Move file

Toolbar button style
Switch toolbar items to viewbuilders
2025-07-01 09:43:37 +00:00 · 2022-12-22 18:06:58 -05:00 · 2022-12-22 17:55:53 -05:00 · 2022-12-22 17:20:03 -05:00 · 2022-12-19 00:19:54 +00:00 · 2022-12-18 15:16:08 -08:00
40 changed files with 920 additions and 257 deletions
--- a/.github/readme/app.png
+++ b/.github/readme/app.png
--- a/.github/readme/notification.png
+++ b/.github/readme/notification.png
--- a/.github/readme/touchid.png
+++ b/.github/readme/touchid.png
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@ -0,0 +1,16 @@
+name: Add bugs to bugs project
+
+on:
+  issues:
+    types:
+      - opened
+
+jobs:
+  add-to-project:
+    name: Add issue to project
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v0.0.3
+        with:
+          project-url: https://github.com/users/maxgoedjen/projects/1
+          github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@ -0,0 +1,53 @@
+name: Nightly
+
+on: 
+  schedule: 
+    - cron: "0 8 * * *"
+jobs:
+  build:
+    runs-on: macOS-latest
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v2
+    - name: Setup Signing
+      env: 
+        SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
+        SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
+        HOST_PROFILE_DATA: ${{ secrets.HOST_PROFILE_DATA }}
+        AGENT_PROFILE_DATA: ${{ secrets.AGENT_PROFILE_DATA }}
+        APPLE_API_KEY_DATA: ${{ secrets.APPLE_API_KEY_DATA }}
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+      run: ./.github/scripts/signing.sh
+    - name: Set Environment
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
+    - name: Update Build Number
+      env:
+        RUN_ID: ${{ github.run_id }}
+      run: |
+            sed -i '' -e "s/GITHUB_CI_VERSION/0.0.0/g" Sources/Config/Config.xcconfig
+            sed -i '' -e "s/GITHUB_BUILD_NUMBER/1.$RUN_ID/g" Sources/Config/Config.xcconfig
+            sed -i '' -e "s/GITHUB_BUILD_URL/https:\/\/github.com\/maxgoedjen\/secretive\/actions\/runs\/$RUN_ID/g" Sources/Secretive/Credits.rtf
+    - name: Build
+      run: xcrun xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Release -archivePath Archive.xcarchive archive
+    - name: Create ZIPs
+      run: |
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive/Products/Applications/Secretive.app ./Secretive.zip
+            ditto -c -k --sequesterRsrc --keepParent Archive.xcarchive ./Archive.zip
+    - name: Notarize
+      env: 
+        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+        APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
+    - name: Document SHAs
+      run: |
+            echo "sha-512:"
+            shasum -a 512 Secretive.zip
+            shasum -a 512 Archive.zip
+            echo "sha-256:"
+            shasum -a 256 Secretive.zip
+            shasum -a 256 Archive.zip
+    - name: Upload App to Artifacts
+      uses: actions/upload-artifact@v1
+      with:
+        name: Secretive.zip
+        path: Secretive.zip
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -6,7 +6,7 @@ on:
      - '*'
 jobs:
  test:
-    runs-on: macos-11.0
+    runs-on: macOS-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v1
@ -20,14 +20,14 @@ jobs:
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_13.2.1.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
    - name: Test
      run: |
            pushd Sources/Packages
            swift test
            popd
  build:
-    runs-on: macos-11.0
+    runs-on: macOS-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v2
@ -41,7 +41,7 @@ jobs:
        APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
      run: ./.github/scripts/signing.sh
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_13.2.1.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
    - name: Update Build Number
      env:
        TAG_NAME: ${{ github.ref }}
@ -64,8 +64,12 @@ jobs:
      run: xcrun notarytool submit --key ~/.private_keys/AuthKey_$APPLE_API_KEY_ID.p8 --key-id $APPLE_API_KEY_ID --issuer $APPLE_API_ISSUER Secretive.zip
    - name: Document SHAs
      run: |
+            echo "sha-512:"
            shasum -a 512 Secretive.zip
            shasum -a 512 Archive.zip
+            echo "sha-256:"
+            shasum -a 256 Secretive.zip
+            shasum -a 256 Archive.zip
    - name: Create Release
      id: create_release
      uses: actions/create-release@v1
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@ -3,12 +3,12 @@ name: Test
 on: [push, pull_request]
 jobs:
  test:
-    runs-on: macos-11.0
+    runs-on: macOS-latest
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@v2
    - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_13.2.1.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
    - name: Test
      run: |
            pushd Sources/Packages
--- a/APP_CONFIG.md
+++ b/APP_CONFIG.md
@ -26,6 +26,15 @@ Host *
 	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
 ```

+## nushell
+
+Add this to your `~/.ssh/config` (the path should match the socket path from the setup flow).
+
+```
+Host *
+	IdentityAgent /Users/$YOUR_USERNAME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh
+```
+
 ## Cyberduck

 Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
@ -51,6 +60,55 @@ Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`

 Log out and log in again before launching Cyberduck.

+## Mountain Duck
+
+Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
+
+```
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>link-ssh-auth-sock</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-c</string>
+    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+```
+
+Log out and log in again before launching Mountain Duck.
+
+## GitKraken
+
+Add this to `~/Library/LaunchAgents/com.maxgoedjen.Secretive.SecretAgent.plist`
+
+```
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>link-ssh-auth-sock</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>/bin/sh</string>
+    <string>-c</string>
+    <string>/bin/ln -sf $HOME/Library/Containers/com.maxgoedjen.Secretive.SecretAgent/Data/socket.ssh $SSH_AUTH_SOCK</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+</dict>
+</plist>
+```
+
+Log out and log in again before launching Gitkraken. Then enable "Use local SSH agent in GitKraken Preferences (Located under Preferences -> SSH)

 # The app I use isn't listed here!

--- a/FAQ.md
+++ b/FAQ.md
@ -12,6 +12,10 @@ Secretive relies on the `SSH_AUTH_SOCK` environment variable being respected. Th

 Please run `ssh -Tv git@github.com` in your terminal and paste the output in a [new GitHub issue](https://github.com/maxgoedjen/secretive/issues/new) with a description of your issue.

+### Secretive was working for me, but now it has stopped
+
+Try running the "Setup Secretive" process by clicking on "Help", then "Setup Secretive." If that doesn't work, follow the process above.
+
 ### Secretive prompts me to type my password instead of using my Apple Watch

 1) Make sure you have enabled "Use your Apple Watch to unlock apps and your Mac" in System Preferences --> Security & Privacy:
@ -26,7 +30,11 @@ Please run `ssh -Tv git@github.com` in your terminal and paste the output in a [

 ### How do I tell SSH to use a specific key?

-You can create a `mykey.pub` (where `mykey` is the name of your key) in your `~/.ssh/` directory with the contents of your public key, and specify that you want to use that key in your `~/.ssh/config`.  [This ServerFault answer](https://serverfault.com/a/295771) has more details on setting that up
+Beginning with Secretive 2.2, every secret has an automatically generated public key file representation on disk, and the path to it is listed under "Public Key Path" in Secretive. You can specify that you want to use that key in your `~/.ssh/config`.  [This ServerFault answer](https://serverfault.com/a/295771) has more details on setting that up.
+
+### Can I use Secretive for SSH Agent Forwarding?
+
+Yes, you can! Once you've set up Secretive, just add `ForwardAgent yes` to the hosts you want to forward to in your SSH config file. Afterwards, any use of one of your SSH keys on the remote host must be authenticated through Secretive.

 ### Why should I trust you?

@ -38,7 +46,11 @@ Awesome! Just bear in mind that because an app only has access to the keychain i

 ### What's this network request to GitHub?

-Secretive checks in with GitHub's releases API to check if there's a new version of Secretive available. You can audit the source code for this feature [here](https://github.com/maxgoedjen/secretive/blob/main/Brief/Updater.swift).
+Secretive checks in with GitHub's releases API to check if there's a new version of Secretive available. You can audit the source code for this feature [here](https://github.com/maxgoedjen/secretive/blob/main/Sources/Packages/Sources/Brief/Updater.swift).
+
+### How do I uninstall Secretive?
+
+Drag Secretive.app to the trash and remove `~/Library/Containers/com.maxgoedjen.Secretive.SecretAgent`. `SecretAgent` may continue running until you quit it or reboot.

 ### I have a security issue

--- a/README.md
+++ b/README.md
@ -16,13 +16,13 @@ The most common setup for SSH keys is just keeping them on disk, guarded by prop

 If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed.

-<img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID">
+<img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID" width="400">

 ### Notifications

 Secretive also notifies you whenever your keys are accessed, so you're never caught off guard.

-<img src="/.github/readme/notification.png" alt="Screenshot of Secretive notifying the user">
+<img src="/.github/readme/notification.png" alt="Screenshot of Secretive notifying the user" width="600">

 ### Support for Smart Cards Too!

--- a/Sources/Packages/Sources/SecretAgentKit/Agent.swift
+++ b/Sources/Packages/Sources/SecretAgentKit/Agent.swift
@ -4,6 +4,25 @@ import OSLog
 import SecretKit
 import AppKit

+enum OpenSSHCertificateError: Error {
+    case unsupportedType
+    case parsingFailed
+    case doesNotExist
+}
+
+extension OpenSSHCertificateError: CustomStringConvertible {
+    public var description: String {
+        switch self {
+        case .unsupportedType:
+            return "The key type was unsupported"
+        case .parsingFailed:
+            return "Failed to properly parse the SSH certificate"
+        case .doesNotExist:
+            return "Certificate does not exist"
+        }
+    }
+}
+
 /// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
 public class Agent {

@ -11,13 +30,15 @@ public class Agent {
    private let witness: SigningWitness?
    private let writer = OpenSSHKeyWriter()
    private let requestTracer = SigningRequestTracer()
+    private let certsPath = (NSHomeDirectory() as NSString).appendingPathComponent("PublicKeys") as String
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent.agent", category: "")

    /// Initializes an agent with a store list and a witness.
    /// - Parameters:
    ///   - storeList: The `SecretStoreList` to make available.
    ///   - witness: A witness to notify of requests.
    public init(storeList: SecretStoreList, witness: SigningWitness? = nil) {
-        Logger().debug("Agent is running")
+        logger.debug("Agent is running")
        self.storeList = storeList
        self.witness = witness
    }
@ -30,40 +51,45 @@ extension Agent {
    /// - Parameters:
    ///   - reader: A ``FileHandleReader`` to read the content of the request.
    ///   - writer: A ``FileHandleWriter`` to write the response to.
-    public func handle(reader: FileHandleReader, writer: FileHandleWriter) {
-        Logger().debug("Agent handling new data")
+    /// - Return value: 
+    ///   - Boolean if data could be read
+    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) -> Bool {
+        logger.debug("Agent handling new data")
        let data = Data(reader.availableData)
-        guard data.count > 4 else { return }
+        guard data.count > 4 else { return false}
        let requestTypeInt = data[4]
        guard let requestType = SSHAgent.RequestType(rawValue: requestTypeInt) else {
            writer.write(OpenSSHKeyWriter().lengthAndData(of: SSHAgent.ResponseType.agentFailure.data))
-            Logger().debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
-            return
+            logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
+            return true
        }
-        Logger().debug("Agent handling request of type \(requestType.debugDescription)")
+        logger.debug("Agent handling request of type \(requestType.debugDescription)")
        let subData = Data(data[5...])
        let response = handle(requestType: requestType, data: subData, reader: reader)
        writer.write(response)
+        return true
    }

    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) -> Data {
+        // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
+        reloadSecretsIfNeccessary()
        var response = Data()
        do {
            switch requestType {
            case .requestIdentities:
                response.append(SSHAgent.ResponseType.agentIdentitiesAnswer.data)
                response.append(identities())
-                Logger().debug("Agent returned \(SSHAgent.ResponseType.agentIdentitiesAnswer.debugDescription)")
+                logger.debug("Agent returned \(SSHAgent.ResponseType.agentIdentitiesAnswer.debugDescription)")
            case .signRequest:
                let provenance = requestTracer.provenance(from: reader)
                response.append(SSHAgent.ResponseType.agentSignResponse.data)
                response.append(try sign(data: data, provenance: provenance))
-                Logger().debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
+                logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)")
            }
        } catch {
            response.removeAll()
            response.append(SSHAgent.ResponseType.agentFailure.data)
-            Logger().debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
+            logger.debug("Agent returned \(SSHAgent.ResponseType.agentFailure.debugDescription)")
        }
        let full = OpenSSHKeyWriter().lengthAndData(of: response)
        return full
@ -80,14 +106,24 @@ extension Agent {
        var count = UInt32(secrets.count).bigEndian
        let countData = Data(bytes: &count, count: UInt32.bitWidth/8)
        var keyData = Data()
-        let writer = OpenSSHKeyWriter()
+
        for secret in secrets {
-            let keyBlob = writer.data(secret: secret)
+            let keyBlob: Data
+            let curveData: Data
+            
+            if let (certBlob, certName) = try? checkForCert(secret: secret) {
+                keyBlob = certBlob
+                curveData = certName
+            } else {
+                keyBlob = writer.data(secret: secret)
+                curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
+            }
+            
            keyData.append(writer.lengthAndData(of: keyBlob))
-            let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
            keyData.append(writer.lengthAndData(of: curveData))
+            
        }
-        Logger().debug("Agent enumerated \(secrets.count) identities")
+        logger.log("Agent enumerated \(secrets.count) identities")
        return countData + keyData
    }

@ -98,9 +134,15 @@ extension Agent {
    /// - Returns: An OpenSSH formatted Data payload containing the signed data response.
    func sign(data: Data, provenance: SigningRequestProvenance) throws -> Data {
        let reader = OpenSSHReader(data: data)
-        let hash = reader.readNextChunk()
+        var hash = reader.readNextChunk()
+        
+        // Check if hash is actually an openssh certificate and reconstruct the public key if it is
+        if let certPublicKey = try? getPublicKeyFromCert(certBlob: hash) {
+            hash = certPublicKey
+        }
+        
        guard let (store, secret) = secret(matching: hash) else {
-            Logger().debug("Agent did not have a key matching \(hash as NSData)")
+            logger.debug("Agent did not have a key matching \(hash as NSData)")
            throw AgentError.noMatchingKey
        }

@ -110,7 +152,7 @@ extension Agent {

        let dataToSign = reader.readNextChunk()
        let signed = try store.sign(data: dataToSign, with: secret, for: provenance)
-        let derSignature = signed.data
+        let derSignature = signed

        let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!

@ -151,18 +193,96 @@ extension Agent {
        signedData.append(writer.lengthAndData(of: sub))

        if let witness = witness {
-            try witness.witness(accessTo: secret, from: store, by: provenance, requiredAuthentication: signed.requiredAuthentication)
+            try witness.witness(accessTo: secret, from: store, by: provenance)
        }

-        Logger().debug("Agent signed request")
+        logger.debug("Agent signed request")

        return signedData
    }
+    
+    /// Reconstructs a public key from a ``Data`` object that contains an OpenSSH certificate. Currently only ecdsa certificates are supported
+    /// - Parameter certBlock: The openssh certificate to extract the public key from
+    /// - Returns: A ``Data`` object containing the public key in OpenSSH wire format
+    func getPublicKeyFromCert(certBlob: Data) throws -> Data {
+        let reader = OpenSSHReader(data: certBlob)
+        let certType = String(decoding: reader.readNextChunk(), as: UTF8.self)
+                
+        switch certType {
+        case "ecdsa-sha2-nistp256-cert-v01@openssh.com",
+            "ecdsa-sha2-nistp384-cert-v01@openssh.com",
+            "ecdsa-sha2-nistp521-cert-v01@openssh.com":
+            
+            _ = reader.readNextChunk() // nonce
+            let curveIdentifier = reader.readNextChunk()
+            let publicKey = reader.readNextChunk()
+            
+            if let curveType = certType.replacingOccurrences(of: "-cert-v01@openssh.com", with: "").data(using: .utf8) {
+                return writer.lengthAndData(of: curveType) +
+                       writer.lengthAndData(of: curveIdentifier) +
+                       writer.lengthAndData(of: publicKey)
+            } else {
+                throw OpenSSHCertificateError.parsingFailed
+            }
+        default:
+            throw OpenSSHCertificateError.unsupportedType
+        }
+    }
+    
+    
+    /// Attempts to find an OpenSSH Certificate  that corresponds to a ``Secret``
+    /// - Parameter secret: The secret to search for a certificate with
+    /// - Returns: Two ``Data`` objects containing the certificate and certificate name respectively
+    func checkForCert(secret: AnySecret) throws -> (Data, Data) {
+        let minimalHex = writer.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        let certificatePath = certsPath.appending("/").appending("\(minimalHex)-cert.pub")
+        
+        if FileManager.default.fileExists(atPath: certificatePath) {
+            logger.debug("Found certificate for \(secret.name)")
+            do {
+                let certContent = try String(contentsOfFile:certificatePath, encoding: .utf8)
+                let certElements = certContent.trimmingCharacters(in: .whitespacesAndNewlines).components(separatedBy: " ")
+                
+                if certElements.count >= 2 {
+                    if let certDecoded = Data(base64Encoded: certElements[1] as String) {
+                        if certElements.count >= 3 {
+                            if let certName = certElements[2].data(using: .utf8) {
+                                return (certDecoded, certName)
+                            } else if let certName = secret.name.data(using: .utf8) {
+                                logger.info("Certificate for \(secret.name) does not have a name tag, using secret name instead")
+                                return (certDecoded, certName)
+                            } else {
+                                throw OpenSSHCertificateError.parsingFailed
+                            }
+                        }
+                    } else {
+                        logger.warning("Certificate found for \(secret.name) but failed to decode base64 key")
+                        throw OpenSSHCertificateError.parsingFailed
+                    }
+                }
+            } catch {
+                logger.warning("Certificate found for \(secret.name) but failed to load")
+                throw OpenSSHCertificateError.parsingFailed
+            }
+        }
+        
+        throw OpenSSHCertificateError.doesNotExist
+    }

 }

 extension Agent {

+    /// Gives any store with no loaded secrets a chance to reload.
+    func reloadSecretsIfNeccessary() {
+        for store in storeList.stores {
+            if store.secrets.isEmpty {
+                logger.debug("Store \(store.name, privacy: .public) has no loaded secrets. Reloading.")
+                store.reloadSecrets()
+            }
+        }
+    }
+
    /// Finds a ``Secret`` matching a specified hash whos signature was requested.
    /// - Parameter hash: The hash to match against.
    /// - Returns: A ``Secret`` and the ``SecretStore`` containing it, if a match is found.
--- a/Sources/Packages/Sources/SecretAgentKit/SigningRequestTracer.swift
+++ b/Sources/Packages/Sources/SecretAgentKit/SigningRequestTracer.swift
@ -40,7 +40,10 @@ extension SigningRequestTracer {
    func process(from pid: Int32) -> SigningRequestProvenance.Process {
        var pidAndNameInfo = self.pidAndNameInfo(from: pid)
        let ppid = pidAndNameInfo.kp_eproc.e_ppid != 0 ? pidAndNameInfo.kp_eproc.e_ppid : nil
-        let procName = String(cString: &pidAndNameInfo.kp_proc.p_comm.0)
+        let procName = withUnsafeMutablePointer(to: &pidAndNameInfo.kp_proc.p_comm.0) { pointer in
+            String(cString: pointer)
+        }
+
        let pathPointer = UnsafeMutablePointer<UInt8>.allocate(capacity: Int(MAXPATHLEN))
        _ = proc_pidpath(pid, pathPointer, UInt32(MAXPATHLEN))
        let path = String(cString: pathPointer)
--- a/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift
+++ b/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift
@ -17,7 +17,6 @@ public protocol SigningWitness {
    ///   - secret: The `Secret` that will was used to sign the request.
    ///   - store: The `Store` that signed the request..
    ///   - provenance: A `SigningRequestProvenance` object describing the origin of the request.
-    ///   - requiredAuthentication: A boolean describing whether or not authentication was required for the request.
-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) throws
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws

 }
--- a/Sources/Packages/Sources/SecretAgentKit/SocketController.swift
+++ b/Sources/Packages/Sources/SecretAgentKit/SocketController.swift
@ -9,7 +9,9 @@ public class SocketController {
    /// The active SocketPort.
    private var port: SocketPort?
    /// A handler that will be notified when a new read/write handle is available.
-    public var handler: ((FileHandleReader, FileHandleWriter) -> Void)?
+    /// False if no data could be read
+    public var handler: ((FileHandleReader, FileHandleWriter) -> Bool)?
+

    /// Initializes a socket controller with a specified path.
    /// - Parameter path: The path to use as a socket.
@ -65,7 +67,7 @@ public class SocketController {
    @objc func handleConnectionAccept(notification: Notification) {
        Logger().debug("Socket controller accepted connection")
        guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { return }
-        handler?(new, new)
+        _ = handler?(new, new)
        new.waitForDataInBackgroundAndNotify()
        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
    }
@ -76,7 +78,12 @@ public class SocketController {
        Logger().debug("Socket controller has new data available")
        guard let new = notification.object as? FileHandle else { return }
        Logger().debug("Socket controller received new file handle")
-        handler?(new, new)
+        if((handler?(new, new)) == true) {
+            Logger().debug("Socket controller handled data, wait for more data")
+            new.waitForDataInBackgroundAndNotify()
+        } else {
+            Logger().debug("Socket controller called with empty data, socked closed")
+        }
    }

 }
--- a/Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md
+++ b/Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md
@ -27,5 +27,8 @@ SecretKit is a collection of protocols describing secrets and stores.

 ### Signing Process

- ``SignedData``
 - ``SigningRequestProvenance``
+
+### Authentication Persistence
+
+- ``PersistedAuthenticationContext``
--- a/Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift
+++ b/Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift
@ -9,6 +9,7 @@ public struct AnySecret: Secret {
    private let _name: () -> String
    private let _algorithm: () -> Algorithm
    private let _keySize: () -> Int
+    private let _requiresAuthentication: () -> Bool
    private let _publicKey: () -> Data

    public init<T>(_ secret: T) where T: Secret {
@ -19,6 +20,7 @@ public struct AnySecret: Secret {
            _name = secret._name
            _algorithm = secret._algorithm
            _keySize = secret._keySize
+            _requiresAuthentication = secret._requiresAuthentication
            _publicKey = secret._publicKey
        } else {
            base = secret as Any
@ -27,6 +29,7 @@ public struct AnySecret: Secret {
            _name = { secret.name }
            _algorithm = { secret.algorithm }
            _keySize = { secret.keySize }
+            _requiresAuthentication = { secret.requiresAuthentication }
            _publicKey = { secret.publicKey }
        }
    }
@ -47,6 +50,10 @@ public struct AnySecret: Secret {
        _keySize()
    }

+    public var requiresAuthentication: Bool {
+        _requiresAuthentication()
+    }
+
    public var publicKey: Data {
        _publicKey()
    }
--- a/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift
+++ b/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift
@ -9,8 +9,10 @@ public class AnySecretStore: SecretStore {
    private let _id: () -> UUID
    private let _name: () -> String
    private let _secrets: () -> [AnySecret]
-    private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> SignedData
+    private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data
+    private let _existingPersistedAuthenticationContext: (AnySecret) -> PersistedAuthenticationContext?
    private let _persistAuthentication: (AnySecret, TimeInterval) throws -> Void
+    private let _reloadSecrets: () -> Void

    private var sink: AnyCancellable?

@ -21,7 +23,9 @@ public class AnySecretStore: SecretStore {
        _id = { secretStore.id }
        _secrets = { secretStore.secrets.map { AnySecret($0) } }
        _sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
+        _existingPersistedAuthenticationContext = { secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
        _persistAuthentication = { try secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
+        _reloadSecrets = { secretStore.reloadSecrets() }
        sink = secretStore.objectWillChange.sink { _ in
            self.objectWillChange.send()
        }
@ -43,14 +47,22 @@ public class AnySecretStore: SecretStore {
        return _secrets()
    }

-    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> SignedData {
+    public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> Data {
        try _sign(data, secret, provenance)
    }

+    public func existingPersistedAuthenticationContext(secret: AnySecret) -> PersistedAuthenticationContext? {
+        _existingPersistedAuthenticationContext(secret)
+    }
+
    public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) throws {
        try _persistAuthentication(secret, duration)
    }

+    public func reloadSecrets() {
+        _reloadSecrets()
+    }
+
 }

 public class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable {
--- a/Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift
+++ b/Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift
@ -6,6 +6,7 @@ public class PublicKeyFileStoreController {

    private let logger = Logger()
    private let directory: String
+    private let keyWriter = OpenSSHKeyWriter()

    /// Initializes a PublicKeyFileStoreController.
    public init(homeDirectory: String) {
@ -14,16 +15,21 @@ public class PublicKeyFileStoreController {

    /// Writes out the keys specified to disk.
    /// - Parameter secrets: The Secrets to generate keys for.
-    /// - Parameter clear: Whether or not the directory should be erased before writing keys.
+    /// - Parameter clear: Whether or not any untracked files in the directory should be removed.
    public func generatePublicKeys(for secrets: [AnySecret], clear: Bool = false) throws {
        logger.log("Writing public keys to disk")
        if clear {
-            try? FileManager.default.removeItem(at: URL(fileURLWithPath: directory))
+            let validPaths = Set(secrets.map { publicKeyPath(for: $0) }).union(Set(secrets.map { sshCertificatePath(for: $0) }))
+            let untracked = Set(try FileManager.default.contentsOfDirectory(atPath: directory)
+                .map { "\(directory)/\($0)" })
+                .subtracting(validPaths)
+            for path in untracked {
+                try? FileManager.default.removeItem(at: URL(fileURLWithPath: path))
+            }
        }
        try? FileManager.default.createDirectory(at: URL(fileURLWithPath: directory), withIntermediateDirectories: false, attributes: nil)
-        let keyWriter = OpenSSHKeyWriter()
        for secret in secrets {
-            let path = path(for: secret)
+            let path = publicKeyPath(for: secret)
            guard let data = keyWriter.openSSHString(secret: secret).data(using: .utf8) else { continue }
            FileManager.default.createFile(atPath: path, contents: data, attributes: nil)
        }
@ -34,8 +40,18 @@ public class PublicKeyFileStoreController {
    /// - Parameter secret: The Secret to return the path for.
    /// - Returns: The path to the Secret's public key.
    /// - Warning: This method returning a path does not imply that a key has been written to disk already. This method only describes where it will be written to.
-    public func path<SecretType: Secret>(for secret: SecretType) -> String {
-        directory.appending("/").appending("\(secret.name.replacingOccurrences(of: " ", with: "-")).pub")
+    public func publicKeyPath<SecretType: Secret>(for secret: SecretType) -> String {
+        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        return directory.appending("/").appending("\(minimalHex).pub")
+    }
+
+    /// The path for a Secret's SSH Certificate public key.
+    /// - Parameter secret: The Secret to return the path for.
+    /// - Returns: The path to the SSH Certificate public key.
+    /// - Warning: This method returning a path does not imply that a key has a SSH certificates. This method only describes where it will be.
+    public func sshCertificatePath<SecretType: Secret>(for secret: SecretType) -> String {
+        let minimalHex = keyWriter.openSSHMD5Fingerprint(secret: secret).replacingOccurrences(of: ":", with: "")
+        return directory.appending("/").appending("\(minimalHex)-cert.pub")
    }

 }
--- a/Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift
+++ b/Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift
@ -0,0 +1,9 @@
+import Foundation
+
+/// Protocol describing a persisted authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time.
+public protocol PersistedAuthenticationContext {
+    /// Whether the context remains valid.
+    var valid: Bool { get }
+    /// The date at which the authorization expires and the context becomes invalid.
+    var expiration: Date { get }
+}
--- a/Sources/Packages/Sources/SecretKit/Types/Secret.swift
+++ b/Sources/Packages/Sources/SecretKit/Types/Secret.swift
@ -9,6 +9,8 @@ public protocol Secret: Identifiable, Hashable {
    var algorithm: Algorithm { get }
    /// The key size for the secret.
    var keySize: Int { get }
+    /// Whether the secret requires authentication before use.
+    var requiresAuthentication: Bool { get }
    /// The public key data for the secret.
    var publicKey: Data { get }

--- a/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift
+++ b/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift
@ -20,8 +20,14 @@ public protocol SecretStore: ObservableObject, Identifiable {
    ///   - data: The data to sign.
    ///   - secret: The ``Secret`` to sign with.
    ///   - provenance: A ``SigningRequestProvenance`` describing where the request came from.
-    /// - Returns: A ``SignedData`` object, containing the signature and metadata about the signature process.
-    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> SignedData
+    /// - Returns: The signed data.
+    func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data
+
+    /// Checks to see if there is currently a valid persisted authentication for a given secret.
+    /// - Parameters:
+    ///   - secret: The ``Secret`` to check if there is a persisted authentication for.
+    /// - Returns: A persisted authentication context, if a valid one exists.
+    func existingPersistedAuthenticationContext(secret: SecretType) -> PersistedAuthenticationContext?

    /// Persists user authorization for access to a secret.
    /// - Parameters:
@ -30,6 +36,9 @@ public protocol SecretStore: ObservableObject, Identifiable {
    ///  - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret.
    func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) throws

+    /// Requests that the store reload secrets from any backing store, if neccessary.
+    func reloadSecrets()
+
 }

 /// A SecretStore that the Secretive admin app can modify.
@ -56,6 +65,9 @@ public protocol SecretStoreModifiable: SecretStore {

 extension NSNotification.Name {

+    // Distributed notification that keys were modified out of process (ie, that the management tool added/removed secrets)
    public static let secretStoreUpdated = NSNotification.Name("com.maxgoedjen.Secretive.secretStore.updated")
+    // Internal notification that keys were reloaded from the backing store.
+    public static let secretStoreReloaded = NSNotification.Name("com.maxgoedjen.Secretive.secretStore.reloaded")

 }
--- a/Sources/Packages/Sources/SecretKit/Types/SignedData.swift
+++ b/Sources/Packages/Sources/SecretKit/Types/SignedData.swift
@ -1,20 +0,0 @@
-import Foundation
-
-/// Describes the output of a sign request.
-public struct SignedData {
-
-    /// The signed data.
-    public let data: Data
-    /// A boolean describing whether authentication was required during the signature process.
-    public let requiredAuthentication: Bool
-
-    /// Initializes a new SignedData.
-    /// - Parameters:
-    ///   - data: The signed data.
-    ///   - requiredAuthentication: A boolean describing whether authentication was required during the signature process.
-    public init(data: Data, requiredAuthentication: Bool) {
-        self.data = data
-        self.requiredAuthentication = requiredAuthentication
-    }
-
-}
--- a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveSecret.swift
+++ b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveSecret.swift
@ -11,6 +11,7 @@ extension SecureEnclave {
        public let name: String
        public let algorithm = Algorithm.ellipticCurve
        public let keySize = 256
+        public let requiresAuthentication: Bool
        public let publicKey: Data

    }
--- a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift
+++ b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift
@ -24,7 +24,7 @@ extension SecureEnclave {
        /// Initializes a Store.
        public init() {
            DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { _ in
-                self.reloadSecrets(notify: false)
+                self.reloadSecretsInternal(notifyAgent: false)
            }
            loadSecrets()
        }
@ -68,7 +68,7 @@ extension SecureEnclave {
                throw KeychainError(statusCode: nil)
            }
            try savePublicKey(publicKey, name: name)
-            reloadSecrets()
+            reloadSecretsInternal()
        }

        public func delete(secret: Secret) throws {
@ -80,7 +80,7 @@ extension SecureEnclave {
            if status != errSecSuccess {
                throw KeychainError(statusCode: status)
            }
-            reloadSecrets()
+            reloadSecretsInternal()
        }

        public func update(secret: Secret, name: String) throws {
@ -97,10 +97,10 @@ extension SecureEnclave {
            if status != errSecSuccess {
                throw KeychainError(statusCode: status)
            }
-            reloadSecrets()
+            reloadSecretsInternal()
        }
        
-        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> SignedData {
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
            let context: LAContext
            if let existing = persistedAuthenticationContexts[secret], existing.valid {
                context = existing.context
@ -131,16 +131,15 @@ extension SecureEnclave {
            let key = untypedSafe as! SecKey
            var signError: SecurityError?

-            let signingStartTime = Date()
            guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else {
                throw SigningError(error: signError)
            }
-            let signatureDuration = Date().timeIntervalSince(signingStartTime)
-            // Hack to determine if the user had to authenticate to sign.
-            // Since there's now way to inspect SecAccessControl to determine (afaict).
-            let requiredAuthentication = signatureDuration > Constants.unauthenticatedThreshold
+            return signature as Data
+        }

-            return SignedData(data: signature as Data, requiredAuthentication: requiredAuthentication)
+        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
+            guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
+            return persisted
        }

        public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) throws {
@ -164,6 +163,10 @@ extension SecureEnclave {
            }
        }

+        public func reloadSecrets() {
+            reloadSecretsInternal(notifyAgent: false)
+        }
+
    }

 }
@ -171,18 +174,22 @@ extension SecureEnclave {
 extension SecureEnclave.Store {

    /// Reloads all secrets from the store.
-    /// - Parameter notify: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
-    private func reloadSecrets(notify: Bool = true) {
+    /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well.
+    private func reloadSecretsInternal(notifyAgent: Bool = true) {
+        let before = secrets
        secrets.removeAll()
        loadSecrets()
-        if notify {
-            DistributedNotificationCenter.default().post(name: .secretStoreUpdated, object: nil)
+        if secrets != before {
+            NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
+            if notifyAgent {
+                DistributedNotificationCenter.default().postNotificationName(.secretStoreUpdated, object: nil, deliverImmediately: true)
+            }
        }
    }

    /// Loads all secrets from the store.
    private func loadSecrets() {
-        let attributes = [
+        let publicAttributes = [
            kSecClass: kSecClassKey,
            kSecAttrKeyType: SecureEnclave.Constants.keyType,
            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
@ -191,16 +198,46 @@ extension SecureEnclave.Store {
            kSecMatchLimit: kSecMatchLimitAll,
            kSecReturnAttributes: true
            ] as CFDictionary
-        var untyped: CFTypeRef?
-        SecItemCopyMatching(attributes, &untyped)
-        guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped: [SecureEnclave.Secret] = typed.map {
+        var publicUntyped: CFTypeRef?
+        SecItemCopyMatching(publicAttributes, &publicUntyped)
+        guard let publicTyped = publicUntyped as? [[CFString: Any]] else { return }
+        let privateAttributes = [
+            kSecClass: kSecClassKey,
+            kSecAttrKeyType: SecureEnclave.Constants.keyType,
+            kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
+            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+            kSecReturnRef: true,
+            kSecMatchLimit: kSecMatchLimitAll,
+            kSecReturnAttributes: true
+            ] as CFDictionary
+        var privateUntyped: CFTypeRef?
+        SecItemCopyMatching(privateAttributes, &privateUntyped)
+        guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
+        let privateMapped = privateTyped.reduce(into: [:] as [Data: [CFString: Any]]) { partialResult, next in
+            let id = next[kSecAttrApplicationLabel] as! Data
+            partialResult[id] = next
+        }
+        let authNotRequiredAccessControl: SecAccessControl =
+            SecAccessControlCreateWithFlags(kCFAllocatorDefault,
+                                            kSecAttrAccessibleWhenUnlockedThisDeviceOnly,
+                                            [.privateKeyUsage],
+                                            nil)!
+
+        let wrapped: [SecureEnclave.Secret] = publicTyped.map {
            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
            let id = $0[kSecAttrApplicationLabel] as! Data
            let publicKeyRef = $0[kSecValueRef] as! SecKey
            let publicKeyAttributes = SecKeyCopyAttributes(publicKeyRef) as! [CFString: Any]
            let publicKey = publicKeyAttributes[kSecValueData] as! Data
-            return SecureEnclave.Secret(id: id, name: name, publicKey: publicKey)
+            let privateKey = privateMapped[id]
+            let requiresAuth: Bool
+            if let authRequirements = privateKey?[kSecAttrAccessControl] {
+                // Unfortunately we can't inspect the access control object directly, but it does behave predicatable with equality.
+                requiresAuth = authRequirements as! SecAccessControl != authNotRequiredAccessControl
+            } else {
+                requiresAuth = false
+            }
+            return SecureEnclave.Secret(id: id, name: name, requiresAuthentication: requiresAuth, publicKey: publicKey)
        }
        secrets.append(contentsOf: wrapped)
    }
@ -263,7 +300,7 @@ extension SecureEnclave {
 extension SecureEnclave {

    /// A context describing a persisted authentication.
-    private struct PersistentAuthenticationContext {
+    private struct PersistentAuthenticationContext: PersistedAuthenticationContext {

        /// The Secret to persist authentication for.
        let secret: Secret
@ -271,7 +308,7 @@ extension SecureEnclave {
        let context: LAContext
        /// An expiration date for the context.
        /// - Note -  Monotonic time instead of Date() to prevent people setting the clock back.
-        let expiration: UInt64
+        let monotonicExpiration: UInt64

        /// Initializes a context.
        /// - Parameters:
@ -282,12 +319,18 @@ extension SecureEnclave {
            self.secret = secret
            self.context = context
            let durationInNanoSeconds = Measurement(value: duration, unit: UnitDuration.seconds).converted(to: .nanoseconds).value
-            self.expiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
+            self.monotonicExpiration = clock_gettime_nsec_np(CLOCK_MONOTONIC) + UInt64(durationInNanoSeconds)
        }

        /// A boolean describing whether or not the context is still valid.
        var valid: Bool {
-            clock_gettime_nsec_np(CLOCK_MONOTONIC) < expiration
+            clock_gettime_nsec_np(CLOCK_MONOTONIC) < monotonicExpiration
+        }
+
+        var expiration: Date {
+            let remainingNanoseconds = monotonicExpiration - clock_gettime_nsec_np(CLOCK_MONOTONIC)
+            let remainingInSeconds = Measurement(value: Double(remainingNanoseconds), unit: UnitDuration.nanoseconds).converted(to: .seconds).value
+            return Date(timeIntervalSinceNow: remainingInSeconds)
        }
    }

--- a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardSecret.swift
+++ b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardSecret.swift
@ -11,6 +11,7 @@ extension SmartCard {
        public let name: String
        public let algorithm: Algorithm
        public let keySize: Int
+        public let requiresAuthentication: Bool = false
        public let publicKey: Data

    }
--- a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift
+++ b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift
@ -44,7 +44,7 @@ extension SmartCard {
            fatalError("Keys must be deleted on the smart card.")
        }

-        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> SignedData {
+        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
            guard let tokenID = tokenID else { fatalError() }
            let context = LAContext()
            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
@ -79,12 +79,29 @@ extension SmartCard {
            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm, data as CFData, &signError) else {
                throw SigningError(error: signError)
            }
-            return SignedData(data: signature as Data, requiredAuthentication: false)
+            return signature as Data
+        }
+
+        public func existingPersistedAuthenticationContext(secret: SmartCard.Secret) -> PersistedAuthenticationContext? {
+            nil
        }

        public func persistAuthentication(secret: SmartCard.Secret, forDuration: TimeInterval) throws {
        }

+        /// Reloads all secrets from the store.
+        public func reloadSecrets() {
+            DispatchQueue.main.async {
+                self.isAvailable = self.tokenID != nil
+                let before = self.secrets
+                self.secrets.removeAll()
+                self.loadSecrets()
+                if self.secrets != before {
+                    NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
+                }
+            }
+        }
+
    }

 }
@ -98,15 +115,6 @@ extension SmartCard.Store {
        reloadSecrets()
    }

-    /// Reloads all secrets from the store.
-    private func reloadSecrets() {
-        DispatchQueue.main.async {
-            self.isAvailable = self.tokenID != nil
-            self.secrets.removeAll()
-            self.loadSecrets()
-        }
-    }
-
    /// Loads all secrets from the store.
    private func loadSecrets() {
        guard let tokenID = tokenID else { return }
--- a/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift
+++ b/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift
@ -49,7 +49,7 @@ extension Stub {
            print("Public Key OpenSSH: \(OpenSSHKeyWriter().openSSHString(secret: secret))")
        }

-        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> SignedData {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
            guard !shouldThrow else {
                throw NSError(domain: "test", code: 0, userInfo: nil)
            }
@ -68,12 +68,19 @@ extension Stub {
            default:
                fatalError()
            }
-            return SignedData(data: SecKeyCreateSignature(privateKey, signatureAlgorithm, data as CFData, nil)! as Data, requiredAuthentication: false)
+            return SecKeyCreateSignature(privateKey, signatureAlgorithm, data as CFData, nil)! as Data
+        }
+
+        public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {
+            nil
        }

        public func persistAuthentication(secret: Stub.Secret, forDuration duration: TimeInterval) throws {
        }

+        public func reloadSecrets() {
+        }
+
    }

 }
@ -88,6 +95,7 @@ extension Stub {

        let keySize: Int
        let publicKey: Data
+        let requiresAuthentication = false
        let privateKey: Data

        init(keySize: Int, publicKey: Data, privateKey: Data) {
--- a/Sources/Packages/Tests/SecretAgentKitTests/StubWitness.swift
+++ b/Sources/Packages/Tests/SecretAgentKitTests/StubWitness.swift
@ -17,7 +17,7 @@ func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: A
        }
    }

-func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) throws {
+func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
        witness(secret, provenance)
    }

--- a/Sources/SecretAgent/AppDelegate.swift
+++ b/Sources/SecretAgent/AppDelegate.swift
@ -33,7 +33,7 @@ class AppDelegate: NSObject, NSApplicationDelegate {
        DispatchQueue.main.async {
            self.socketController.handler = self.agent.handle(reader:writer:)
        }
-        DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { [self] _ in
+        NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in
            try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
        }
        try? publicKeyFileStoreController.generatePublicKeys(for: storeList.stores.flatMap({ $0.secrets }), clear: true)
--- a/Sources/SecretAgent/Notifier.swift
+++ b/Sources/SecretAgent/Notifier.swift
@ -57,7 +57,7 @@ class Notifier {
        notificationCenter.requestAuthorization(options: .alert) { _, _ in }
    }

-    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) {
+    func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) {
        notificationDelegate.pendingPersistableSecrets[secret.id.description] = secret
        notificationDelegate.pendingPersistableStores[store.id.description] = store
        let notificationCenter = UNUserNotificationCenter.current()
@ -69,7 +69,7 @@ class Notifier {
        if #available(macOS 12.0, *) {
            notificationContent.interruptionLevel = .timeSensitive
        }
-        if requiredAuthentication {
+        if secret.requiresAuthentication && store.existingPersistedAuthenticationContext(secret: secret) == nil {
            notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
        }
        if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) {
@ -106,8 +106,8 @@ extension Notifier: SigningWitness {
    func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
    }

-    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance, requiredAuthentication: Bool) throws {
-        notify(accessTo: secret, from: store, by: provenance, requiredAuthentication: requiredAuthentication)
+    func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws {
+        notify(accessTo: secret, from: store, by: provenance)
    }

 }
@ -154,7 +154,7 @@ class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
        case Notifier.Constants.persistAuthenticationCategoryIdentitifier:
            handlePersistAuthenticationResponse(response: response)
        default:
-            fatalError()
+            break
        }

        completionHandler()
--- a/Sources/Secretive.xcodeproj/project.pbxproj
+++ b/Sources/Secretive.xcodeproj/project.pbxproj
@ -31,6 +31,7 @@
 		50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8923FCE48E0099B055 /* Preview Assets.xcassets */; };
 		50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D9823FCE48E0099B055 /* SecretiveTests.swift */; };
 		50617DD223FCEFA90099B055 /* PreviewStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617DD123FCEFA90099B055 /* PreviewStore.swift */; };
+		5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */; };
 		5066A6C22516F303004B5A36 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C12516F303004B5A36 /* SetupView.swift */; };
 		5066A6C82516FE6E004B5A36 /* CopyableView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C72516FE6E004B5A36 /* CopyableView.swift */; };
 		5066A6F7251829B1004B5A36 /* ShellConfigurationController.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */; };
@ -123,6 +124,7 @@
 		50617D9823FCE48E0099B055 /* SecretiveTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretiveTests.swift; sourceTree = "<group>"; };
 		50617D9A23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = "<group>"; };
 		50617DD123FCEFA90099B055 /* PreviewStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PreviewStore.swift; sourceTree = "<group>"; };
+		5065E312295517C500E16645 /* ToolbarButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolbarButtonStyle.swift; sourceTree = "<group>"; };
 		5066A6C12516F303004B5A36 /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = "<group>"; };
 		5066A6C72516FE6E004B5A36 /* CopyableView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = CopyableView.swift; sourceTree = "<group>"; };
 		5066A6F6251829B1004B5A36 /* ShellConfigurationController.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ShellConfigurationController.swift; sourceTree = "<group>"; };
@ -275,6 +277,7 @@
 				50153E1F250AFCB200525160 /* UpdateView.swift */,
 				5066A6C12516F303004B5A36 /* SetupView.swift */,
 				5066A6C72516FE6E004B5A36 /* CopyableView.swift */,
+				5065E312295517C500E16645 /* ToolbarButtonStyle.swift */,
 			);
 			path = Views;
 			sourceTree = "<group>";
@ -475,6 +478,7 @@
 				2C4A9D2F2636FFD3008CC8E2 /* RenameSecretView.swift in Sources */,
 				5091D2BC25183B830049FD9B /* ApplicationDirectoryController.swift in Sources */,
 				5066A6C22516F303004B5A36 /* SetupView.swift in Sources */,
+				5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */,
 				50617D8523FCE48E0099B055 /* ContentView.swift in Sources */,
 				50571E0324393C2600F76F6C /* JustUpdatedChecker.swift in Sources */,
 				5079BA0F250F29BF00EA86F4 /* StoreListView.swift in Sources */,
--- a/Sources/Secretive.xcodeproj/xcshareddata/xcschemes/Secretive.xcscheme
+++ b/Sources/Secretive.xcodeproj/xcshareddata/xcschemes/Secretive.xcscheme
@ -75,6 +75,7 @@
      ignoresPersistentStateOnLaunch = "NO"
      debugDocumentVersioning = "YES"
      debugServiceExtension = "internal"
+      enableGPUValidationMode = "1"
      allowLocationSimulation = "YES">
      <BuildableProductRunnable
         runnableDebuggingMode = "0">
--- a/Content/PreviewStore.swift
+++ b/Content/PreviewStore.swift
@ -11,6 +11,7 @@ extension Preview {
        let name: String
        let algorithm = Algorithm.ellipticCurve
        let keySize = 256
+        let requiresAuthentication: Bool = false
        let publicKey = UUID().uuidString.data(using: .utf8)!

    }
@ -35,13 +36,20 @@ extension Preview {
            self.secrets.append(contentsOf: new)
        }

-        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> SignedData {
-            return SignedData(data: data, requiredAuthentication: false)
+        func sign(data: Data, with secret: Preview.Secret, for provenance: SigningRequestProvenance) throws -> Data {
+            return data
+        }
+
+        func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
+            nil
        }

        func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws {
        }

+        func reloadSecrets() {
+        }
+
    }

    class StoreModifiable: Store, SecretStoreModifiable {
--- a/Sources/Secretive/Views/ContentView.swift
+++ b/Sources/Secretive/Views/ContentView.swift
@ -9,6 +9,8 @@ struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentSt
    @Binding var showingCreation: Bool
    @Binding var runningSetup: Bool
    @Binding var hasRunSetup: Bool
+    @State var showingAgentInfo = false
+    @Environment(\.colorScheme) var colorScheme

    @EnvironmentObject private var storeList: SecretStoreList
    @EnvironmentObject private var updater: UpdaterType
@ -27,10 +29,13 @@ struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentSt
        }
        .frame(minWidth: 640, minHeight: 320)
        .toolbar {
-            updateNotice
-            setupNotice
-            appPathNotice
-            newItem
+            toolbarItem(updateNoticeView, id: "update")
+            toolbarItem(runningOrRunSetupView, id: "setup")
+            toolbarItem(appPathNoticeView, id: "appPath")
+            toolbarItem(newItemView, id: "new")
+        }
+        .sheet(isPresented: $runningSetup) {
+            SetupView(visible: $runningSetup, setupComplete: $hasRunSetup)
        }
    }

@ -38,124 +43,141 @@ struct ContentView<UpdaterType: UpdaterProtocol, AgentStatusCheckerType: AgentSt

 extension ContentView {

-    var updateNotice: ToolbarItem<Void, AnyView> {
-        guard let update = updater.update else {
-            return ToolbarItem { AnyView(EmptyView()) }
+
+    func toolbarItem(_ view: some View, id: String) -> ToolbarItem<String, some View> {
+        ToolbarItem(id: id) { view }
+    }
+
+    var needsSetup: Bool {
+        (runningSetup || !hasRunSetup || !agentStatusChecker.running) && !agentStatusChecker.developmentBuild
+    }
+
+    /// Item either showing a "everything's good, here's more info" or "something's wrong, re-run setup" message
+    /// These two are mutually exclusive
+    @ViewBuilder
+    var runningOrRunSetupView: some View {
+        if needsSetup {
+            setupNoticeView
+        } else {
+            runningNoticeView
        }
-        let color: Color
-        let text: String
+    }
+
+    var updateNoticeContent: (String, Color)? {
+        guard let update = updater.update else { return nil }
        if update.critical {
-            text = "Critical Security Update Required"
-            color = .red
+            return ("Critical Security Update Required", .red)
        } else {
            if updater.testBuild {
-                text = "Test Build"
-                color = .blue
+                return ("Test Build", .blue)
            } else {
-                text = "Update Available"
-                color = .orange
+                return ("Update Available", .orange)
            }
        }
-        return ToolbarItem {
-            AnyView(
-                Button(action: {
-                    selectedUpdate = update
-                }, label: {
-                    Text(text)
-                        .font(.headline)
-                        .foregroundColor(.white)
-                })
-                    .background(color)
-                    .cornerRadius(5)
-                    .popover(item: $selectedUpdate, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) { update in
-                        UpdateDetailView(update: update)
-                    }
-            )
-        }
    }

-    var newItem: ToolbarItem<Void, AnyView> {
-        guard storeList.modifiableStore?.isAvailable ?? false else {
-            return ToolbarItem { AnyView(EmptyView()) }
-        }
-        return ToolbarItem {
-            AnyView(
-                Button(action: {
-                    showingCreation = true
-                }, label: {
-                    Image(systemName: "plus")
-                })
-                    .popover(isPresented: $showingCreation, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
-                        if let modifiable = storeList.modifiableStore {
-                            CreateSecretView(store: modifiable, showing: $showingCreation)
-                        }
-                    }
-
-            )
-        }
-    }
-
-    var setupNotice: ToolbarItem<Void, AnyView> {
-        return ToolbarItem {
-            AnyView(
-                Group {
-                    if (runningSetup || !hasRunSetup || !agentStatusChecker.running) && !agentStatusChecker.developmentBuild  {
-                        Button(action: {
-                            runningSetup = true
-                        }, label: {
-                            Group {
-                                if hasRunSetup && !agentStatusChecker.running {
-                                    Text("Secret Agent Is Not Running")
-                                } else {
-                                    Text("Setup Secretive")
-                                }
-                            }
-                            .font(.headline)
-                            .foregroundColor(.white)
-                        })
-                            .background(Color.orange)
-                            .cornerRadius(5)
-                    } else {
-                        EmptyView()
-                    }
-                }
-                    .sheet(isPresented: $runningSetup) {
-                        SetupView(visible: $runningSetup, setupComplete: $hasRunSetup)
-                    }
-            )
-        }
-    }
-
-    var appPathNotice: ToolbarItem<Void, AnyView> {
-        let controller = ApplicationDirectoryController()
-        guard !controller.isInApplicationsDirectory else {
-            return ToolbarItem { AnyView(EmptyView()) }
-        }
-        return ToolbarItem {
-            AnyView(
-                Button(action: {
-                    showingAppPathNotice = true
-                }, label: {
-                    Group {
-                        Text("Secretive Is Not in Applications Folder")
-                    }
+    @ViewBuilder
+    var updateNoticeView: some View {
+        if let update = updater.update, let (text, color) = updateNoticeContent {
+            Button(action: {
+                selectedUpdate = update
+            }, label: {
+                Text(text)
                    .font(.headline)
                    .foregroundColor(.white)
-                })
-                    .background(Color.orange)
-                    .cornerRadius(5)
-                    .popover(isPresented: $showingAppPathNotice, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
-                        VStack {
-                            Image(systemName: "exclamationmark.triangle")
-                                .resizable()
-                                .aspectRatio(contentMode: .fit)
-                                .frame(width: 64)
-                            Text("Secretive needs to be in your Applications folder to work properly. Please move it and relaunch.")
-                                .frame(maxWidth: 300)
-                        }
-                        .padding()
-                    }
-            )
+            })
+            .buttonStyle(ToolbarButtonStyle(color: color))
+            .popover(item: $selectedUpdate, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) { update in
+                UpdateDetailView(update: update)
+            }
+        }
+    }
+
+    @ViewBuilder
+    var newItemView: some View {
+        if storeList.modifiableStore?.isAvailable ?? false {
+            Button(action: {
+                showingCreation = true
+            }, label: {
+                Image(systemName: "plus")
+            })
+            .sheet(isPresented: $showingCreation) {
+                if let modifiable = storeList.modifiableStore {
+                    CreateSecretView(store: modifiable, showing: $showingCreation)
+                }
+            }
+        }
+    }
+
+    @ViewBuilder
+    var setupNoticeView: some View {
+        Button(action: {
+            runningSetup = true
+        }, label: {
+            Group {
+                if hasRunSetup && !agentStatusChecker.running {
+                    Text("Secret Agent Is Not Running")
+                } else {
+                    Text("Setup Secretive")
+                }
+            }
+            .font(.headline)
+            .foregroundColor(.white)
+        })
+        .buttonStyle(ToolbarButtonStyle(color: .orange))
+    }
+
+    @ViewBuilder
+    var runningNoticeView: some View {
+        Button(action: {
+            showingAgentInfo = true
+        }, label: {
+            HStack {
+                Text("Agent is Running")
+                    .font(.headline)
+                    .foregroundColor(colorScheme == .light ? Color(white: 0.3) : .white)
+                Circle()
+                    .frame(width: 10, height: 10)
+                    .foregroundColor(Color.green)
+            }
+        })
+        .buttonStyle(ToolbarButtonStyle(lightColor: .black.opacity(0.05), darkColor: .white.opacity(0.05)))
+        .popover(isPresented: $showingAgentInfo, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
+            VStack {
+                Text("SecretAgent is Running")
+                    .font(.title)
+                    .padding(5)
+                Text("SecretAgent is a process that runs in the background to sign requests, so you don't need to keep Secretive open all the time.\n\n**You can close Secretive, and everything will still keep working.**")
+                    .frame(width: 300)
+            }
+            .padding()
+        }
+    }
+
+    @ViewBuilder
+    var appPathNoticeView: some View {
+        if !ApplicationDirectoryController().isInApplicationsDirectory {
+            Button(action: {
+                showingAppPathNotice = true
+            }, label: {
+                Group {
+                    Text("Secretive Is Not in Applications Folder")
+                }
+                .font(.headline)
+                .foregroundColor(.white)
+            })
+            .buttonStyle(ToolbarButtonStyle(color: .orange))
+            .popover(isPresented: $showingAppPathNotice, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
+                VStack {
+                    Image(systemName: "exclamationmark.triangle")
+                        .resizable()
+                        .aspectRatio(contentMode: .fit)
+                        .frame(width: 64)
+                    Text("Secretive needs to be in your Applications folder to work properly. Please move it and relaunch.")
+                        .frame(maxWidth: 300)
+                }
+                .padding()
+            }
        }
    }

@ -198,3 +220,4 @@ struct ContentView_Previews: PreviewProvider {
 }

 #endif
+
--- a/Sources/Secretive/Views/CopyableView.swift
+++ b/Sources/Secretive/Views/CopyableView.swift
@ -8,6 +8,7 @@ struct CopyableView: View {
    var text: String

    @State private var interactionState: InteractionState = .normal
+    @Environment(\.colorScheme) private var colorScheme

    var body: some View {
        VStack(alignment: .leading) {
@ -77,38 +78,32 @@ struct CopyableView: View {
    }

    var backgroundColor: Color {
-        let color: NSColor
        switch interactionState {
        case .normal:
-            color = .windowBackgroundColor
+            return colorScheme == .dark ? Color(white: 0.2) : Color(white: 0.885)
        case .hovering:
-            color = .unemphasizedSelectedContentBackgroundColor
+            return colorScheme == .dark ? Color(white: 0.275) : Color(white: 0.82)
        case .clicking:
-            color = .selectedContentBackgroundColor
+            return .accentColor
        }
-        return Color(color)
    }

    var primaryTextColor: Color {
-        let color: NSColor
        switch interactionState {
        case .normal, .hovering:
-            color = .textColor
+            return Color(.textColor)
        case .clicking:
-            color = .white
+            return .white
        }
-        return Color(color)
    }

    var secondaryTextColor: Color {
-        let color: NSColor
        switch interactionState {
        case .normal, .hovering:
-            color = .secondaryLabelColor
+            return Color(.secondaryLabelColor)
        case .clicking:
-            color = .white
+            return .white
        }
-        return Color(color)
    }

    func copy() {
@ -128,7 +123,9 @@ struct CopyableView_Previews: PreviewProvider {
    static var previews: some View {
        Group {
            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Hello world.")
+                .padding()
            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. ")
+                .padding()
        }
    }
 }
--- a/Sources/Secretive/Views/CreateSecretView.swift
+++ b/Sources/Secretive/Views/CreateSecretView.swift
@ -12,28 +12,35 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
    var body: some View {
        VStack {
            HStack {
-                Image(nsImage: NSApplication.shared.applicationIconImage)
-                    .resizable()
-                    .frame(width: 64, height: 64)
-                    .padding()
                VStack {
                    HStack {
-                        Text("Create a New Secret").bold()
+                        Text("Create a New Secret")
+                            .font(.largeTitle)
                        Spacer()
                    }
                    HStack {
                        Text("Name:")
-                        TextField("Shhhhh", text: $name).focusable()
+                        TextField("Shhhhh", text: $name)
+                            .focusable()
                    }
-                    HStack {
-                        VStack(spacing: 20) {
-                            Picker("", selection: $requiresAuthentication) {
-                                Text("Requires Authentication (Biometrics or Password) before each use").tag(true)
-                                Text("Authentication not required when Mac is unlocked").tag(false)
+                    if #available(macOS 12.0, *) {
+                        ThumbnailPickerView(items: [
+                            ThumbnailPickerView.Item(value: true, name: "Require Authentication", description: "You will be required to authenticate using Touch ID, Apple Watch, or password before each use.", thumbnail: AuthenticationView()),
+                            ThumbnailPickerView.Item(value: false, name: "Notify",
+                                                     description: "No authentication is required while your Mac is unlocked, but you will be notified when a secret is used.",
+                                                     thumbnail: NotificationView())
+                        ], selection: $requiresAuthentication)
+                    } else {
+                        HStack {
+                            VStack(spacing: 20) {
+                                Picker("", selection: $requiresAuthentication) {
+                                    Text("Requires Authentication (Biometrics or Password) before each use").tag(true)
+                                    Text("Authentication not required when Mac is unlocked").tag(false)
+                                }
+                                .pickerStyle(RadioGroupPickerStyle())
+                                Spacer(minLength: 10)
                            }
-                            .pickerStyle(RadioGroupPickerStyle())
                        }
-                        Spacer()
                    }
                }
            }
@ -54,4 +61,208 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
        try! store.create(name: name, requiresAuthentication: requiresAuthentication)
        showing = false
    }
+
 }
+
+struct ThumbnailPickerView<ValueType: Hashable>: View {
+
+    private let items: [Item<ValueType>]
+    @Binding var selection: ValueType
+
+    init(items: [ThumbnailPickerView<ValueType>.Item<ValueType>], selection: Binding<ValueType>) {
+        self.items = items
+        _selection = selection
+    }
+
+    var body: some View {
+        HStack(alignment: .top) {
+            ForEach(items) { item in
+                VStack(alignment: .leading, spacing: 15) {
+                    item.thumbnail
+                        .frame(height: 200)
+                        .overlay(RoundedRectangle(cornerRadius: 10)
+                            .stroke(lineWidth: item.value == selection ? 15 : 0))
+                        .clipShape(RoundedRectangle(cornerRadius: 10, style: .continuous))
+                        .foregroundColor(.accentColor)
+                    VStack(alignment: .leading, spacing: 5) {
+                        Text(item.name)
+                            .bold()
+                        Text(item.description)
+                            .fixedSize(horizontal: false, vertical: true)
+                    }
+                }
+                .frame(width: 250)
+                .onTapGesture {
+                    withAnimation(.spring()) {
+                        selection = item.value
+                    }
+                }
+            }
+            .padding(5)
+        }
+    }
+
+}
+
+extension ThumbnailPickerView {
+
+    struct Item<ValueType: Hashable>: Identifiable {
+        let id = UUID()
+        let value: ValueType
+        let name: String
+        let description: String
+        let thumbnail: AnyView
+
+        init<ViewType: View>(value: ValueType, name: String, description: String, thumbnail: ViewType) {
+            self.value = value
+            self.name = name
+            self.description = description
+            self.thumbnail = AnyView(thumbnail)
+        }
+    }
+
+}
+
+@MainActor class SystemBackground: ObservableObject {
+
+    static let shared = SystemBackground()
+    @Published var image: NSImage?
+
+    private init() {
+        if let mainScreen = NSScreen.main, let imageURL = NSWorkspace.shared.desktopImageURL(for: mainScreen) {
+            image = NSImage(contentsOf: imageURL)
+        } else {
+            image = nil
+        }
+    }
+
+}
+
+@available(macOS 12.0, *)
+struct SystemBackgroundView: View {
+
+    let anchor: UnitPoint
+
+    var body: some View {
+        if let image = SystemBackground.shared.image {
+            Image(nsImage: image)
+                .resizable()
+                .scaleEffect(3, anchor: anchor)
+                .clipped()
+                .allowsHitTesting(false)
+        } else {
+            Rectangle()
+                .foregroundColor(Color(.systemPurple))
+        }
+    }
+}
+
+@available(macOS 12.0, *)
+struct AuthenticationView: View {
+
+    var body: some View {
+        ZStack {
+            SystemBackgroundView(anchor: .center)
+            GeometryReader { geometry in
+                VStack {
+                    Image(systemName: "touchid")
+                        .resizable()
+                        .aspectRatio(contentMode: .fit)
+                        .foregroundColor(Color(.systemRed))
+                    Text("Touch ID Prompt")
+                        .font(.headline)
+                        .foregroundColor(.primary)
+                        .redacted(reason: .placeholder)
+                    VStack {
+                        Text("Touch ID Detail prompt.Detail two.")
+                            .font(.caption2)
+                            .foregroundColor(.primary)
+                        Text("Touch ID Detail prompt.Detail two.")
+                            .font(.caption2)
+                            .foregroundColor(.primary)
+                    }
+                    .redacted(reason: .placeholder)
+                    RoundedRectangle(cornerRadius: 5)
+                        .frame(width: geometry.size.width, height: 20, alignment: .center)
+                        .foregroundColor(.accentColor)
+                    RoundedRectangle(cornerRadius: 5)
+                        .frame(width: geometry.size.width, height: 20, alignment: .center)
+                        .foregroundColor(Color(.unemphasizedSelectedContentBackgroundColor))
+                }
+            }
+            .padding()
+            .frame(width: 150)
+            .background(
+                RoundedRectangle(cornerRadius: 15)
+                    .foregroundStyle(.ultraThickMaterial)
+            )
+            .padding()
+
+        }
+    }
+
+}
+
+@available(macOS 12.0, *)
+struct NotificationView: View {
+
+    var body: some View {
+        ZStack {
+            SystemBackgroundView(anchor: .topTrailing)
+            VStack {
+                Rectangle()
+                    .background(Color.clear)
+                    .foregroundStyle(.thinMaterial)
+                    .frame(height: 35)
+                VStack {
+                    HStack {
+                        Spacer()
+                        HStack {
+                            Image(nsImage: NSApplication.shared.applicationIconImage)
+                                .resizable()
+                                .frame(width: 64, height: 64)
+                                .foregroundColor(.primary)
+                            VStack(alignment: .leading) {
+                                Text("Secretive")
+                                    .font(.title)
+                                    .foregroundColor(.primary)
+                                Text("Secretive wants to sign")
+                                    .font(.body)
+                                    .foregroundColor(.primary)
+                            }
+                        }.padding()
+                            .redacted(reason: .placeholder)
+                            .background(
+                                RoundedRectangle(cornerRadius: 15)
+                                    .foregroundStyle(.ultraThickMaterial)
+                            )
+                    }
+                    Spacer()
+                }
+                .padding()
+            }
+        }
+    }
+
+}
+
+#if DEBUG
+
+struct CreateSecretView_Previews: PreviewProvider {
+
+    static var previews: some View {
+        Group {
+            CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true))
+            if #available(macOS 12.0, *) {
+                AuthenticationView().environment(\.colorScheme, .dark)
+                AuthenticationView().environment(\.colorScheme, .light)
+                NotificationView().environment(\.colorScheme, .dark)
+                NotificationView().environment(\.colorScheme, .light)
+            } else {
+                // Fallback on earlier versions
+            }
+        }
+    }
+}
+
+#endif
--- a/Sources/Secretive/Views/SecretDetailView.swift
+++ b/Sources/Secretive/Views/SecretDetailView.swift
@ -21,7 +21,7 @@ struct SecretDetailView<SecretType: Secret>: View {
                    CopyableView(title: "Public Key", image: Image(systemName: "key"), text: keyString)
                    Spacer()
                        .frame(height: 20)
-                    CopyableView(title: "Public Key Path", image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.path(for: secret))
+                    CopyableView(title: "Public Key Path", image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret))
                    Spacer()
                }
            }
--- a/Sources/Secretive/Views/SecretListItemView.swift
+++ b/Sources/Secretive/Views/SecretListItemView.swift
@ -20,7 +20,15 @@ struct SecretListItemView: View {
        )

        return NavigationLink(destination: SecretDetailView(secret: secret), tag: secret.id, selection: $activeSecret) {
-            Text(secret.name)
+            if secret.requiresAuthentication {
+                HStack {
+                    Text(secret.name)
+                    Spacer()
+                    Image(systemName: "lock")
+                }
+            } else {
+                Text(secret.name)
+            }
        }.contextMenu {
            if store is AnySecretStoreModifiable {
                Button(action: { isRenaming = true }) {
--- a/Sources/Secretive/Views/SetupView.swift
+++ b/Sources/Secretive/Views/SetupView.swift
@ -22,7 +22,7 @@ struct SetupView: View {
                        }
                        .frame(width: proxy.size.width)
                    }
-                    .offset(x: -proxy.size.width * CGFloat(stepIndex), y: 0)
+                    .offset(x: -proxy.size.width * Double(stepIndex), y: 0)
                }
            }
        }
@ -44,7 +44,7 @@ struct StepView: View {
    let currentStep: Int

    // Ideally we'd have a geometry reader inside this view doing this for us, but that crashes on 11.0b7
-    let width: CGFloat
+    let width: Double

    var body: some View {
        ZStack(alignment: .leading) {
@ -53,7 +53,7 @@ struct StepView: View {
                .frame(height: 5)
            Rectangle()
                .foregroundColor(.green)
-                .frame(width: max(0, ((width - (Constants.padding * 2)) / CGFloat(numberOfSteps - 1)) * CGFloat(currentStep) - (Constants.circleWidth / 2)), height: 5)
+                .frame(width: max(0, ((width - (Constants.padding * 2)) / Double(numberOfSteps - 1)) * Double(currentStep) - (Constants.circleWidth / 2)), height: 5)
            HStack {
                ForEach(0..<numberOfSteps) { index in
                    ZStack {
@ -92,8 +92,8 @@ extension StepView {

    enum Constants {

-        static let padding: CGFloat = 15
-        static let circleWidth: CGFloat = 30
+        static let padding: Double = 15
+        static let circleWidth: Double = 30

    }

--- a/Sources/Secretive/Views/ToolbarButtonStyle.swift
+++ b/Sources/Secretive/Views/ToolbarButtonStyle.swift
@ -0,0 +1,37 @@
+import SwiftUI
+
+struct ToolbarButtonStyle: ButtonStyle {
+
+    private let lightColor: Color
+    private let darkColor: Color
+    @Environment(\.colorScheme) var colorScheme
+    @State var hovering = false
+
+    init(color: Color) {
+        self.lightColor = color
+        self.darkColor = color
+    }
+
+    init(lightColor: Color, darkColor: Color) {
+        self.lightColor = lightColor
+        self.darkColor = darkColor
+    }
+
+    func makeBody(configuration: Configuration) -> some View {
+        configuration.label
+            .padding(EdgeInsets(top: 6, leading: 8, bottom: 6, trailing: 8))
+            .background(colorScheme == .light ? lightColor : darkColor)
+            .foregroundColor(.white)
+            .clipShape(RoundedRectangle(cornerRadius: 5))
+            .overlay(
+                RoundedRectangle(cornerRadius: 5)
+                    .stroke(colorScheme == .light ? .black.opacity(0.15) : .white.opacity(0.15), lineWidth: 1)
+                    .background(hovering ? (colorScheme == .light ? .black.opacity(0.1) : .white.opacity(0.05)) : Color.clear)
+            )
+            .onHover { hovering in
+                withAnimation {
+                    self.hovering = hovering
+                }
+            }
+    }
+}
Author	SHA1	Message	Date
Max Goedjen	8597d86ee8	Move file	2022-12-22 18:06:58 -05:00
Max Goedjen	efef3b3412	Toolbar button style	2022-12-22 17:55:53 -05:00
Max Goedjen	d429d090cf	Switch toolbar items to viewbuilders	2022-12-22 17:20:03 -05:00
Max Goedjen	acdf0baf3a	Create Secret Screen Redesign (#370 )	2022-12-19 00:19:54 +00:00
Max Goedjen	1a362ef955	Tighten up light-scheme colors (#429 ) * Tighten up light-scheme colors * Tweak more * Little more	2022-12-18 15:16:08 -08:00
Max Goedjen	3b254d33a5	Fix for SecretAgent acting as if it has no keys after updating macOS (#427 ) * Allow reload pre-op * Fix tests * Make sure standin keys get rewritten on force update * Stub store	2022-12-18 07:16:56 +00:00
Max Goedjen	382913cb99	Update workflows to macOS-latest and Xcode 14.1 (#421 ) * Update nightly.yml * Update release.yml * Update test.yml	2022-10-27 07:40:01 +00:00
Max Goedjen	20cbaac6f6	Fix cstring init (#420 )	2022-10-27 07:20:22 +00:00
Max Goedjen	47d736cb0d	Don't delete public cert keys corrresponding to secretive-tracked keys (#417 )	2022-10-27 05:46:43 +00:00
unreality	fa0e81cd8e	Initial openssh certificate support (#416 ) * initial openssh certificate support * use the certificate to construct the public key instead of storing a map in memory * move certificate check into its own function and neaten up a few things * final requested changes Co-authored-by: Max Goedjen <max.goedjen@gmail.com>	2022-10-27 05:19:21 +00:00
Noah Berman	e31db0f4fa	Add line about help/setup tool to FAQ (#382 ) Co-authored-by: Max Goedjen <max.goedjen@gmail.com>	2022-10-26 08:48:31 +00:00
Kit Adams	403709ac83	Add in config for nushell (#406 )	2022-08-31 06:32:45 +00:00
Max Goedjen	5f055efa18	Ignore unhandled (#385 )	2022-06-04 22:25:13 +00:00
TheBitStick	e77812c06c	Added Mountain Duck Agent Configuration (#380 )	2022-05-05 04:52:32 +00:00
Paul Hammond	8744313ba1	Add sha-256 checksums to auditable build output (#377 )	2022-04-23 02:37:28 +00:00
Max Goedjen	26d6ced9ee	Rename add-to-project to add-to-project.yml (#375 )	2022-04-08 04:44:37 +00:00
Max Goedjen	71b4780488	Create add-to-project (#373 )	2022-04-07 21:41:20 -07:00
Max Goedjen	84dd9403c3	Update FAQ.md (#361 )	2022-02-26 22:56:09 +00:00
Paul	0af7b803bc	Add section on SSH agent forwarding to FAQ (#360 )	2022-02-26 22:48:24 +00:00
Max Goedjen	a1009d0dac	Statically load whether or not a key requires authentication before use (#357 ) * Add protocol requirements * Load auth settings. * Updates. * Update preview store * Add lock icon	2022-02-25 06:59:35 +00:00
Max Goedjen	ae7394f771	Update Agent.swift (#359 )	2022-02-25 06:57:29 +00:00
Max Goedjen	6ea0a3ebd2	Update screenshots (#352 ) * Update * Update README.md	2022-02-17 07:12:14 +00:00
Max Goedjen	067f1526b0	Fix local generation by ensuring generation happens only after local store reload (#351 )	2022-02-17 07:05:24 +00:00
Max Goedjen	f43dea0d0d	Specify immediate delivery (#350 )	2022-02-17 06:50:48 +00:00
Max Goedjen	db8833fa25	Switch key reps to an md5 based name (#349 )	2022-02-17 06:15:47 +00:00
Max Goedjen	1409e9ac31	Revert "Remove 24h unlock duration (#342 )" (#346 ) This reverts commit `19f9494492`.	2022-02-12 06:34:24 +00:00
Max Goedjen	adabe801d3	Update FAQ.md (#344 )	2022-02-07 01:01:09 +00:00
Max Goedjen	19f9494492	Remove 24h unlock duration (#342 )	2022-01-31 08:09:57 +00:00
Max Goedjen	c50d2feaf9	Add nightly build (#341 )	2022-01-31 07:58:23 +00:00
David Gunzinger	03d3cc9177	wait for new packets on the agent socket after the handler is invoked… (#267 ) * wait for new packets on the agent socket after the handler is invoked. this fixes https://github.com/maxgoedjen/secretive/issues/244 * handle closing of the socked * fix compile Co-authored-by: David Gunzinger <david.gunzinger@smoca.ch>	2022-01-31 07:53:02 +00:00
Max Goedjen	141cc03b60	Move presentation of setup view off of toolbar item, since it's not a popover anymore (#340 )	2022-01-31 07:44:09 +00:00
Andrew Glaze	07559bd7ef	Add setup instructions for GitKraken (#339 )	2022-01-27 03:19:15 +00:00
Max Goedjen	cb206a18c2	Switch (#334 )	2022-01-18 21:24:57 +00:00
Anthony Kosednar	6cb3ff80d9	Corrected FAQ link to Updater.swift source code (#326 )	2022-01-18 21:20:03 +00:00