
 @testable import Brief
 
+class ReleaseParsingTests: XCTestCase {
 
-@Suite struct ReleaseParsingTests {
+    func testNonCritical() {
-
-    @Test
-    func nonCritical() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release")
-        #expect(release.critical == false)
+        XCTAssert(release.critical == false)
     }
 
-    @Test
+    func testCritical() {
-    func critical() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
-        #expect(release.critical == true)
+        XCTAssert(release.critical == true)
     }
 
-    @Test
+    func testOSMissing() {
-    func osMissing() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
-        #expect(release.minimumOSVersion == SemVer("11.0.0"))
+        XCTAssert(release.minimumOSVersion == SemVer("11.0.0"))
     }
 
-    @Test
+    func testOSPresentWithContentBelow() {
-    func osPresentWithContentBelow() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update ##Minimum macOS Version\n1.2.3\nBuild info")
-        #expect(release.minimumOSVersion == SemVer("1.2.3"))
+        XCTAssert(release.minimumOSVersion == SemVer("1.2.3"))
     }
 
-    @Test
+    func testOSPresentAtEnd() {
-    func osPresentAtEnd() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
-        #expect(release.minimumOSVersion == SemVer("1.2.3"))
+        XCTAssert(release.minimumOSVersion == SemVer("1.2.3"))
     }
 
-    @Test
+    func testOSWithMacOSPrefix() {
-    func osWithMacOSPrefix() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: macOS 1.2.3")
-        #expect(release.minimumOSVersion == SemVer("1.2.3"))
+        XCTAssert(release.minimumOSVersion == SemVer("1.2.3"))
     }
 
-    @Test
+    func testOSGreaterThanMinimum() {
-    func osGreaterThanMinimum() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
-        #expect(release.minimumOSVersion < SemVer("11.0.0"))
+        XCTAssert(release.minimumOSVersion < SemVer("11.0.0"))
     }
 
-    @Test
+    func testOSEqualToMinimum() {
-    func osEqualToMinimum() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 11.2.3")
-        #expect(release.minimumOSVersion <= SemVer("11.2.3"))
+        XCTAssert(release.minimumOSVersion <= SemVer("11.2.3"))
     }
 
-    @Test
+    func testOSLessThanMinimum() {
-    func osLessThanMinimum() {
         let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3")
-        #expect(release.minimumOSVersion > SemVer("1.0.0"))
+        XCTAssert(release.minimumOSVersion > SemVer("1.0.0"))
     }
 
-    @Test
+    func testGreatestSelectedIfOldPatchIsPublishedLater() {
-    func greatestSelectedIfOldPatchIsPublishedLater() async throws {
         // If 2.x.x series has been published, and a patch for 1.x.x is issued
         // 2.x.x should still be selected if user can run it.
         let updater = Updater(checkOnLaunch: false, osVersion: SemVer("2.2.3"), currentVersion: SemVer("1.0.0"))
@@ -72,13 +60,16 @@ import Foundation
             Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"),
         ]
 
-        await updater.evaluate(releases: releases)
+        let expectation = XCTestExpectation()
-        try await Task.sleep(nanoseconds: 1)
+        updater.evaluate(releases: releases)
-        #expect(updater.update == two)
+        DispatchQueue.main.async {
+            XCTAssert(updater.update == two)
+            expectation.fulfill()
+        }
+        wait(for: [expectation], timeout: 1)
     }
 
-    @Test
+    func testLatestVersionIsRunnable() {
-    func latestVersionIsRunnable() async throws {
         // If the 2.x.x series has been published but the user can't run it
         // the last version the user can run should be selected.
         let updater = Updater(checkOnLaunch: false, osVersion: SemVer("1.2.3"), currentVersion: SemVer("1.0.0"))
@@ -89,13 +80,16 @@ import Foundation
             Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available! Minimum macOS Version: 2.2.3"),
             Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"),
         ]
-        await updater.evaluate(releases: releases)
+        let expectation = XCTestExpectation()
-        try await Task.sleep(nanoseconds: 1)
+        updater.evaluate(releases: releases)
-        #expect(updater.update == oneOhTwo)
+        DispatchQueue.main.async {
+            XCTAssert(updater.update == oneOhTwo)
+            expectation.fulfill()
+        }
+        wait(for: [expectation], timeout: 1)
     }
 
-    @Test
+    func testSorting() {
-    func sorting() {
         let two = Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available!")
         let releases = [
             Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release"),
@@ -104,7 +98,7 @@ import Foundation
             Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch!"),
         ]
         let sorted = releases.sorted().reversed().first
-        #expect(sorted == two)
+        XCTAssert(sorted == two)
     }
 
 }

Sources/Packages/Tests/BriefTests/SemVerTests.swift

@@ -1,52 +1,51 @@
-import Testing
+import XCTest
-import Foundation
 @testable import Brief
 
-@Suite struct SemVerTests {
+class SemVerTests: XCTestCase {
 
-    @Test func equal() {
+    func testEqual() {
         let current = SemVer("1.0.2")
         let old = SemVer("1.0.2")
-        #expect(!(current > old))
+        XCTAssert(!(current > old))
     }
 
-    @Test func patchGreaterButMinorLess() {
+    func testPatchGreaterButMinorLess() {
         let current = SemVer("1.1.0")
         let old = SemVer("1.0.2")
-        #expect(current > old)
+        XCTAssert(current > old)
     }
 
-    @Test func majorSameMinorGreater() {
+    func testMajorSameMinorGreater() {
         let current = SemVer("1.0.2")
         let new = SemVer("1.0.3")
-        #expect(current < new)
+        XCTAssert(current < new)
     }
 
-    @Test func majorGreaterMinorLesser() {
+    func testMajorGreaterMinorLesser() {
         let current = SemVer("1.0.2")
         let new = SemVer("2.0.0")
-        #expect(current < new)
+        XCTAssert(current < new)
     }
 
-    @Test func regularParsing() {
+    func testRegularParsing() {
         let current = SemVer("1.0.2")
-        #expect(current.versionNumbers == [1, 0, 2])
+        XCTAssert(current.versionNumbers == [1, 0, 2])
     }
 
-    @Test func noPatch() {
+    func testNoPatch() {
         let current = SemVer("1.1")
-        #expect(current.versionNumbers == [1, 1, 0])
+        XCTAssert(current.versionNumbers == [1, 1, 0])
     }
 
-    @Test func garbage() {
+    func testGarbage() {
         let current = SemVer("Test")
-        #expect(current.versionNumbers == [0, 0, 0])
+        XCTAssert(current.versionNumbers == [0, 0, 0])
     }
 
-    @Test func beta() {
+    func testBeta() {
         let current = SemVer("1.0.2")
         let new = SemVer("1.1.0_beta1")
-        #expect(current < new)
+        XCTAssert(current < new)
     }
 
 }

Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift

@@ -1,48 +1,48 @@
 import Foundation
-import Testing
+import XCTest
 import CryptoKit
 @testable import SecretKit
 @testable import SecretAgentKit
 
-@Suite struct AgentTests {
+class AgentTests: XCTestCase {
 
     let stubWriter = StubFileHandleWriter()
 
     // MARK: Identity Listing
 
-    @Test func emptyStores() async {
+    func testEmptyStores() {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
         let agent = Agent(storeList: SecretStoreList())
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestIdentitiesEmpty)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesEmpty)
     }
 
-    @Test func identitiesList() async {
+    func testIdentitiesList() {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestIdentitiesMultiple)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesMultiple)
     }
 
     // MARK: Signatures
 
-    @Test func noMatchingIdentities() async {
+    func testNoMatchingIdentities() {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+//        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
-    @Test func signature() async throws {
+    func testSignature() {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...])
         _ = requestReader.readNextChunk()
         let dataToSign = requestReader.readNextChunk()
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        agent.handle(reader: stubReader, writer: stubWriter)
         let outer = OpenSSHReader(data: stubWriter.data[5...])
         let payload = outer.readNextChunk()
         let inner = OpenSSHReader(data: payload)
@@ -61,33 +61,24 @@ import CryptoKit
         var rs = r
         rs.append(s)
         let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs)
-        let referenceValid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
+        let valid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
-        let store = list.stores.first!
+        XCTAssertTrue(valid)
-        let derVerifies = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidRandomSignature = try await store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidRandomData = try await store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret))
-        let invalidWrongKey = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret))
-        #expect(referenceValid)
-        #expect(derVerifies)
-        #expect(invalidRandomSignature == false)
-        #expect(invalidRandomData == false)
-        #expect(invalidWrongKey == false)
     }
 
     // MARK: Witness protocol
 
-    @Test func witnessObjectionStopsRequest() async {
+    func testWitnessObjectionStopsRequest() {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
         let witness = StubWitness(speakNow: { _,_  in
             return true
         }, witness: { _, _ in })
         let agent = Agent(storeList: list, witness: witness)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
-    @Test func witnessSignature() async {
+    func testWitnessSignature() {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
         var witnessed = false
@@ -97,11 +88,11 @@ import CryptoKit
             witnessed = true
         })
         let agent = Agent(storeList: list, witness: witness)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(witnessed)
+        XCTAssertTrue(witnessed)
     }
 
-    @Test func requestTracing() async {
+    func testRequestTracing() {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
         var speakNowTrace: SigningRequestProvenance! = nil
@@ -113,32 +104,32 @@ import CryptoKit
             witnessTrace = trace
         })
         let agent = Agent(storeList: list, witness: witness)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(witnessTrace == speakNowTrace)
+        XCTAssertEqual(witnessTrace, speakNowTrace)
-        #expect(witnessTrace.origin.displayName == "Finder")
+        XCTAssertEqual(witnessTrace.origin.displayName, "Finder")
-        #expect(witnessTrace.origin.validSignature == true)
+        XCTAssertEqual(witnessTrace.origin.validSignature, true)
-        #expect(witnessTrace.origin.parentPID == 1)
+        XCTAssertEqual(witnessTrace.origin.parentPID, 1)
     }
 
     // MARK: Exception Handling
 
-    @Test func signatureException() async {
+    func testSignatureException() {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let store = list.stores.first?.base as! Stub.Store
         store.shouldThrow = true
         let agent = Agent(storeList: list)
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
     // MARK: Unsupported
 
-    @Test func unhandledAdd() async {
+    func testUnhandledAdd() {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity)
         let agent = Agent(storeList: SecretStoreList())
-        await agent.handle(reader: stubReader, writer: stubWriter)
+        agent.handle(reader: stubReader, writer: stubWriter)
-        #expect(stubWriter.data == Constants.Responses.requestFailure)
+        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
 }

Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift

@@ -1,7 +1,7 @@
 import Foundation
 import SecretAgentKit
 
-class StubFileHandleWriter: FileHandleWriter, @unchecked Sendable {
+class StubFileHandleWriter: FileHandleWriter {
 
     var data = Data()
 

Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift

@@ -6,7 +6,7 @@ struct Stub {}
 
 extension Stub {
 
-    public final class Store: SecretStore, @unchecked Sendable {
+    public class Store: SecretStore {
 
         public let isAvailable = true
         public let id = UUID()
@@ -27,7 +27,7 @@ extension Stub {
                                                 flags,
                                                 nil) as Any
 
-            let attributes = KeychainDictionary([
+            let attributes = [
                 kSecAttrLabel: name,
                 kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
                 kSecAttrKeySizeInBits: size,
@@ -35,10 +35,11 @@ extension Stub {
                     kSecAttrIsPermanent: true,
                     kSecAttrAccessControl: access
                 ]
-                ])
+                ] as CFDictionary
 
-            let privateKey = SecKeyCreateRandomKey(attributes, nil)!
+            var privateKey: SecKey! = nil
-            let publicKey = SecKeyCopyPublicKey(privateKey)!
+            var publicKey: SecKey! = nil
+            SecKeyGeneratePair(attributes, &publicKey, &privateKey)
             let publicAttributes = SecKeyCopyAttributes(publicKey) as! [CFString: Any]
             let privateAttributes = SecKeyCopyAttributes(privateKey) as! [CFString: Any]
             let publicData = (publicAttributes[kSecValueData] as! Data)
@@ -52,36 +53,22 @@ extension Stub {
             guard !shouldThrow else {
                 throw NSError(domain: "test", code: 0, userInfo: nil)
             }
-            let privateKey = SecKeyCreateWithData(secret.privateKey as CFData, KeychainDictionary([
+            let privateKey = SecKeyCreateWithData(secret.privateKey as CFData, [
                 kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
                 kSecAttrKeySizeInBits: secret.keySize,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate
-                ])
+                ] as CFDictionary
                 , nil)!
-            return SecKeyCreateSignature(privateKey, signatureAlgorithm(for: secret), data as CFData, nil)! as Data
+            let signatureAlgorithm: SecKeyAlgorithm
-        }
+            switch secret.keySize {
-
+            case 256:
-        public func verify(signature: Data, for data: Data, with secret: Stub.Secret) throws -> Bool {
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA256
-            let attributes = KeychainDictionary([
+            case 384:
-                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
+                signatureAlgorithm = .ecdsaSignatureMessageX962SHA384
-                kSecAttrKeySizeInBits: secret.keySize,
+            default:
-                kSecAttrKeyClass: kSecAttrKeyClassPublic
+                fatalError()
-            ])
-            var verifyError: Unmanaged<CFError>?
-            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
-            guard let untypedSafe = untyped else {
-                throw NSError(domain: "test", code: 0, userInfo: nil)
             }
-            let key = untypedSafe as! SecKey
+            return SecKeyCreateSignature(privateKey, signatureAlgorithm, data as CFData, nil)! as Data
-            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret), data as CFData, signature as CFData, &verifyError)
-            if let verifyError {
-                if verifyError.takeUnretainedValue() ~= .verifyError {
-                    return false
-                } else {
-                    throw NSError(domain: "test", code: 0, userInfo: nil)
-                }
-            }
-            return verified
         }
 
         public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {

Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift

@@ -1,19 +1,19 @@
 import Foundation
-import Testing
+import XCTest
 @testable import SecretKit
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
-@Suite struct AnySecretTests {
+class AnySecretTests: XCTestCase {
 
-    @Test func eraser() {
+    func testEraser() {
         let secret = SmartCard.Secret(id: UUID().uuidString.data(using: .utf8)!, name: "Name", algorithm: .ellipticCurve, keySize: 256, publicKey: UUID().uuidString.data(using: .utf8)!)
         let erased = AnySecret(secret)
-        #expect(erased.id == secret.id as AnyHashable)
+        XCTAssert(erased.id == secret.id as AnyHashable)
-        #expect(erased.name == secret.name)
+        XCTAssert(erased.name == secret.name)
-        #expect(erased.algorithm == secret.algorithm)
+        XCTAssert(erased.algorithm == secret.algorithm)
-        #expect(erased.keySize == secret.keySize)
+        XCTAssert(erased.keySize == secret.keySize)
-        #expect(erased.publicKey == secret.publicKey)
+        XCTAssert(erased.publicKey == secret.publicKey)
     }
 
 }

Sources/Packages/Tests/SecretKitTests/OpenSSHReaderTests.swift

@@ -1,19 +1,19 @@
 import Foundation
-import Testing
+import XCTest
 @testable import SecretKit
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
-@Suite struct OpenSSHReaderTests {
+class OpenSSHReaderTests: XCTestCase {
 
-    @Test func signatureRequest() {
+    func testSignatureRequest() {
         let reader = OpenSSHReader(data: Constants.signatureRequest)
         let hash = reader.readNextChunk()
-        #expect(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ=="))
+        XCTAssert(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ=="))
         let dataToSign = reader.readNextChunk()
-        #expect(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU="))
+        XCTAssert(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU="))
         let empty = reader.readNextChunk()
-        #expect(empty.isEmpty)
+        XCTAssert(empty.isEmpty)
     }
 
 }

Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift

@@ -1,45 +1,45 @@
 import Foundation
-import Testing
+import XCTest
 @testable import SecretKit
 @testable import SecureEnclaveSecretKit
 @testable import SmartCardSecretKit
 
-@Suite struct OpenSSHWriterTests {
+class OpenSSHWriterTests: XCTestCase {
 
     let writer = OpenSSHKeyWriter()
 
-    @Test func ecdsa256MD5Fingerprint() {
+    func testECDSA256MD5Fingerprint() {
-        #expect(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa256Secret) == "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
+        XCTAssertEqual(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa256Secret), "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5")
     }
 
-    @Test func ecdsa256SHA256Fingerprint() {
+    func testECDSA256SHA256Fingerprint() {
-        #expect(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa256Secret) == "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650")
+        XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa256Secret), "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650")
     }
 
-    @Test func ecdsa256PublicKey() {
+    func testECDSA256PublicKey() {
-        #expect(writer.openSSHString(secret:  Constants.ecdsa256Secret) ==
+        XCTAssertEqual(writer.openSSHString(secret:  Constants.ecdsa256Secret),
         "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")
     }
 
-    @Test func ecdsa256Hash() {
+    func testECDSA256Hash() {
-    #expect(writer.data(secret: Constants.ecdsa256Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo="))
+    XCTAssertEqual(writer.data(secret: Constants.ecdsa256Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo="))
     }
 
-    @Test func ecdsa384MD5Fingerprint() {
+    func testECDSA384MD5Fingerprint() {
-        #expect(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa384Secret) == "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e")
+        XCTAssertEqual(writer.openSSHMD5Fingerprint(secret:  Constants.ecdsa384Secret), "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e")
     }
 
-    @Test func ecdsa384SHA256Fingerprint() {
+    func testECDSA384SHA256Fingerprint() {
-        #expect(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa384Secret) == "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I")
+        XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret:  Constants.ecdsa384Secret), "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I")
     }
 
-    @Test func ecdsa384PublicKey() {
+    func testECDSA384PublicKey() {
-        #expect(writer.openSSHString(secret:  Constants.ecdsa384Secret) ==
+        XCTAssertEqual(writer.openSSHString(secret:  Constants.ecdsa384Secret),
                        "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")
     }
 
-    @Test func ecdsa384Hash() {
+    func testECDSA384Hash() {
-        #expect(writer.data(secret: Constants.ecdsa384Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ=="))
+        XCTAssertEqual(writer.data(secret: Constants.ecdsa384Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ=="))
     }
 
 }

Sources/SecretAgent/AppDelegate.swift

@@ -6,9 +6,8 @@ import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import SecretAgentKit
 import Brief
-import Observation
 
-@main
+@NSApplicationMain
 class AppDelegate: NSObject, NSApplicationDelegate {
 
     private let storeList: SecretStoreList = {
@@ -28,32 +27,22 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         return SocketController(path: path)
     }()
     private var updateSink: AnyCancellable?
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "AppDelegate")
 
     func applicationDidFinishLaunching(_ aNotification: Notification) {
-        logger.debug("SecretAgent finished launching")
+        Logger().debug("SecretAgent finished launching")
-        Task { @MainActor in
+        DispatchQueue.main.async {
-            socketController.handler = { [agent] reader, writer in
+            self.socketController.handler = self.agent.handle(reader:writer:)
-                await agent.handle(reader: reader, writer: writer)
-            }
         }
-        Task {
+        NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in
-            for await _ in NotificationCenter.default.notifications(named: .secretStoreReloaded) {
+            try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
-                try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
-            }
         }
-        try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true)
+        try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
         notifier.prompt()
-        _ = withObservationTracking {
+        updateSink = updater.$update.sink { update in
-            updater.update
+            guard let update = update else { return }
-        } onChange: { [updater, notifier] in
+            self.notifier.notify(update: update, ignore: self.updater.ignore(release:))
-            notifier.notify(update: updater.update!) { release in
-                Task {
-                    await updater.ignore(release: release)
-                }
-            }
         }
     }
-    
+
 }
 

Sources/SecretAgent/Notifier.swift

@@ -4,15 +4,14 @@ import AppKit
 import SecretKit
 import SecretAgentKit
 import Brief
-import Synchronization
 
-final class Notifier: Sendable {
+class Notifier {
 
     private let notificationDelegate = NotificationDelegate()
 
     init() {
-        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: String(localized: "update_notification_update_button"), options: [])
+        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: "Update", options: [])
-        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: String(localized: "update_notification_ignore_button"), options: [])
+        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: "Ignore", options: [])
         let updateCategory = UNNotificationCategory(identifier: Constants.updateCategoryIdentitifier, actions: [updateAction, ignoreAction], intentIdentifiers: [], options: [])
         let criticalUpdateCategory = UNNotificationCategory(identifier: Constants.criticalUpdateCategoryIdentitifier, actions: [updateAction], intentIdentifiers: [], options: [])
 
@@ -23,7 +22,7 @@ final class Notifier: Sendable {
             Measurement(value: 24, unit: UnitDuration.hours)
         ]
 
-        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: String(localized: "persist_authentication_decline_button"), options: [])
+        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: "Do Not Unlock", options: [])
         var allPersistenceActions = [doNotPersistAction]
 
         let formatter = DateComponentsFormatter()
@@ -35,24 +34,20 @@ final class Notifier: Sendable {
             guard let string = formatter.string(from: seconds)?.capitalized else { continue }
             let identifier = Constants.persistAuthenticationCategoryIdentitifier.appending("\(seconds)")
             let action = UNNotificationAction(identifier: identifier, title: string, options: [])
-            notificationDelegate.state.withLock { state in
+            notificationDelegate.persistOptions[identifier] = seconds
-                state.persistOptions[identifier] = seconds
-            }
             allPersistenceActions.append(action)
         }
 
         let persistAuthenticationCategory = UNNotificationCategory(identifier: Constants.persistAuthenticationCategoryIdentitifier, actions: allPersistenceActions, intentIdentifiers: [], options: [])
         if persistAuthenticationCategory.responds(to: Selector(("actionsMenuTitle"))) {
-            persistAuthenticationCategory.setValue(String(localized: "persist_authentication_accept_button"), forKey: "_actionsMenuTitle")
+            persistAuthenticationCategory.setValue("Leave Unlocked", forKey: "_actionsMenuTitle")
         }
         UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory])
         UNUserNotificationCenter.current().delegate = notificationDelegate
 
-        notificationDelegate.state.withLock { state in
+        notificationDelegate.persistAuthentication = { secret, store, duration in
-            state.persistAuthentication = { secret, store, duration in
+            guard let duration = duration else { return }
-                guard let duration = duration else { return }
+            try? store.persistAuthentication(secret: secret, forDuration: duration)
-                try? await store.persistAuthentication(secret: secret, forDuration: duration)
-            }
         }
 
     }
@@ -62,42 +57,42 @@ final class Notifier: Sendable {
         notificationCenter.requestAuthorization(options: .alert) { _, _ in }
     }
 
-    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async {
+    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) {
-        notificationDelegate.state.withLock { state in
+        notificationDelegate.pendingPersistableSecrets[secret.id.description] = secret
-            state.pendingPersistableSecrets[secret.id.description] = secret
+        notificationDelegate.pendingPersistableStores[store.id.description] = store
-            state.pendingPersistableStores[store.id.description] = store
-        }
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
-        notificationContent.title = String(localized: "signed_notification_title_\(provenance.origin.displayName)")
+        notificationContent.title = "Signed Request from \(provenance.origin.displayName)"
-        notificationContent.subtitle = String(localized: "signed_notification_description_\(secret.name)")
+        notificationContent.subtitle = "Using secret \"\(secret.name)\""
         notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
         notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
-        notificationContent.interruptionLevel = .timeSensitive
+        if #available(macOS 12.0, *) {
-        if await store.existingPersistedAuthenticationContext(secret: secret) == nil && secret.requiresAuthentication {
+            notificationContent.interruptionLevel = .timeSensitive
+        }
+        if secret.requiresAuthentication && store.existingPersistedAuthenticationContext(secret: secret) == nil {
             notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
         }
         if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
             notificationContent.attachments = [attachment]
         }
         let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
-        try? await notificationCenter.add(request)
+        notificationCenter.add(request, withCompletionHandler: nil)
     }
 
     func notify(update: Release, ignore: ((Release) -> Void)?) {
-        notificationDelegate.state.withLock { [update] state in
+        notificationDelegate.release = update
-            state.release = update
+        notificationDelegate.ignore = ignore
-//            state.ignore = ignore
-        }
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
         if update.critical {
-            notificationContent.interruptionLevel = .critical
+            if #available(macOS 12.0, *) {
-            notificationContent.title = String(localized: "update_notification_update_critical_title_\(update.name)")
+                notificationContent.interruptionLevel = .critical
+            }
+            notificationContent.title = "Critical Security Update - \(update.name)"
         } else {
-            notificationContent.title = String(localized: "update_notification_update_normal_title_\(update.name)")
+            notificationContent.title = "Update Available - \(update.name)"
         }
-        notificationContent.subtitle = String(localized: "update_notification_update_description")
+        notificationContent.subtitle = "Click to Update"
         notificationContent.body = update.body
         notificationContent.categoryIdentifier = update.critical ? Constants.criticalUpdateCategoryIdentitifier : Constants.updateCategoryIdentitifier
         let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)
@@ -108,11 +103,11 @@ final class Notifier: Sendable {
 
 extension Notifier: SigningWitness {
 
-    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
+    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
     }
 
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws {
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
-        await notify(accessTo: secret, from: store, by: provenance)
+        notify(accessTo: secret, from: store, by: provenance)
     }
 
 }
@@ -138,66 +133,55 @@ extension Notifier {
 
 }
 
-final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Sendable {
+class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
+
+    fileprivate var release: Release?
+    fileprivate var ignore: ((Release) -> Void)?
+    fileprivate var persistAuthentication: ((AnySecret, AnySecretStore, TimeInterval?) -> Void)?
+    fileprivate var persistOptions: [String: TimeInterval] = [:]
+    fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
+    fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
 
-    struct State {
-        typealias PersistAuthentication = ((AnySecret, AnySecretStore, TimeInterval?) async -> Void)
-        typealias Ignore = ((Release) -> Void)
-        fileprivate var release: Release?
-        fileprivate var ignore: Ignore?
-        fileprivate var persistAuthentication: PersistAuthentication?
-        fileprivate var persistOptions: [String: TimeInterval] = [:]
-        fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:]
-        fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:]
-    }
-    
-    fileprivate let state: Mutex<State> = .init(.init())
-    
     func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) {
 
     }
-    
+
-    func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse) async {
+    func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
         let category = response.notification.request.content.categoryIdentifier
         switch category {
         case Notifier.Constants.updateCategoryIdentitifier:
             handleUpdateResponse(response: response)
         case Notifier.Constants.persistAuthenticationCategoryIdentitifier:
-            await handlePersistAuthenticationResponse(response: response)
+            handlePersistAuthenticationResponse(response: response)
         default:
             break
         }
+
+        completionHandler()
     }
 
     func handleUpdateResponse(response: UNNotificationResponse) {
-        state.withLock { state in
+        guard let update = release else { return }
-            guard let update = state.release else { return }
+        switch response.actionIdentifier {
-            switch response.actionIdentifier {
+        case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier:
-            case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier:
+            NSWorkspace.shared.open(update.html_url)
-                NSWorkspace.shared.open(update.html_url)
+        case Notifier.Constants.ignoreActionIdentitifier:
-            case Notifier.Constants.ignoreActionIdentitifier:
+            ignore?(update)
-                state.ignore?(update)
+        default:
-            default:
+            fatalError()
-                fatalError()
-            }
         }
     }
 
-    func handlePersistAuthenticationResponse(response: UNNotificationResponse) async {
+    func handlePersistAuthenticationResponse(response: UNNotificationResponse) {
-//        let (secret, store, persistOptions, callback): (AnySecret?, AnySecretStore?, TimeInterval?, State.PersistAuthentication?) = state.withLock { state in
+        guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String, let secret = pendingPersistableSecrets[secretID],
-//            guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String, let secret = state.pendingPersistableSecrets[secretID],
+              let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String, let store = pendingPersistableStores[storeID]
-//                  let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String, let store = state.pendingPersistableStores[storeID]
+        else { return }
-//            else { return (nil, nil, nil, nil) }
+        pendingPersistableSecrets[secretID] = nil
-//            state.pendingPersistableSecrets[secretID] = nil
+        persistAuthentication?(secret, store, persistOptions[response.actionIdentifier])
-//            return (secret, store, state.persistOptions[response.actionIdentifier], state.persistAuthentication)
-//        }
-//        guard let secret, let store, let persistOptions else { return }
-//        await callback?(secret, store, persistOptions)
     }
 
-    
+    func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
-    func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification) async -> UNNotificationPresentationOptions {
+        completionHandler([.list, .banner])
-        [.list, .banner]
     }
 
 }

Sources/Secretive.xcodeproj/project.pbxproj

@@ -3,7 +3,7 @@
 	archiveVersion = 1;
 	classes = {
 	};
-	objectVersion = 54;
+	objectVersion = 52;
 	objects = {
 
 /* Begin PBXBuildFile section */
@@ -18,7 +18,6 @@
 		5003EF612780081600DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF602780081600DF2006 /* SmartCardSecretKit */; };
 		5003EF632780081B00DF2006 /* SecureEnclaveSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF622780081B00DF2006 /* SecureEnclaveSecretKit */; };
 		5003EF652780081B00DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF642780081B00DF2006 /* SmartCardSecretKit */; };
-		500B93C32B478D8400E157DE /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 500B93C22B478D8400E157DE /* Localizable.xcstrings */; };
 		501421622781262300BBAA70 /* Brief in Frameworks */ = {isa = PBXBuildFile; productRef = 501421612781262300BBAA70 /* Brief */; };
 		501421652781268000BBAA70 /* SecretAgent.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = 50A3B78A24026B7500D209EA /* SecretAgent.app */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		50153E20250AFCB200525160 /* UpdateView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50153E1F250AFCB200525160 /* UpdateView.swift */; };
@@ -30,6 +29,7 @@
 		50617D8523FCE48E0099B055 /* ContentView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D8423FCE48E0099B055 /* ContentView.swift */; };
 		50617D8723FCE48E0099B055 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8623FCE48E0099B055 /* Assets.xcassets */; };
 		50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8923FCE48E0099B055 /* Preview Assets.xcassets */; };
+		50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D9823FCE48E0099B055 /* SecretiveTests.swift */; };
 		50617DD223FCEFA90099B055 /* PreviewStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617DD123FCEFA90099B055 /* PreviewStore.swift */; };
 		5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */; };
 		5066A6C22516F303004B5A36 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C12516F303004B5A36 /* SetupView.swift */; };
@@ -51,7 +51,6 @@
 		50B8550D24138C4F009958AC /* DeleteSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50B8550C24138C4F009958AC /* DeleteSecretView.swift */; };
 		50BB046B2418AAAE00D6E079 /* EmptyStoreView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */; };
 		50C385A52407A76D00AF2719 /* SecretDetailView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50C385A42407A76D00AF2719 /* SecretDetailView.swift */; };
-		50E9CF422B51D596004AB36D /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 500B93C22B478D8400E157DE /* Localizable.xcstrings */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -62,6 +61,13 @@
 			remoteGlobalIDString = 50A3B78924026B7500D209EA;
 			remoteInfo = SecretAgent;
 		};
+		50617D9523FCE48E0099B055 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 50617D7723FCE48D0099B055 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = 50617D7E23FCE48D0099B055;
+			remoteInfo = Secretive;
+		};
 /* End PBXContainerItemProxy section */
 
 /* Begin PBXCopyFilesBuildPhase section */
@@ -102,7 +108,6 @@
 		50020BAF24064869003D4025 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
 		50033AC227813F1700253856 /* BundleIDs.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BundleIDs.swift; sourceTree = "<group>"; };
 		5003EF39278005C800DF2006 /* Packages */ = {isa = PBXFileReference; lastKnownFileType = wrapper; path = Packages; sourceTree = "<group>"; };
-		500B93C22B478D8400E157DE /* Localizable.xcstrings */ = {isa = PBXFileReference; lastKnownFileType = text.json.xcstrings; path = Localizable.xcstrings; sourceTree = "<group>"; };
 		50153E1F250AFCB200525160 /* UpdateView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = UpdateView.swift; sourceTree = "<group>"; };
 		50153E21250DECA300525160 /* SecretListItemView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretListItemView.swift; sourceTree = "<group>"; };
 		5018F54E24064786002EB505 /* Notifier.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Notifier.swift; sourceTree = "<group>"; };
@@ -115,6 +120,9 @@
 		50617D8923FCE48E0099B055 /* Preview Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = "Preview Assets.xcassets"; sourceTree = "<group>"; };
 		50617D8E23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50617D8F23FCE48E0099B055 /* Secretive.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Secretive.entitlements; sourceTree = "<group>"; };
+		50617D9423FCE48E0099B055 /* SecretiveTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = SecretiveTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; };
+		50617D9823FCE48E0099B055 /* SecretiveTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretiveTests.swift; sourceTree = "<group>"; };
+		50617D9A23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50617DD123FCEFA90099B055 /* PreviewStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PreviewStore.swift; sourceTree = "<group>"; };
 		5065E312295517C500E16645 /* ToolbarButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolbarButtonStyle.swift; sourceTree = "<group>"; };
 		5066A6C12516F303004B5A36 /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; };
@@ -155,6 +163,13 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		50617D9123FCE48E0099B055 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50A3B78724026B7500D209EA /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			buildActionMask = 2147483647;
@@ -183,6 +198,7 @@
 			children = (
 				5003EF39278005C800DF2006 /* Packages */,
 				50617D8123FCE48E0099B055 /* Secretive */,
+				50617D9723FCE48E0099B055 /* SecretiveTests */,
 				50A3B78B24026B7500D209EA /* SecretAgent */,
 				508A58AF241E144C0069DC07 /* Config */,
 				50617D8023FCE48E0099B055 /* Products */,
@@ -194,6 +210,7 @@
 			isa = PBXGroup;
 			children = (
 				50617D7F23FCE48E0099B055 /* Secretive.app */,
+				50617D9423FCE48E0099B055 /* SecretiveTests.xctest */,
 				50A3B78A24026B7500D209EA /* SecretAgent.app */,
 			);
 			name = Products;
@@ -211,7 +228,6 @@
 				508BF28D25B4F005009EFB7E /* InternetAccessPolicy.plist */,
 				50617D8F23FCE48E0099B055 /* Secretive.entitlements */,
 				506772C62424784600034DED /* Credits.rtf */,
-				500B93C22B478D8400E157DE /* Localizable.xcstrings */,
 				50617D8823FCE48E0099B055 /* Preview Content */,
 			);
 			path = Secretive;
@@ -228,6 +244,15 @@
 			path = "Preview Content";
 			sourceTree = "<group>";
 		};
+		50617D9723FCE48E0099B055 /* SecretiveTests */ = {
+			isa = PBXGroup;
+			children = (
+				50617D9823FCE48E0099B055 /* SecretiveTests.swift */,
+				50617D9A23FCE48E0099B055 /* Info.plist */,
+			);
+			path = SecretiveTests;
+			sourceTree = "<group>";
+		};
 		508A58AF241E144C0069DC07 /* Config */ = {
 			isa = PBXGroup;
 			children = (
@@ -241,7 +266,6 @@
 			isa = PBXGroup;
 			children = (
 				50617D8423FCE48E0099B055 /* ContentView.swift */,
-				5065E312295517C500E16645 /* ToolbarButtonStyle.swift */,
 				5079BA0E250F29BF00EA86F4 /* StoreListView.swift */,
 				50153E21250DECA300525160 /* SecretListItemView.swift */,
 				50C385A42407A76D00AF2719 /* SecretDetailView.swift */,
@@ -253,6 +277,7 @@
 				50153E1F250AFCB200525160 /* UpdateView.swift */,
 				5066A6C12516F303004B5A36 /* SetupView.swift */,
 				5066A6C72516FE6E004B5A36 /* CopyableView.swift */,
+				5065E312295517C500E16645 /* ToolbarButtonStyle.swift */,
 			);
 			path = Views;
 			sourceTree = "<group>";
@@ -328,6 +353,24 @@
 			productReference = 50617D7F23FCE48E0099B055 /* Secretive.app */;
 			productType = "com.apple.product-type.application";
 		};
+		50617D9323FCE48E0099B055 /* SecretiveTests */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 50617DA023FCE48E0099B055 /* Build configuration list for PBXNativeTarget "SecretiveTests" */;
+			buildPhases = (
+				50617D9023FCE48E0099B055 /* Sources */,
+				50617D9123FCE48E0099B055 /* Frameworks */,
+				50617D9223FCE48E0099B055 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				50617D9623FCE48E0099B055 /* PBXTargetDependency */,
+			);
+			name = SecretiveTests;
+			productName = SecretiveTests;
+			productReference = 50617D9423FCE48E0099B055 /* SecretiveTests.xctest */;
+			productType = "com.apple.product-type.bundle.unit-test";
+		};
 		50A3B78924026B7500D209EA /* SecretAgent */ = {
 			isa = PBXNativeTarget;
 			buildConfigurationList = 50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */;
@@ -366,6 +409,10 @@
 					50617D7E23FCE48D0099B055 = {
 						CreatedOnToolsVersion = 11.3;
 					};
+					50617D9323FCE48E0099B055 = {
+						CreatedOnToolsVersion = 11.3;
+						TestTargetID = 50617D7E23FCE48D0099B055;
+					};
 					50A3B78924026B7500D209EA = {
 						CreatedOnToolsVersion = 11.4;
 					};
@@ -378,13 +425,6 @@
 			knownRegions = (
 				en,
 				Base,
-				it,
-				fr,
-				de,
-				"pt-BR",
-				fi,
-				ko,
-				ca,
 			);
 			mainGroup = 50617D7623FCE48D0099B055;
 			productRefGroup = 50617D8023FCE48E0099B055 /* Products */;
@@ -392,6 +432,7 @@
 			projectRoot = "";
 			targets = (
 				50617D7E23FCE48D0099B055 /* Secretive */,
+				50617D9323FCE48E0099B055 /* SecretiveTests */,
 				50A3B78924026B7500D209EA /* SecretAgent */,
 			);
 		};
@@ -403,19 +444,24 @@
 			buildActionMask = 2147483647;
 			files = (
 				50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */,
-				500B93C32B478D8400E157DE /* Localizable.xcstrings in Resources */,
 				50617D8723FCE48E0099B055 /* Assets.xcassets in Resources */,
 				506772C72424784600034DED /* Credits.rtf in Resources */,
 				508BF28E25B4F005009EFB7E /* InternetAccessPolicy.plist in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		50617D9223FCE48E0099B055 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50A3B78824026B7500D209EA /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
 				50A3B79724026B7600D209EA /* Main.storyboard in Resources */,
-				50E9CF422B51D596004AB36D /* Localizable.xcstrings in Resources */,
 				50A3B79424026B7600D209EA /* Preview Assets.xcassets in Resources */,
 				50A3B79124026B7600D209EA /* Assets.xcassets in Resources */,
 				508BF2AA25B4F1CB009EFB7E /* InternetAccessPolicy.plist in Resources */,
@@ -455,6 +501,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		50617D9023FCE48E0099B055 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		50A3B78624026B7500D209EA /* Sources */ = {
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -472,6 +526,11 @@
 			target = 50A3B78924026B7500D209EA /* SecretAgent */;
 			targetProxy = 50142166278126B500BBAA70 /* PBXContainerItemProxy */;
 		};
+		50617D9623FCE48E0099B055 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = 50617D7E23FCE48D0099B055 /* Secretive */;
+			targetProxy = 50617D9523FCE48E0099B055 /* PBXContainerItemProxy */;
+		};
 /* End PBXTargetDependency section */
 
 /* Begin PBXVariantGroup section */
@@ -538,18 +597,16 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
-				OTHER_SWIFT_FLAGS = "";
+				OTHER_SWIFT_FLAGS = "-Xfrontend -warn-concurrency -Xfrontend -enable-actor-data-race-checks";
 				SDKROOT = macosx;
 				STRIP_INSTALLED_PRODUCT = NO;
 				STRIP_SWIFT_SYMBOLS = NO;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 6.0;
 			};
 			name = Debug;
 		};
@@ -599,17 +656,15 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				MTL_FAST_MATH = YES;
-				OTHER_SWIFT_FLAGS = "";
+				OTHER_SWIFT_FLAGS = "-Xfrontend -warn-concurrency -Xfrontend -enable-actor-data-race-checks";
 				SDKROOT = macosx;
 				STRIP_INSTALLED_PRODUCT = NO;
 				STRIP_SWIFT_SYMBOLS = NO;
 				SWIFT_COMPILATION_MODE = wholemodule;
-				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
-				SWIFT_VERSION = 6.0;
 			};
 			name = Release;
 		};
@@ -636,6 +691,7 @@
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE_SPECIFIER = "";
+				SWIFT_VERSION = 5.0;
 			};
 			name = Debug;
 		};
@@ -662,6 +718,49 @@
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE_SPECIFIER = "Secretive - Host";
+				SWIFT_VERSION = 5.0;
+			};
+			name = Release;
+		};
+		50617DA123FCE48E0099B055 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				DEVELOPMENT_TEAM = Z72PRUAWF6;
+				INFOPLIST_FILE = SecretiveTests/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/../Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive";
+			};
+			name = Debug;
+		};
+		50617DA223FCE48E0099B055 /* Release */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_STYLE = Automatic;
+				COMBINE_HIDPI_IMAGES = YES;
+				DEVELOPMENT_TEAM = Z72PRUAWF6;
+				INFOPLIST_FILE = SecretiveTests/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/../Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive";
 			};
 			name = Release;
 		};
@@ -717,18 +816,16 @@
 				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
 				GCC_WARN_UNUSED_FUNCTION = YES;
 				GCC_WARN_UNUSED_VARIABLE = YES;
-				MACOSX_DEPLOYMENT_TARGET = 15.0;
+				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
-				OTHER_SWIFT_FLAGS = "";
+				OTHER_SWIFT_FLAGS = "-Xfrontend -warn-concurrency -Xfrontend -enable-actor-data-race-checks";
 				SDKROOT = macosx;
 				STRIP_INSTALLED_PRODUCT = NO;
 				STRIP_SWIFT_SYMBOLS = NO;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 6.0;
 			};
 			name = Test;
 		};
@@ -751,6 +848,29 @@
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
+			};
+			name = Test;
+		};
+		508A5916241EF1A00069DC07 /* Test */ = {
+			isa = XCBuildConfiguration;
+			buildSettings = {
+				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
+				BUNDLE_LOADER = "$(TEST_HOST)";
+				CODE_SIGN_IDENTITY = "-";
+				CODE_SIGN_STYLE = Manual;
+				COMBINE_HIDPI_IMAGES = YES;
+				INFOPLIST_FILE = SecretiveTests/Info.plist;
+				LD_RUNPATH_SEARCH_PATHS = (
+					"$(inherited)",
+					"@executable_path/../Frameworks",
+					"@loader_path/../Frameworks",
+				);
+				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				PROVISIONING_PROFILE_SPECIFIER = "";
+				SWIFT_VERSION = 5.0;
+				TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive";
 			};
 			name = Test;
 		};
@@ -771,6 +891,7 @@
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
 			};
 			name = Test;
 		};
@@ -793,6 +914,7 @@
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
+				SWIFT_VERSION = 5.0;
 			};
 			name = Debug;
 		};
@@ -817,6 +939,7 @@
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
 				PROVISIONING_PROFILE_SPECIFIER = "Secretive - Secret Agent";
+				SWIFT_VERSION = 5.0;
 			};
 			name = Release;
 		};
@@ -843,6 +966,16 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		50617DA023FCE48E0099B055 /* Build configuration list for PBXNativeTarget "SecretiveTests" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				50617DA123FCE48E0099B055 /* Debug */,
+				508A5916241EF1A00069DC07 /* Test */,
+				50617DA223FCE48E0099B055 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 		50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */ = {
 			isa = XCConfigurationList;
 			buildConfigurations = (

Sources/Secretive/App.swift

@@ -5,20 +5,9 @@ import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import Brief
 
-extension EnvironmentValues {
-    @Entry var secretStoreList: SecretStoreList = {
-        let list = SecretStoreList()
-        list.add(store: SecureEnclave.Store())
-        list.add(store: SmartCard.Store())
-        return list
-    }()
-    @Entry var agentStatusChecker: any AgentStatusCheckerProtocol = AgentStatusChecker()
-    @Entry var updater: any UpdaterProtocol = Updater(checkOnLaunch: false)
-}
-
 @main
 struct Secretive: App {
-    
+
     private let storeList: SecretStoreList = {
         let list = SecretStoreList()
         list.add(store: SecureEnclave.Store())
@@ -34,10 +23,10 @@ struct Secretive: App {
 
     @SceneBuilder var body: some Scene {
         WindowGroup {
-            ContentView(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup)
+            ContentView<Updater, AgentStatusChecker>(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup)
-                .environment(storeList)
+                .environmentObject(storeList)
-                .environment(Updater(checkOnLaunch: hasRunSetup))
+                .environmentObject(Updater(checkOnLaunch: hasRunSetup))
-                .environment(agentStatusChecker)
+                .environmentObject(agentStatusChecker)
                 .onAppear {
                     if !hasRunSetup {
                         showingSetup = true
@@ -56,18 +45,18 @@ struct Secretive: App {
         }
         .commands {
             CommandGroup(after: CommandGroupPlacement.newItem) {
-                Button("app_menu_new_secret_button") {
+                Button("New Secret") {
                     showingCreation = true
                 }
                 .keyboardShortcut(KeyboardShortcut(KeyEquivalent("N"), modifiers: [.command, .shift]))
             }
             CommandGroup(replacing: .help) {
-                Button("app_menu_help_button") {
+                Button("Help") {
                     NSWorkspace.shared.open(Constants.helpURL)
                 }
             }
             CommandGroup(after: .help) {
-                Button("app_menu_setup_button") {
+                Button("Setup Secretive") {
                     showingSetup = true
                 }
             }
@@ -81,12 +70,13 @@ extension Secretive {
 
     private func reinstallAgent() {
         justUpdatedChecker.check()
-        Task {
+        LaunchAgentController().install {
-            await LaunchAgentController().install()
+            // Wait a second for launchd to kick in (next runloop isn't enough).
-            try? await Task.sleep(for: .seconds(1))
+            DispatchQueue.main.asyncAfter(deadline: .now() + 1) {
-            agentStatusChecker.check()
+                agentStatusChecker.check()
-            if !agentStatusChecker.running {
+                if !agentStatusChecker.running {
-                forceLaunchAgent()
+                    forceLaunchAgent()
+                }
             }
         }
     }
@@ -94,8 +84,7 @@ extension Secretive {
     private func forceLaunchAgent() {
         // We've run setup, we didn't just update, launchd is just not doing it's thing.
         // Force a launch directly.
-        Task {
+        LaunchAgentController().forceLaunch { _ in
-            _ = await LaunchAgentController().forceLaunch()
             agentStatusChecker.check()
         }
     }

Sources/Secretive/Controllers/AgentStatusChecker.swift

@@ -2,16 +2,15 @@ import Foundation
 import Combine
 import AppKit
 import SecretKit
-import Observation
 
-protocol AgentStatusCheckerProtocol: Observable {
+protocol AgentStatusCheckerProtocol: ObservableObject {
     var running: Bool { get }
     var developmentBuild: Bool { get }
 }
 
-@Observable class AgentStatusChecker: AgentStatusCheckerProtocol {
+class AgentStatusChecker: ObservableObject, AgentStatusCheckerProtocol {
 
-    var running: Bool = false
+    @Published var running: Bool = false
 
     init() {
         check()

Sources/Secretive/Controllers/LaunchAgentController.swift

@@ -6,47 +6,38 @@ import SecretKit
 
 struct LaunchAgentController {
     
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController")
+    func install(completion: (() -> Void)? = nil) {
-
+        Logger().debug("Installing agent")
-    func install() async {
-        logger.debug("Installing agent")
         _ = setEnabled(false)
         // This is definitely a bit of a "seems to work better" thing but:
         // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old
         // and start new?
-        try? await Task.sleep(for: .seconds(1))
+        DispatchQueue.main.asyncAfter(deadline: .now() + 0.1) {
-        await MainActor.run {
             _  = setEnabled(true)
+            completion?()
         }
+
     }
 
-    func forceLaunch() async -> Bool {
+    func forceLaunch(completion: ((Bool) -> Void)?) {
-        logger.debug("Agent is not running, attempting to force launch")
+        Logger().debug("Agent is not running, attempting to force launch")
         let url = Bundle.main.bundleURL.appendingPathComponent("Contents/Library/LoginItems/SecretAgent.app")
         let config = NSWorkspace.OpenConfiguration()
         config.activates = false
-        do {
+        NSWorkspace.shared.openApplication(at: url, configuration: config) { app, error in
-            try await NSWorkspace.shared.openApplication(at: url, configuration: config)
+            DispatchQueue.main.async {
-            logger.debug("Agent force launched")
+                completion?(error == nil)
-            return true
+            }
-        } catch {
+            if let error = error {
-            logger.error("Error force launching \(error.localizedDescription)")
+                Logger().error("Error force launching \(error.localizedDescription)")
-            return false
+            } else {
+                Logger().debug("Agent force launched")
+            }
         }
     }
 
     private func setEnabled(_ enabled: Bool) -> Bool {
-        let service = SMAppService.loginItem(identifier: Bundle.main.agentBundleID)
+        SMLoginItemSetEnabled(Bundle.main.agentBundleID as CFString, enabled)
-        do {
-            if enabled {
-                try service.register()
-            } else {
-                try service.unregister()
-            }
-            return true
-        } catch {
-            return false
-        }
     }
 
 }

Sources/Secretive/Preview Content/PreviewStore.swift

@@ -18,69 +18,65 @@ extension Preview {
 
 }
 
-//extension Preview {
+extension Preview {
-//
+
-//    class Store: SecretStore, ObservableObject {
+    class Store: SecretStore, ObservableObject {
-//
+
-//        let isAvailable = true
+        let isAvailable = true
-//        let id = UUID()
+        let id = UUID()
-//        var name: String { "Preview Store" }
+        var name: String { "Preview Store" }
-//        @Published var secrets: [Secret] = []
+        @Published var secrets: [Secret] = []
-//
+
-//        init(secrets: [Secret]) {
+        init(secrets: [Secret]) {
-//            self.secrets.append(contentsOf: secrets)
+            self.secrets.append(contentsOf: secrets)
-//        }
+        }
-//
+
-//        init(numberOfRandomSecrets: Int = 5) {
+        init(numberOfRandomSecrets: Int = 5) {
-//            let new = (0..<numberOfRandomSecrets).map { Secret(name: String(describing: $0)) }
+            let new = (0..<numberOfRandomSecrets).map { Secret(name: String(describing: $0)) }
-//            self.secrets.append(contentsOf: new)
+            self.secrets.append(contentsOf: new)
-//        }
+        }
-//
+
-//        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
+        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
-//            return data
+            return data
-//        }
+        }
-//
+
-//        func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool {
+        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
-//            true
+            nil
-//        }
+        }
-//
+
-//        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
+        func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws {
-//            nil
+        }
-//        }
+
-//
+        func reloadSecrets() {
-//        func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws {
+        }
-//        }
+
-//
+    }
-//        func reloadSecrets() {
+
-//        }
+    class StoreModifiable: Store, SecretStoreModifiable {
-//
+        override var name: String { "Modifiable Preview Store" }
-//    }
+
-//
+        func create(name: String, requiresAuthentication: Bool) throws {
-//    class StoreModifiable: Store, SecretStoreModifiable {
+        }
-//        override var name: String { "Modifiable Preview Store" }
+
-//
+        func delete(secret: Preview.Secret) throws {
-//        func create(name: String, requiresAuthentication: Bool) throws {
+        }
-//        }
+
-//
+        func update(secret: Preview.Secret, name: String) throws {
-//        func delete(secret: Preview.Secret) throws {
+        }
-//        }
+    }
-//
+}
-//        func update(secret: Preview.Secret, name: String) throws {
+
-//        }
+extension Preview {
-//    }
+
-//}
+    static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList {
-//
+        let list = SecretStoreList()
-//extension Preview {
+        for store in stores {
-//
+            list.add(store: store)
-//    static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList {
+        }
-//        let list = SecretStoreList()
+        for storeModifiable in modifiableStores {
-//        for store in stores {
+            list.add(store: storeModifiable)
-//            list.add(store: store)
+        }
-//        }
+        return list
-//        for storeModifiable in modifiableStores {
+    }
-//            list.add(store: storeModifiable)
+
-//        }
+}
-//        return list
-//    }
-//
-//}

Sources/Secretive/Preview Content/PreviewUpdater.swift

@@ -1,32 +1,20 @@
 import Foundation
-import Synchronization
+import Combine
-import Observation
 import Brief
 
-@Observable class PreviewUpdater: UpdaterProtocol {
+class PreviewUpdater: UpdaterProtocol {
-
-    var update: Release? {
-        _update.withLock { $0 }
-    }
-    let _update: Mutex<Release?> = .init(nil)
 
+    let update: Release?
     let testBuild = false
 
     init(update: Update = .none) {
         switch update {
         case .none:
-            _update.withLock {
+            self.update = nil
-                $0 = nil
-            }
         case .advisory:
-            _update.withLock {
+            self.update = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Some regular update")
-                $0 = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Some regular update")
-            }
         case .critical:
-            _update.withLock {
+            self.update = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
-                $0 = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update")
-
-            }
         }
     }
 

Sources/Secretive/Views/ContentView.swift

@@ -4,18 +4,17 @@ import SecureEnclaveSecretKit
 import SmartCardSecretKit
 import Brief
 
-struct ContentView: View {
+struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentStatusCheckerProtocol>: View {
 
     @Binding var showingCreation: Bool
     @Binding var runningSetup: Bool
     @Binding var hasRunSetup: Bool
     @State var showingAgentInfo = false
-    @State var activeSecret: AnySecret.ID?
     @Environment(\.colorScheme) var colorScheme
 
-    @Environment(\.secretStoreList) private var storeList: SecretStoreList
+    @EnvironmentObject private var storeList: SecretStoreList
-    @Environment(\.updater) private var updater: any UpdaterProtocol
+    @EnvironmentObject private var updater: UpdaterType
-    @Environment(\.agentStatusChecker) private var agentStatusChecker: any AgentStatusCheckerProtocol
+    @EnvironmentObject private var agentStatusChecker: AgentStatusCheckerType
 
     @State private var selectedUpdate: Release?
     @State private var showingAppPathNotice = false
@@ -23,7 +22,7 @@ struct ContentView: View {
     var body: some View {
         VStack {
             if storeList.anyAvailable {
-                StoreListView(activeSecret: $activeSecret)
+                StoreListView(showingCreation: $showingCreation)
             } else {
                 NoStoresView()
             }
@@ -64,15 +63,15 @@ extension ContentView {
         }
     }
 
-    var updateNoticeContent: (LocalizedStringKey, Color)? {
+    var updateNoticeContent: (String, Color)? {
         guard let update = updater.update else { return nil }
         if update.critical {
-            return ("update_critical_notice_title", .red)
+            return ("Critical Security Update Required", .red)
         } else {
             if updater.testBuild {
-                return ("update_test_notice_title", .blue)
+                return ("Test Build", .blue)
             } else {
-                return ("update_normal_notice_title", .orange)
+                return ("Update Available", .orange)
             }
         }
     }
@@ -88,7 +87,7 @@ extension ContentView {
                     .foregroundColor(.white)
             })
             .buttonStyle(ToolbarButtonStyle(color: color))
-            .popover(item: $selectedUpdate, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) { update in
+            .popover(item: $selectedUpdate, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) { update in
                 UpdateDetailView(update: update)
             }
         }
@@ -105,10 +104,6 @@ extension ContentView {
             .sheet(isPresented: $showingCreation) {
                 if let modifiable = storeList.modifiableStore {
                     CreateSecretView(store: modifiable, showing: $showingCreation)
-                        .onDisappear {
-                            guard let newest = modifiable.secrets.last?.id else { return }
-                            activeSecret = newest
-                        }
                 }
             }
         }
@@ -121,9 +116,9 @@ extension ContentView {
         }, label: {
             Group {
                 if hasRunSetup && !agentStatusChecker.running {
-                    Text("agent_not_running_notice_title")
+                    Text("Secret Agent Is Not Running")
                 } else {
-                    Text("agent_setup_notice_title")
+                    Text("Setup Secretive")
                 }
             }
             .font(.headline)
@@ -138,7 +133,7 @@ extension ContentView {
             showingAgentInfo = true
         }, label: {
             HStack {
-                Text("agent_running_notice_title")
+                Text("Agent is Running")
                     .font(.headline)
                     .foregroundColor(colorScheme == .light ? Color(white: 0.3) : .white)
                 Circle()
@@ -147,12 +142,12 @@ extension ContentView {
             }
         })
         .buttonStyle(ToolbarButtonStyle(lightColor: .black.opacity(0.05), darkColor: .white.opacity(0.05)))
-        .popover(isPresented: $showingAgentInfo, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) {
+        .popover(isPresented: $showingAgentInfo, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
             VStack {
-                Text("agent_running_notice_detail_title")
+                Text("SecretAgent is Running")
                     .font(.title)
                     .padding(5)
-                Text("agent_running_notice_detail_description")
+                Text("SecretAgent is a process that runs in the background to sign requests, so you don't need to keep Secretive open all the time.\n\n**You can close Secretive, and everything will still keep working.**")
                     .frame(width: 300)
             }
             .padding()
@@ -166,19 +161,19 @@ extension ContentView {
                 showingAppPathNotice = true
             }, label: {
                 Group {
-                    Text("app_not_in_applications_notice_title")
+                    Text("Secretive Is Not in Applications Folder")
                 }
                 .font(.headline)
                 .foregroundColor(.white)
             })
             .buttonStyle(ToolbarButtonStyle(color: .orange))
-            .popover(isPresented: $showingAppPathNotice, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) {
+            .popover(isPresented: $showingAppPathNotice, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
                 VStack {
                     Image(systemName: "exclamationmark.triangle")
                         .resizable()
                         .aspectRatio(contentMode: .fit)
                         .frame(width: 64)
-                    Text("app_not_in_applications_notice_detail_description")
+                    Text("Secretive needs to be in your Applications folder to work properly. Please move it and relaunch.")
                         .frame(maxWidth: 300)
                 }
                 .padding()
@@ -186,48 +181,43 @@ extension ContentView {
         }
     }
 
-    var attachmentAnchor: PopoverAttachmentAnchor {
-        // Ideally .point(.bottom), but broken on Sonoma (FB12726503)
-        .rect(.bounds)
-    }
-
 }
 
-//#if DEBUG
+#if DEBUG
-//
+
-//struct ContentView_Previews: PreviewProvider {
+struct ContentView_Previews: PreviewProvider {
-//
+
-//    private static let storeList: SecretStoreList = {
+    private static let storeList: SecretStoreList = {
-//        let list = SecretStoreList()
+        let list = SecretStoreList()
-//        list.add(store: SecureEnclave.Store())
+        list.add(store: SecureEnclave.Store())
-//        list.add(store: SmartCard.Store())
+        list.add(store: SmartCard.Store())
-//        return list
+        return list
-//    }()
+    }()
-//    private static let agentStatusChecker = AgentStatusChecker()
+    private static let agentStatusChecker = AgentStatusChecker()
-//    private static let justUpdatedChecker = JustUpdatedChecker()
+    private static let justUpdatedChecker = JustUpdatedChecker()
-//
+
-//    @State var hasRunSetup = false
+    @State var hasRunSetup = false
-//    @State private var showingSetup = false
+    @State private var showingSetup = false
-//    @State private var showingCreation = false
+    @State private var showingCreation = false
-//
+
-//    static var previews: some View {
+    static var previews: some View {
-//        Group {
+        Group {
-//            // Empty on modifiable and nonmodifiable
+            // Empty on modifiable and nonmodifiable
-//            ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
+            ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
-//                .environmentObject(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)]))
+                .environmentObject(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)]))
-//                .environmentObject(PreviewUpdater())
+                .environmentObject(PreviewUpdater())
-//                .environmentObject(agentStatusChecker)
+                .environmentObject(agentStatusChecker)
-//
+
-//            // 5 items on modifiable and nonmodifiable
+            // 5 items on modifiable and nonmodifiable
-//            ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
+            ContentView<PreviewUpdater, AgentStatusChecker>(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true))
-//                .environmentObject(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()]))
+                .environmentObject(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()]))
-//                .environmentObject(PreviewUpdater())
+                .environmentObject(PreviewUpdater())
-//                .environmentObject(agentStatusChecker)
+                .environmentObject(agentStatusChecker)
-//        }
+        }
-//        .environmentObject(agentStatusChecker)
+        .environmentObject(agentStatusChecker)
-//
+
-//    }
+    }
-//}
+}
-//
+
-//#endif
+#endif
 

Sources/Secretive/Views/CopyableView.swift

@@ -3,7 +3,7 @@ import UniformTypeIdentifiers
 
 struct CopyableView: View {
 
-    var title: LocalizedStringKey
+    var title: String
     var image: Image
     var text: String
 
@@ -66,12 +66,12 @@ struct CopyableView: View {
         )
     }
 
-    var hoverText: LocalizedStringKey {
+    var hoverText: String {
         switch interactionState {
         case .hovering:
-            return "copyable_click_to_copy_button"
+            return "Click to Copy"
         case .clicking:
-            return "copyable_copied"
+            return "Copied"
         case .normal:
             fatalError()
         }
@@ -122,9 +122,9 @@ struct CopyableView: View {
 struct CopyableView_Previews: PreviewProvider {
     static var previews: some View {
         Group {
-            CopyableView(title: "secret_detail_sha256_fingerprint_label", image: Image(systemName: "figure.wave"), text: "Hello world.")
+            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Hello world.")
                 .padding()
-            CopyableView(title: "secret_detail_sha256_fingerprint_label", image: Image(systemName: "figure.wave"), text: "Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. ")
+            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. ")
                 .padding()
         }
     }

Sources/Secretive/Views/CreateSecretView.swift

@@ -3,7 +3,7 @@ import SecretKit
 
 struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
 
-    @State var store: StoreType
+    @ObservedObject var store: StoreType
     @Binding var showing: Bool
 
     @State private var name = ""
@@ -14,30 +14,43 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
             HStack {
                 VStack {
                     HStack {
-                        Text("create_secret_title")
+                        Text("Create a New Secret")
                             .font(.largeTitle)
                         Spacer()
                     }
                     HStack {
-                        Text("create_secret_name_label")
+                        Text("Name:")
-                        TextField("create_secret_name_placeholder", text: $name)
+                        TextField("Shhhhh", text: $name)
                             .focusable()
                     }
-                    ThumbnailPickerView(items: [
+                    if #available(macOS 12.0, *) {
-                        ThumbnailPickerView.Item(value: true, name: "create_secret_require_authentication_title", description: "create_secret_require_authentication_description", thumbnail: AuthenticationView()),
+                        ThumbnailPickerView(items: [
-                        ThumbnailPickerView.Item(value: false, name: "create_secret_notify_title",
+                            ThumbnailPickerView.Item(value: true, name: "Require Authentication", description: "You will be required to authenticate using Touch ID, Apple Watch, or password before each use.", thumbnail: AuthenticationView()),
-                                                 description: "create_secret_notify_description",
+                            ThumbnailPickerView.Item(value: false, name: "Notify",
-                                                 thumbnail: NotificationView())
+                                                     description: "No authentication is required while your Mac is unlocked, but you will be notified when a secret is used.",
-                    ], selection: $requiresAuthentication)
+                                                     thumbnail: NotificationView())
+                        ], selection: $requiresAuthentication)
+                    } else {
+                        HStack {
+                            VStack(spacing: 20) {
+                                Picker("", selection: $requiresAuthentication) {
+                                    Text("Requires Authentication (Biometrics or Password) before each use").tag(true)
+                                    Text("Authentication not required when Mac is unlocked").tag(false)
+                                }
+                                .pickerStyle(RadioGroupPickerStyle())
+                                Spacer(minLength: 10)
+                            }
+                        }
+                    }
                 }
             }
             HStack {
                 Spacer()
-                Button("create_secret_cancel_button") {
+                Button("Cancel") {
                     showing = false
                 }
                 .keyboardShortcut(.cancelAction)
-                Button("create_secret_create_button", action: save)
+                Button("Create", action: save)
                     .disabled(name.isEmpty)
                     .keyboardShortcut(.defaultAction)
             }
@@ -45,10 +58,8 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
     }
 
     func save() {
-        Task {
+        try! store.create(name: name, requiresAuthentication: requiresAuthentication)
-            try! await store.create(name: name, requiresAuthentication: requiresAuthentication)
+        showing = false
-            showing = false
-        }
     }
 
 }
@@ -95,14 +106,14 @@ struct ThumbnailPickerView<ValueType: Hashable>: View {
 
 extension ThumbnailPickerView {
 
-    struct Item<InnerValueType: Hashable>: Identifiable {
+    struct Item<ValueType: Hashable>: Identifiable {
         let id = UUID()
-        let value: InnerValueType
+        let value: ValueType
-        let name: LocalizedStringKey
+        let name: String
-        let description: LocalizedStringKey
+        let description: String
         let thumbnail: AnyView
 
-        init<ViewType: View>(value: InnerValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) {
+        init<ViewType: View>(value: ValueType, name: String, description: String, thumbnail: ViewType) {
             self.value = value
             self.name = name
             self.description = description
@@ -127,6 +138,7 @@ extension ThumbnailPickerView {
 
 }
 
+@available(macOS 12.0, *)
 struct SystemBackgroundView: View {
 
     let anchor: UnitPoint
@@ -145,6 +157,7 @@ struct SystemBackgroundView: View {
     }
 }
 
+@available(macOS 12.0, *)
 struct AuthenticationView: View {
 
     var body: some View {
@@ -156,15 +169,15 @@ struct AuthenticationView: View {
                         .resizable()
                         .aspectRatio(contentMode: .fit)
                         .foregroundColor(Color(.systemRed))
-                    Text(verbatim: "Touch ID Prompt")
+                    Text("Touch ID Prompt")
                         .font(.headline)
                         .foregroundColor(.primary)
                         .redacted(reason: .placeholder)
                     VStack {
-                        Text(verbatim: "Touch ID Detail prompt.Detail two.")
+                        Text("Touch ID Detail prompt.Detail two.")
                             .font(.caption2)
                             .foregroundColor(.primary)
-                        Text(verbatim: "Touch ID Detail prompt.Detail two.")
+                        Text("Touch ID Detail prompt.Detail two.")
                             .font(.caption2)
                             .foregroundColor(.primary)
                     }
@@ -190,6 +203,7 @@ struct AuthenticationView: View {
 
 }
 
+@available(macOS 12.0, *)
 struct NotificationView: View {
 
     var body: some View {
@@ -209,10 +223,10 @@ struct NotificationView: View {
                                 .frame(width: 64, height: 64)
                                 .foregroundColor(.primary)
                             VStack(alignment: .leading) {
-                                Text(verbatim: "Secretive")
+                                Text("Secretive")
                                     .font(.title)
                                     .foregroundColor(.primary)
-                                Text(verbatim: "Secretive wants to sign")
+                                Text("Secretive wants to sign")
                                     .font(.body)
                                     .foregroundColor(.primary)
                             }
@@ -232,19 +246,23 @@ struct NotificationView: View {
 
 }
 
-//#if DEBUG
+#if DEBUG
-//
+
-//struct CreateSecretView_Previews: PreviewProvider {
+struct CreateSecretView_Previews: PreviewProvider {
-//
+
-//    static var previews: some View {
+    static var previews: some View {
-//        Group {
+        Group {
-//            CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true))
+            CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true))
-//                AuthenticationView().environment(\.colorScheme, .dark)
+            if #available(macOS 12.0, *) {
-//                AuthenticationView().environment(\.colorScheme, .light)
+                AuthenticationView().environment(\.colorScheme, .dark)
-//                NotificationView().environment(\.colorScheme, .dark)
+                AuthenticationView().environment(\.colorScheme, .light)
-//                NotificationView().environment(\.colorScheme, .light)
+                NotificationView().environment(\.colorScheme, .dark)
-//        }
+                NotificationView().environment(\.colorScheme, .light)
-//    }
+            } else {
-//}
+                // Fallback on earlier versions
-//
+            }
-//#endif
+        }
+    }
+}
+
+#endif

Sources/Secretive/Views/DeleteSecretView.swift

@@ -3,7 +3,7 @@ import SecretKit
 
 struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
 
-    @State var store: StoreType
+    @ObservedObject var store: StoreType
     let secret: StoreType.SecretType
     var dismissalBlock: (Bool) -> ()
 
@@ -18,24 +18,25 @@ struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
                     .padding()
                 VStack {
                     HStack {
-                        Text("delete_confirmation_title_\(secret.name)").bold()
+                        Text("Delete \(secret.name)?").bold()
                         Spacer()
                     }
                     HStack {
-                        Text("delete_confirmation_description_\(secret.name)_\(secret.name)")
+                        Text("If you delete \(secret.name), you will not be able to recover it. Type \"\(secret.name)\" to confirm.")
                         Spacer()
                     }
                     HStack {
-                        Text("delete_confirmation_confirm_name_label")
+                        Text("Confirm Name:")
                         TextField(secret.name, text: $confirm)
                     }
                 }
             }
             HStack {
                 Spacer()
-                Button("delete_confirmation_delete_button", action: delete)
+                Button("Delete", action: delete)
                     .disabled(confirm != secret.name)
-                Button("delete_confirmation_cancel_button") {
+                    .keyboardShortcut(.delete)
+                Button("Don't Delete") {
                     dismissalBlock(false)
                 }
                 .keyboardShortcut(.cancelAction)
@@ -49,10 +50,8 @@ struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
     }
     
     func delete() {
-        Task {
+        try! store.delete(secret: secret)
-            try! await store.delete(secret: secret)
+        dismissalBlock(true)
-            dismissalBlock(true)
-        }
     }
 
 }

Sources/Secretive/Views/EmptyStoreView.swift

@@ -3,17 +3,17 @@ import SecretKit
 
 struct EmptyStoreView: View {
 
-    @State var store: AnySecretStore
+    @ObservedObject var store: AnySecretStore
     @Binding var activeSecret: AnySecret.ID?
 
     var body: some View {
         if store is AnySecretStoreModifiable {
             NavigationLink(destination: EmptyStoreModifiableView(), tag: Constants.emptyStoreModifiableTag, selection: $activeSecret) {
-                Text("empty_store_modifiable_title")
+                Text("No Secrets")
             }
         } else {
             NavigationLink(destination: EmptyStoreImmutableView(), tag: Constants.emptyStoreTag, selection: $activeSecret) {
-                Text("empty_store_nonmodifiable_title")
+                Text("No Secrets")
             }
         }
     }
@@ -22,8 +22,8 @@ struct EmptyStoreView: View {
 extension EmptyStoreView {
     
     enum Constants {
-        static let emptyStoreModifiableTag = "emptyStoreModifiableTag"
+        static let emptyStoreModifiableTag: AnyHashable = "emptyStoreModifiableTag"
-        static let emptyStoreTag = "emptyStoreTag"
+        static let emptyStoreTag: AnyHashable = "emptyStoreModifiableTag"
     }
 
 }
@@ -32,9 +32,9 @@ struct EmptyStoreImmutableView: View {
     
     var body: some View {
         VStack {
-            Text("empty_store_nonmodifiable_title").bold()
+            Text("No Secrets").bold()
-            Text("empty_store_nonmodifiable_description")
+            Text("Use your Smart Card's management tool to create a secret.")
-            Text("empty_store_nonmodifiable_supported_key_types")
+            Text("Secretive only supports Elliptic Curve keys.")
         }.frame(maxWidth: .infinity, maxHeight: .infinity)
     }
     
@@ -63,8 +63,8 @@ struct EmptyStoreModifiableView: View {
                         path.addLine(to: CGPoint(x: g.size.width - 3, y: 0))
                     }.fill()
                 }.frame(height: (windowGeometry.size.height/2) - 20).padding()
-                Text("empty_store_modifiable_click_here_title").bold()
+                Text("No Secrets").bold()
-                Text("empty_store_modifiable_click_here_description")
+                Text("Create a new one by clicking here.")
                 Spacer()
             }.frame(maxWidth: .infinity, maxHeight: .infinity)
         }

Sources/Secretive/Views/NoStoresView.swift

@@ -4,10 +4,9 @@ struct NoStoresView: View {
 
     var body: some View {
         VStack {
-            Text("no_secure_storage_title")
+            Text("No Secure Storage Available").bold()
-                .bold()
+            Text("Your Mac doesn't have a Secure Enclave, and there's not a compatible Smart Card inserted.")
-            Text("no_secure_storage_description")
+            Link("If you're looking to add one to your Mac, the YubiKey 5 Series are great.", destination: URL(string: "https://www.yubico.com/products/compare-yubikey-5-series/")!)
-            Link("no_secure_storage_yubico_link", destination: URL(string: "https://www.yubico.com/products/compare-yubikey-5-series/")!)
         }.padding()
     }
     

Sources/Secretive/Views/RenameSecretView.swift

@@ -3,7 +3,7 @@ import SecretKit
 
 struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
 
-    @State var store: StoreType
+    @ObservedObject var store: StoreType
     let secret: StoreType.SecretType
     var dismissalBlock: (_ renamed: Bool) -> ()
 
@@ -18,7 +18,7 @@ struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
                     .padding()
                 VStack {
                     HStack {
-                        Text("rename_title_\(secret.name)")
+                        Text("Type your new name for \"\(secret.name)\" below.")
                         Spacer()
                     }
                     HStack {
@@ -28,10 +28,10 @@ struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
             }
             HStack {
                 Spacer()
-                Button("rename_rename_button", action: rename)
+                Button("Rename", action: rename)
                     .disabled(newName.count == 0)
                     .keyboardShortcut(.return)
-                Button("rename_cancel_button") {
+                Button("Cancel") {
                     dismissalBlock(false)
                 }.keyboardShortcut(.cancelAction)
             }
@@ -44,9 +44,7 @@ struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
     }
 
     func rename() {
-        Task {
+        try? store.update(secret: secret, name: newName)
-            try? await store.update(secret: secret, name: newName)
+        dismissalBlock(true)
-            dismissalBlock(true)
-        }
     }
 }

Sources/Secretive/Views/SecretDetailView.swift

@@ -12,16 +12,16 @@ struct SecretDetailView<SecretType: Secret>: View {
         ScrollView {
             Form {
                 Section {
-                    CopyableView(title: "secret_detail_sha256_fingerprint_label", image: Image(systemName: "touchid"), text: keyWriter.openSSHSHA256Fingerprint(secret: secret))
+                    CopyableView(title: "SHA256 Fingerprint", image: Image(systemName: "touchid"), text: keyWriter.openSSHSHA256Fingerprint(secret: secret))
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(title: "secret_detail_md5_fingerprint_label", image: Image(systemName: "touchid"), text: keyWriter.openSSHMD5Fingerprint(secret: secret))
+                    CopyableView(title: "MD5 Fingerprint", image: Image(systemName: "touchid"), text: keyWriter.openSSHMD5Fingerprint(secret: secret))
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(title: "secret_detail_public_key_label", image: Image(systemName: "key"), text: keyString)
+                    CopyableView(title: "Public Key", image: Image(systemName: "key"), text: keyString)
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(title: "secret_detail_public_key_path_label", image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret))
+                    CopyableView(title: "Public Key Path", image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret))
                     Spacer()
                 }
             }
@@ -47,12 +47,12 @@ struct SecretDetailView<SecretType: Secret>: View {
 
 }
 
-//#if DEBUG
+#if DEBUG
-//
+
-//struct SecretDetailView_Previews: PreviewProvider {
+struct SecretDetailView_Previews: PreviewProvider {
-//    static var previews: some View {
+    static var previews: some View {
-//        SecretDetailView(secret: Preview.Store(numberOfRandomSecrets: 1).secrets[0])
+        SecretDetailView(secret: Preview.Store(numberOfRandomSecrets: 1).secrets[0])
-//    }
+    }
-//}
+}
-//
+
-//#endif
+#endif

Sources/Secretive/Views/SecretListItemView.swift

@@ -3,7 +3,7 @@ import SecretKit
 
 struct SecretListItemView: View {
 
-    @State var store: AnySecretStore
+    @ObservedObject var store: AnySecretStore
     var secret: AnySecret
     @Binding var activeSecret: AnySecret.ID?
 
@@ -29,14 +29,13 @@ struct SecretListItemView: View {
             } else {
                 Text(secret.name)
             }
-        }
+        }.contextMenu {
-        .contextMenu {
             if store is AnySecretStoreModifiable {
                 Button(action: { isRenaming = true }) {
-                    Text("secret_list_rename_button")
+                    Text("Rename")
                 }
                 Button(action: { isDeleting = true }) {
-                    Text("secret_list_delete_button")
+                    Text("Delete")
                 }
             }
         }

Sources/Secretive/Views/SetupView.swift

@@ -26,7 +26,7 @@ struct SetupView: View {
                 }
             }
         }
-        .frame(minWidth: 500, idealWidth: 500, minHeight: 500, idealHeight: 500)
+        .frame(idealWidth: 500, idealHeight: 500)
     }
 
 
@@ -61,7 +61,7 @@ struct StepView: View {
                             Circle()
                                 .foregroundColor(.green)
                                 .frame(width: Constants.circleWidth, height: Constants.circleWidth)
-                            Text("setup_step_complete_symbol")
+                            Text("✓")
                                 .foregroundColor(.white)
                                 .bold()
                         } else {
@@ -101,14 +101,14 @@ extension StepView {
 
 struct SetupStepView<Content> : View where Content : View {
 
-    let title: LocalizedStringKey
+    let title: String
     let image: Image
-    let bodyText: LocalizedStringKey
+    let bodyText: String
-    let buttonTitle: LocalizedStringKey
+    let buttonTitle: String
     let buttonAction: () -> Void
     let content: Content
 
-    init(title: LocalizedStringKey, image: Image, bodyText: LocalizedStringKey, buttonTitle: LocalizedStringKey, buttonAction: @escaping () -> Void = {}, @ViewBuilder content: () -> Content) {
+    init(title: String, image: Image, bodyText: String, buttonTitle: String, buttonAction: @escaping () -> Void = {}, @ViewBuilder content: () -> Content) {
         self.title = title
         self.image = image
         self.bodyText = bodyText
@@ -145,21 +145,19 @@ struct SecretAgentSetupView: View {
     let buttonAction: () -> Void
 
     var body: some View {
-        SetupStepView(title: "setup_agent_title",
+        SetupStepView(title: "Setup Secret Agent",
                       image: Image(nsImage: NSApplication.shared.applicationIconImage),
-                      bodyText: "setup_agent_description",
+                      bodyText: "Secretive needs to set up a helper app to work properly. It will sign requests from SSH clients in the background, so you don't need to keep the main Secretive app open.",
-                      buttonTitle: "setup_agent_install_button",
+                      buttonTitle: "Install",
                       buttonAction: install) {
-            Text("setup_agent_activity_monitor_description")
+            (Text("This helper app is called ") + Text("Secret Agent").bold().underline() + Text(" and you may see it in Activity Manager from time to time."))
                 .multilineTextAlignment(.center)
         }
     }
 
     func install() {
-        Task {
+        LaunchAgentController().install()
-            await LaunchAgentController().install()
+        buttonAction()
-            buttonAction()
-        }
     }
 
 }
@@ -172,12 +170,12 @@ struct SSHAgentSetupView: View {
     @State private var selectedShellInstruction: ShellConfigInstruction = controller.shellInstructions.first!
 
     var body: some View {
-        SetupStepView(title: "setup_ssh_title",
+        SetupStepView(title: "Configure your SSH Agent",
                       image: Image(systemName: "terminal"),
-                      bodyText: "setup_ssh_description",
+                      bodyText: "Add this line to your shell config telling SSH to talk to Secret Agent when it wants to authenticate. Secretive can either do this for you automatically, or you can copy and paste this into your config file.",
-                      buttonTitle: "setup_ssh_added_manually_button",
+                      buttonTitle: "I Added it Manually",
                       buttonAction: buttonAction) {
-        Link("setup_third_party_faq_link", destination: URL(string: "https://github.com/maxgoedjen/secretive/blob/main/APP_CONFIG.md")!)
+        Link("If you're trying to set up a third party app, check out the FAQ.", destination: URL(string: "https://github.com/maxgoedjen/secretive/blob/main/APP_CONFIG.md")!)
             Picker(selection: $selectedShellInstruction, label: EmptyView()) {
                 ForEach(SSHAgentSetupView.controller.shellInstructions) { instruction in
                     Text(instruction.shell)
@@ -185,8 +183,8 @@ struct SSHAgentSetupView: View {
                         .padding()
                 }
             }.pickerStyle(SegmentedPickerStyle())
-            CopyableView(title: "setup_ssh_add_to_config_button_\(selectedShellInstruction.shellConfigPath)", image: Image(systemName: "greaterthan.square"), text: selectedShellInstruction.text)
+            CopyableView(title: "Add to \(selectedShellInstruction.shellConfigPath)", image: Image(systemName: "greaterthan.square"), text: selectedShellInstruction.text)
-            Button("setup_ssh_add_for_me_button") {
+            Button("Add it For Me") {
                 let controller = ShellConfigurationController()
                 if controller.addToShell(shellInstructions: selectedShellInstruction) {
                     buttonAction()
@@ -216,12 +214,12 @@ struct UpdaterExplainerView: View {
     let buttonAction: () -> Void
 
     var body: some View {
-        SetupStepView(title: "setup_updates_title",
+        SetupStepView(title: "Updates",
                       image: Image(systemName: "dot.radiowaves.left.and.right"),
-                      bodyText: "setup_updates_description",
+                      bodyText: "Secretive will periodically check with GitHub to see if there's a new release. If you see any network requests to GitHub, that's why.",
-                      buttonTitle: "setup_updates_ok",
+                      buttonTitle: "Okay",
                       buttonAction: buttonAction) {
-            Link("setup_updates_readmore", destination: SetupView.Constants.updaterFAQURL)
+            Link("Read more about this here.", destination: SetupView.Constants.updaterFAQURL)
         }
     }
 

Sources/Secretive/Views/StoreListView.swift

@@ -1,19 +1,20 @@
 import SwiftUI
-import Combine
 import SecretKit
 
 struct StoreListView: View {
 
-    @Binding var activeSecret: AnySecret.ID?
+    @Binding var showingCreation: Bool
     
-    @Environment(SecretStoreList.self) private var storeList: SecretStoreList
+    @State private var activeSecret: AnySecret.ID?
+
+    @EnvironmentObject private var storeList: SecretStoreList
 
     private func secretDeleted(secret: AnySecret) {
         activeSecret = nextDefaultSecret
     }
 
     private func secretRenamed(secret: AnySecret) {
-        activeSecret = secret.id
+        activeSecret = nextDefaultSecret
     }
 
     var body: some View {

Sources/Secretive/Views/UpdateView.swift

@@ -3,28 +3,26 @@ import Brief
 
 struct UpdateDetailView<UpdaterType: Updater>: View {
 
-    @Environment(UpdaterType.self) var updater: UpdaterType
+    @EnvironmentObject var updater: UpdaterType
 
     let update: Release
 
     var body: some View {
         VStack {
-            Text("update_version_name_\(update.name)").font(.title)
+            Text("Secretive \(update.name)").font(.title)
-            GroupBox(label: Text("update_release_notes_title")) {
+            GroupBox(label: Text("Release Notes")) {
                 ScrollView {
                     attributedBody
                 }
             }
             HStack {
                 if !update.critical {
-                    Button("update_ignore_button") {
+                    Button("Ignore") {
-                        Task {
+                        updater.ignore(release: update)
-                            await updater.ignore(release: update)
-                        }
                     }
                     Spacer()
                 }
-                Button("update_update_button") {
+                Button("Update") {
                     NSWorkspace.shared.open(update.html_url)
                 }
                 .keyboardShortcut(.defaultAction)
@@ -36,24 +34,24 @@ struct UpdateDetailView<UpdaterType: Updater>: View {
     }
 
     var attributedBody: Text {
-        var text = Text(verbatim: "")
+        var text = Text("")
         for line in update.body.split(whereSeparator: \.isNewline) {
             let attributed: Text
             let split = line.split(separator: " ")
-            let unprefixed = split.dropFirst().joined(separator: " ")
+            let unprefixed = split.dropFirst().joined()
             if let prefix = split.first {
                 switch prefix {
                 case "#":
-                    attributed = Text(unprefixed).font(.title) + Text(verbatim: "\n")
+                    attributed = Text(unprefixed).font(.title) + Text("\n")
                 case "##":
-                    attributed = Text(unprefixed).font(.title2) + Text(verbatim: "\n")
+                    attributed = Text(unprefixed).font(.title2) + Text("\n")
                 case "###":
-                    attributed = Text(unprefixed).font(.title3) + Text(verbatim: "\n")
+                    attributed = Text(unprefixed).font(.title3) + Text("\n")
                 default:
-                    attributed = Text(line) + Text(verbatim: "\n\n")
+                    attributed = Text(line) + Text("\n\n")
                 }
             } else {
-                attributed = Text(line) + Text(verbatim: "\n\n")
+                attributed = Text(line) + Text("\n\n")
             }
             text = text + attributed
         }

Sources/SecretiveTests/Info.plist

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>$(DEVELOPMENT_LANGUAGE)</string>
+	<key>CFBundleExecutable</key>
+	<string>$(EXECUTABLE_NAME)</string>
+	<key>CFBundleIdentifier</key>
+	<string>$(PRODUCT_BUNDLE_IDENTIFIER)</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundleName</key>
+	<string>$(PRODUCT_NAME)</string>
+	<key>CFBundlePackageType</key>
+	<string>$(PRODUCT_BUNDLE_PACKAGE_TYPE)</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+</dict>
+</plist>

Sources/SecretiveTests/SecretiveTests.swift

@@ -0,0 +1,20 @@
+import XCTest
+@testable import Secretive
+
+class SecretiveTests: XCTestCase {
+
+    override func setUp() {
+        // Put setup code here. This method is called before the invocation of each test method in the class.
+    }
+
+    override func tearDown() {
+        // Put teardown code here. This method is called after the invocation of each test method in the class.
+    }
+
+    func testExample() {
+        // This is an example of a functional test case.
+        // Use XCTAssert and related functions to verify your tests produce the correct results.
+    }
+
+
+}