Update CI + Concurrency Warnings (#564)

* Update test.yml

* Update nightly.yml

* Update release.yml

* Tweak concurrency settings

* Remove bad annotations

.github/workflows/add-to-project.yml

@@ -10,7 +10,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v0.0.3
+      - uses: actions/add-to-project@v1.0.1
         with:
           project-url: https://github.com/users/maxgoedjen/projects/1
           github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

.github/workflows/nightly.yml

@@ -5,10 +5,11 @@ on:
     - cron: "0 8 * * *"
 jobs:
   build:
-    runs-on: macOS-latest
+#     runs-on: macOS-latest
+    runs-on: macos-14
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -19,7 +20,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app
     - name: Update Build Number
       env:
         RUN_ID: ${{ github.run_id }}
@@ -47,7 +48,7 @@ jobs:
             shasum -a 256 Secretive.zip
             shasum -a 256 Archive.zip
     - name: Upload App to Artifacts
-      uses: actions/upload-artifact@v1
+      uses: actions/upload-artifact@v4
       with:
         name: Secretive.zip
         path: Secretive.zip

.github/workflows/release.yml

@@ -6,10 +6,11 @@ on:
       - '*'
 jobs:
   test:
-    runs-on: macOS-latest
+#     runs-on: macOS-latest
+    runs-on: macos-14
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v4
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -20,17 +21,18 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app
     - name: Test
       run: |
             pushd Sources/Packages
             swift test
             popd
   build:
-    runs-on: macOS-latest
+#     runs-on: macOS-latest
+    runs-on: macos-14
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Setup Signing
       env: 
         SIGNING_DATA: ${{ secrets.SIGNING_DATA }}
@@ -41,7 +43,7 @@ jobs:
         APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
       run: ./.github/scripts/signing.sh
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app
     - name: Update Build Number
       env:
         TAG_NAME: ${{ github.ref }}
@@ -105,12 +107,12 @@ jobs:
         asset_name: Secretive.zip
         asset_content_type: application/zip
     - name: Upload App to Artifacts
-      uses: actions/upload-artifact@v1
+      uses: actions/upload-artifact@v4
       with:
         name: Secretive.zip
         path: Secretive.zip
     - name: Upload Archive to Artifacts
-      uses: actions/upload-artifact@v1
+      uses: actions/upload-artifact@v4
       with:
         name: Xcode_Archive.zip
         path: Archive.zip

.github/workflows/test.yml

@@ -3,12 +3,13 @@ name: Test
 on: [push, pull_request]
 jobs:
   test:
-    runs-on: macOS-latest
+#     runs-on: macOS-latest
+    runs-on: macos-14
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
     - name: Set Environment
-      run: sudo xcrun xcode-select -s /Applications/Xcode_14.1.app
+      run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app
     - name: Test
       run: |
             pushd Sources/Packages

CONTRIBUTING.md

@@ -14,6 +14,10 @@ Secretive is designed to be easily auditable by people who are considering using
 
 All contributors must abide by the [Code of Conduct](CODE_OF_CONDUCT.md)
 
+## Localization
+
+If you'd like to contribute a translation, please see [Localizing](LOCALIZING.md) to get started.
+
 ## Credits
 
 If you make a material contribution to the app, please add yourself to the end of the [credits](https://github.com/maxgoedjen/secretive/blob/main/Secretive/Credits.rtf).

FAQ.md

@@ -32,6 +32,10 @@ Try running the "Setup Secretive" process by clicking on "Help", then "Setup Sec
 
 Beginning with Secretive 2.2, every secret has an automatically generated public key file representation on disk, and the path to it is listed under "Public Key Path" in Secretive. You can specify that you want to use that key in your `~/.ssh/config`.  [This ServerFault answer](https://serverfault.com/a/295771) has more details on setting that up.
 
+### How can I generate an RSA key?
+
+The Mac's Secure Enclave only supports 256-bit EC keys, so inherently Secretive cannot support generating RSA keys.
+
 ### Can I use Secretive for SSH Agent Forwarding?
 
 Yes, you can! Once you've set up Secretive, just add `ForwardAgent yes` to the hosts you want to forward to in your SSH config file. Afterwards, any use of one of your SSH keys on the remote host must be authenticated through Secretive.

LOCALIZING.md

@@ -0,0 +1,37 @@
+# Localizing Secretive
+
+If you speak another language, and would like to help translate Secretive to support that language, we'd love your help!
+
+## Getting Started
+
+### Download Xcode
+
+Download the latest version of Xcode (at minimum, Xcode 15) from [Apple](http://developer.apple.com/download/applications/).
+
+### Clone Secretive
+
+Clone Secretive using [these instructions from GitHub](https://docs.github.com/en/repositories/creating-and-managing-repositories/cloning-a-repository).
+
+### Open Secretive
+
+Open [Sources/Secretive.xcodeproj](Sources/Secretive.xcodeproj) in Xcode.
+
+### Translate
+
+Navigate to [Secretive/Localizable](Sources/Secretive/Localizable.xcstrings). 
+
+<img src="/.github/readme/localize_sidebar.png" alt="Screenshot of Xcode navigating to the Localizable file" width="300">
+
+If your language already has an in-progress localization, select it from the list. If it isn't there, hit the "+" button and choose your language from the list.
+
+<img src="/.github/readme/localize_add.png" alt="Screenshot of Xcode adding a new language" width="600">
+
+Start translating! You'll see a list of english phrases, and a space to add a translation of your language.
+
+### Create a Pull Request
+
+Push your changes and open a pull request. 
+
+### Questions
+
+Please open an issue if you have a question about translating the app. I'm more than happy to clarify any terms that are ambiguous or confusing. Thanks for contributing!

README.md

@@ -3,7 +3,10 @@
 
 Secretive is an app for storing and managing SSH keys in the Secure Enclave. It is inspired by the [sekey project](https://github.com/sekey/sekey), but rewritten in Swift with no external dependencies and with a handy native management app.
 
-<img src="/.github/readme/app.png" alt="Screenshot of Secretive" width="600">
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="/.github/readme/app-dark.png">
+  <img src="/.github/readme/app-light.png" alt="Screenshot of Secretive" width="600">
+</picture>
 
 
 ## Why?
@@ -14,7 +17,7 @@ The most common setup for SSH keys is just keeping them on disk, guarded by prop
 
 ### Access Control
 
-If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your key so that they require Touch ID (or Watch) authentication before they're accessed.
+If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your keys so that they require Touch ID (or Watch) authentication before they're accessed.
 
 <img src="/.github/readme/touchid.png" alt="Screenshot of Secretive authenticating with Touch ID" width="400">
 

Sources/Packages/Package.swift

@@ -1,4 +1,4 @@
-// swift-tools-version:5.5
+// swift-tools-version:5.9
 // The swift-tools-version declares the minimum version of Swift required to build this package.
 
 import PackageDescription
@@ -6,7 +6,7 @@ import PackageDescription
 let package = Package(
     name: "SecretivePackages",
     platforms: [
-        .macOS(.v11)
+        .macOS(.v12)
     ],
     products: [
         .library(
@@ -33,23 +33,28 @@ let package = Package(
     targets: [
         .target(
             name: "SecretKit",
-            dependencies: []
+            dependencies: [],
+            swiftSettings: [.unsafeFlags(["-warnings-as-errors"])]
         ),
         .testTarget(
             name: "SecretKitTests",
-            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"]
+            dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"],
+            swiftSettings: [.unsafeFlags(["-warnings-as-errors"])]
         ),
         .target(
             name: "SecureEnclaveSecretKit",
-            dependencies: ["SecretKit"]
+            dependencies: ["SecretKit"],
+            swiftSettings: [.unsafeFlags(["-warnings-as-errors"])]
         ),
         .target(
             name: "SmartCardSecretKit",
-            dependencies: ["SecretKit"]
+            dependencies: ["SecretKit"],
+            swiftSettings: [.unsafeFlags(["-warnings-as-errors"])]
         ),
         .target(
             name: "SecretAgentKit",
-            dependencies: ["SecretKit", "SecretAgentKitHeaders"]
+            dependencies: ["SecretKit", "SecretAgentKitHeaders"],
+            swiftSettings: [.unsafeFlags(["-warnings-as-errors"])]
         ),
         .systemLibrary(
             name: "SecretAgentKitHeaders"

Sources/Packages/Sources/Brief/Updater.swift

@@ -2,7 +2,7 @@ import Foundation
 import Combine
 
 /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version.
-public class Updater: ObservableObject, UpdaterProtocol {
+public final class Updater: ObservableObject, UpdaterProtocol {
 
     @Published public var update: Release?
     public let testBuild: Bool

Sources/Packages/Sources/Brief/UpdaterProtocol.swift

@@ -1,4 +1,5 @@
 import Foundation
+import Combine
 
 /// A protocol for retreiving the latest available version of an app.
 public protocol UpdaterProtocol: ObservableObject {

Sources/Packages/Sources/SecretAgentKit/Agent.swift

@@ -5,14 +5,14 @@ import SecretKit
 import AppKit
 
 /// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores.
-public class Agent {
+public final class Agent {
 
     private let storeList: SecretStoreList
     private let witness: SigningWitness?
     private let writer = OpenSSHKeyWriter()
     private let requestTracer = SigningRequestTracer()
     private let certificateHandler = OpenSSHCertificateHandler()
-    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent.agent", category: "")
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "Agent")
 
     /// Initializes an agent with a store list and a witness.
     /// - Parameters:
@@ -35,7 +35,7 @@ extension Agent {
     ///   - writer: A ``FileHandleWriter`` to write the response to.
     /// - Return value: 
     ///   - Boolean if data could be read
-    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) -> Bool {
+    @discardableResult public func handle(reader: FileHandleReader, writer: FileHandleWriter) async -> Bool {
         logger.debug("Agent handling new data")
         let data = Data(reader.availableData)
         guard data.count > 4 else { return false}
@@ -47,12 +47,12 @@ extension Agent {
         }
         logger.debug("Agent handling request of type \(requestType.debugDescription)")
         let subData = Data(data[5...])
-        let response = handle(requestType: requestType, data: subData, reader: reader)
+        let response = await handle(requestType: requestType, data: subData, reader: reader)
         writer.write(response)
         return true
     }
 
-    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) -> Data {
+    func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) async -> Data {
         // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting
         reloadSecretsIfNeccessary()
         var response = Data()
@@ -86,27 +86,24 @@ extension Agent {
     func identities() -> Data {
         let secrets = storeList.allSecrets
         certificateHandler.reloadCertificates(for: secrets)
-        var count = UInt32(secrets.count).bigEndian
-        let countData = Data(bytes: &count, count: UInt32.bitWidth/8)
+        var count = secrets.count
         var keyData = Data()
 
         for secret in secrets {
-            let keyBlob: Data
-            let curveData: Data
-            
-            if let (certificateData, name) = try? certificateHandler.keyBlobAndName(for: secret) {
-                keyBlob = certificateData
-                curveData = name
-            } else {
-                keyBlob = writer.data(secret: secret)
-                curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
-            }
-            
+            let keyBlob = writer.data(secret: secret)
+            let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)!
             keyData.append(writer.lengthAndData(of: keyBlob))
             keyData.append(writer.lengthAndData(of: curveData))
             
+            if let (certificateData, name) = try? certificateHandler.keyBlobAndName(for: secret) {
+                keyData.append(writer.lengthAndData(of: certificateData))
+                keyData.append(writer.lengthAndData(of: name))
+                count += 1
+            }
         }
-        logger.log("Agent enumerated \(secrets.count) identities")
+        logger.log("Agent enumerated \(count) identities")
+        var countBigEndian = UInt32(count).bigEndian
+        let countData = Data(bytes: &countBigEndian, count: UInt32.bitWidth/8)
         return countData + keyData
     }
 

Sources/Packages/Sources/SecretAgentKit/FileHandleProtocols.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// Protocol abstraction of the reading aspects of FileHandle.
-public protocol FileHandleReader {
+public protocol FileHandleReader: Sendable {
 
     /// Gets data that is available for reading.
     var availableData: Data { get }
@@ -13,7 +13,7 @@ public protocol FileHandleReader {
 }
 
 /// Protocol abstraction of the writing aspects of FileHandle.
-public protocol FileHandleWriter {
+public protocol FileHandleWriter: Sendable {
 
     /// Writes data to the handle.
     func write(_ data: Data)

Sources/Packages/Sources/SecretAgentKit/Sendability.swift

@@ -0,0 +1,11 @@
+import Foundation
+
+struct UncheckedSendable<T>: @unchecked Sendable {
+
+    let value: T
+
+    init(_ value: T) {
+        self.value = value
+    }
+
+}

Sources/Packages/Sources/SecretAgentKit/SigningRequestTracer.swift

@@ -60,7 +60,10 @@ extension SigningRequestTracer {
     func iconURL(for pid: Int32) -> URL? {
         do {
             if let app = NSRunningApplication(processIdentifier: pid), let icon = app.icon?.tiffRepresentation {
-                let temporaryURL = URL(fileURLWithPath: (NSTemporaryDirectory() as NSString).appendingPathComponent("\(UUID().uuidString).png"))
+                let temporaryURL = URL(fileURLWithPath: (NSTemporaryDirectory() as NSString).appendingPathComponent("\(app.bundleIdentifier ?? UUID().uuidString).png"))
+                if FileManager.default.fileExists(atPath: temporaryURL.path) {
+                    return temporaryURL
+                }
                 let bitmap = NSBitmapImageRep(data: icon)
                 try bitmap?.representation(using: .png, properties: [:])?.write(to: temporaryURL)
                 return temporaryURL

Sources/Packages/Sources/SecretAgentKit/SocketController.swift

@@ -2,7 +2,7 @@ import Foundation
 import OSLog
 
 /// A controller that manages socket configuration and request dispatching.
-public class SocketController {
+public final class SocketController {
 
     /// The active FileHandle.
     private var fileHandle: FileHandle?
@@ -10,22 +10,24 @@ public class SocketController {
     private var port: SocketPort?
     /// A handler that will be notified when a new read/write handle is available.
     /// False if no data could be read
-    public var handler: ((FileHandleReader, FileHandleWriter) -> Bool)?
+    public var handler: (@Sendable (FileHandleReader, FileHandleWriter) async -> Bool)?
+    /// Logger.
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "SocketController")
 
 
     /// Initializes a socket controller with a specified path.
     /// - Parameter path: The path to use as a socket.
     public init(path: String) {
-        Logger().debug("Socket controller setting up at \(path)")
+        logger.debug("Socket controller setting up at \(path)")
         if let _ = try? FileManager.default.removeItem(atPath: path) {
-            Logger().debug("Socket controller removed existing socket")
+            logger.debug("Socket controller removed existing socket")
         }
         let exists = FileManager.default.fileExists(atPath: path)
         assert(!exists)
-        Logger().debug("Socket controller path is clear")
+        logger.debug("Socket controller path is clear")
         port = socketPort(at: path)
         configureSocket(at: path)
-        Logger().debug("Socket listening at \(path)")
+        logger.debug("Socket listening at \(path)")
     }
 
     /// Configures the socket and a corresponding FileHandle.
@@ -35,7 +37,7 @@ public class SocketController {
         fileHandle = FileHandle(fileDescriptor: port.socket, closeOnDealloc: true)
         NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionAccept(notification:)), name: .NSFileHandleConnectionAccepted, object: nil)
         NotificationCenter.default.addObserver(self, selector: #selector(handleConnectionDataAvailable(notification:)), name: .NSFileHandleDataAvailable, object: nil)
-        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
+        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.Mode.common])
     }
 
     /// Creates a SocketPort for a path.
@@ -65,25 +67,45 @@ public class SocketController {
     /// Handles a new connection being accepted, invokes the handler, and prepares to accept new connections.
     /// - Parameter notification: A `Notification` that triggered the call.
     @objc func handleConnectionAccept(notification: Notification) {
-        Logger().debug("Socket controller accepted connection")
+        logger.debug("Socket controller accepted connection")
         guard let new = notification.userInfo?[NSFileHandleNotificationFileHandleItem] as? FileHandle else { return }
-        _ = handler?(new, new)
-        new.waitForDataInBackgroundAndNotify()
-        fileHandle?.acceptConnectionInBackgroundAndNotify(forModes: [RunLoop.current.currentMode!])
+        Task { [handler, fileHandle] in
+            _ = await handler?(new, new)
+            await new.waitForDataInBackgroundAndNotifyOnMainActor()
+            await fileHandle?.acceptConnectionInBackgroundAndNotifyOnMainActor()
+        }
     }
 
     /// Handles a new connection providing data and invokes the handler callback.
     /// - Parameter notification: A `Notification` that triggered the call.
     @objc func handleConnectionDataAvailable(notification: Notification) {
-        Logger().debug("Socket controller has new data available")
+        logger.debug("Socket controller has new data available")
         guard let new = notification.object as? FileHandle else { return }
-        Logger().debug("Socket controller received new file handle")
-        if((handler?(new, new)) == true) {
-            Logger().debug("Socket controller handled data, wait for more data")
-            new.waitForDataInBackgroundAndNotify()
-        } else {
-            Logger().debug("Socket controller called with empty data, socked closed")
+        logger.debug("Socket controller received new file handle")
+        Task { [handler, logger = UncheckedSendable(logger)] in
+            if((await handler?(new, new)) == true) {
+                logger.value.debug("Socket controller handled data, wait for more data")
+                await new.waitForDataInBackgroundAndNotifyOnMainActor()
+            } else {
+                logger.value.debug("Socket controller called with empty data, socked closed")
+            }
         }
     }
 
 }
+
+extension FileHandle {
+    
+    /// Ensures waitForDataInBackgroundAndNotify will be called on the main actor.
+    @MainActor func waitForDataInBackgroundAndNotifyOnMainActor() {
+        waitForDataInBackgroundAndNotify()
+    }
+
+
+    /// Ensures acceptConnectionInBackgroundAndNotify will be called on the main actor.
+    /// - Parameter modes: the runloop modes to use.
+    @MainActor func acceptConnectionInBackgroundAndNotifyOnMainActor(forModes modes: [RunLoop.Mode]? = [RunLoop.Mode.common]) {
+        acceptConnectionInBackgroundAndNotify(forModes: modes)
+    }
+
+}

Sources/Packages/Sources/SecretKit/Documentation.docc/Documentation.md

@@ -32,3 +32,9 @@ SecretKit is a collection of protocols describing secrets and stores.
 ### Authentication Persistence
 
 - ``PersistedAuthenticationContext``
+
+### Errors
+
+- ``KeychainError``
+- ``SigningError``
+- ``SecurityError``

Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift

@@ -10,6 +10,7 @@ public class AnySecretStore: SecretStore {
     private let _name: () -> String
     private let _secrets: () -> [AnySecret]
     private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data
+    private let _verify: (Data, Data, AnySecret) throws -> Bool
     private let _existingPersistedAuthenticationContext: (AnySecret) -> PersistedAuthenticationContext?
     private let _persistAuthentication: (AnySecret, TimeInterval) throws -> Void
     private let _reloadSecrets: () -> Void
@@ -23,6 +24,7 @@ public class AnySecretStore: SecretStore {
         _id = { secretStore.id }
         _secrets = { secretStore.secrets.map { AnySecret($0) } }
         _sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) }
+        _verify = { try secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) }
         _existingPersistedAuthenticationContext = { secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) }
         _persistAuthentication = { try secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) }
         _reloadSecrets = { secretStore.reloadSecrets() }
@@ -51,6 +53,10 @@ public class AnySecretStore: SecretStore {
         try _sign(data, secret, provenance)
     }
 
+    public func verify(signature: Data, for data: Data, with secret: AnySecret) throws -> Bool {
+        try _verify(signature, data, secret)
+    }
+
     public func existingPersistedAuthenticationContext(secret: AnySecret) -> PersistedAuthenticationContext? {
         _existingPersistedAuthenticationContext(secret)
     }
@@ -65,7 +71,7 @@ public class AnySecretStore: SecretStore {
 
 }
 
-public class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable {
+public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable {
 
     private let _create: (String, Bool) throws -> Void
     private let _delete: (AnySecret) throws -> Void

Sources/Packages/Sources/SecretKit/KeychainTypes.swift

@@ -0,0 +1,71 @@
+import Foundation
+
+public typealias SecurityError = Unmanaged<CFError>
+
+/// Wraps a Swift dictionary in a CFDictionary.
+/// - Parameter dictionary: The Swift dictionary to wrap.
+/// - Returns: A CFDictionary containing the keys and values.
+public func KeychainDictionary(_ dictionary: [CFString: Any]) -> CFDictionary {
+    dictionary as CFDictionary
+}
+
+public extension CFError {
+
+    /// The CFError returned when a verification operation fails.
+    static let verifyError = CFErrorCreate(nil, NSOSStatusErrorDomain as CFErrorDomain, CFIndex(errSecVerifyFailed), nil)!
+
+    /// Equality operation that only considers domain and code.
+    static func ~=(lhs: CFError, rhs: CFError) -> Bool {
+        CFErrorGetDomain(lhs) == CFErrorGetDomain(rhs) && CFErrorGetCode(lhs) == CFErrorGetCode(rhs)
+    }
+
+}
+
+/// A wrapper around an error code reported by a Keychain API.
+public struct KeychainError: Error {
+    /// The status code involved, if one was reported.
+    public let statusCode: OSStatus?
+
+    /// Initializes a KeychainError with an optional error code.
+    /// - Parameter statusCode: The status code returned by the keychain operation, if one is applicable.
+    public init(statusCode: OSStatus?) {
+        self.statusCode = statusCode
+    }
+}
+
+/// A signing-related error.
+public struct SigningError: Error {
+    /// The underlying error reported by the API, if one was returned.
+    public let error: SecurityError?
+
+    /// Initializes a SigningError with an optional SecurityError.
+    /// - Parameter statusCode: The SecurityError, if one is applicable.
+    public init(error: SecurityError?) {
+        self.error = error
+    }
+
+}
+
+public extension SecretStore {
+
+    /// Returns the appropriate keychian signature algorithm to use for a given secret.
+    /// - Parameters:
+    ///   - secret: The secret which will be used for signing.
+    ///   - allowRSA: Whether or not RSA key types should be permited.
+    /// - Returns: The appropriate algorithm.
+    func signatureAlgorithm(for secret: SecretType, allowRSA: Bool = false) -> SecKeyAlgorithm {
+        switch (secret.algorithm, secret.keySize) {
+        case (.ellipticCurve, 256):
+            return .ecdsaSignatureMessageX962SHA256
+        case (.ellipticCurve, 384):
+            return .ecdsaSignatureMessageX962SHA384
+        case (.rsa, 1024), (.rsa, 2048):
+            guard allowRSA else { fatalError() }
+            return .rsaSignatureMessagePKCS1v15SHA512
+        default:
+            fatalError()
+        }
+
+    }
+
+}

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift

@@ -2,10 +2,10 @@ import Foundation
 import OSLog
 
 /// Manages storage and lookup for OpenSSH certificates.
-public class OpenSSHCertificateHandler {
+public final class OpenSSHCertificateHandler {
 
     private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory())
-    private let logger = Logger()
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler")
     private let writer = OpenSSHKeyWriter()
     private var keyBlobsAndNames: [AnySecret: (Data, Data)] = [:]
 

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift

@@ -64,6 +64,10 @@ extension OpenSSHKeyWriter {
         switch algorithm {
         case .ellipticCurve:
             return "ecdsa-sha2-nistp" + String(describing: length)
+        case .rsa:
+            // All RSA keys use the same 512 bit hash function, per
+            // https://security.stackexchange.com/questions/255074/why-are-rsa-sha2-512-and-rsa-sha2-256-supported-but-not-reported-by-ssh-q-key
+            return "rsa-sha2-512"
         }
     }
 
@@ -76,6 +80,9 @@ extension OpenSSHKeyWriter {
         switch algorithm {
         case .ellipticCurve:
             return "nistp" + String(describing: length)
+        case .rsa:
+            // All RSA keys use the same 512 bit hash function
+            return "rsa-sha2-512"
         }
     }
 

Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHReader.swift

@@ -1,7 +1,7 @@
 import Foundation
 
 /// Reads OpenSSH protocol data.
-public class OpenSSHReader {
+public final class OpenSSHReader {
 
     var remaining: Data
 

Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift

@@ -2,9 +2,9 @@ import Foundation
 import OSLog
 
 /// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts.
-public class PublicKeyFileStoreController {
+public final class PublicKeyFileStoreController {
 
-    private let logger = Logger()
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController")
     private let directory: String
     private let keyWriter = OpenSSHKeyWriter()
 
@@ -20,8 +20,10 @@ public class PublicKeyFileStoreController {
         logger.log("Writing public keys to disk")
         if clear {
             let validPaths = Set(secrets.map { publicKeyPath(for: $0) }).union(Set(secrets.map { sshCertificatePath(for: $0) }))
-            let untracked = Set(try FileManager.default.contentsOfDirectory(atPath: directory)
-                .map { "\(directory)/\($0)" })
+            let contentsOfDirectory = (try? FileManager.default.contentsOfDirectory(atPath: directory)) ?? []
+            let fullPathContents = contentsOfDirectory.map { "\(directory)/\($0)" }
+
+            let untracked = Set(fullPathContents)
                 .subtracting(validPaths)
             for path in untracked {
                 try? FileManager.default.removeItem(at: URL(fileURLWithPath: path))

Sources/Packages/Sources/SecretKit/SecretStoreList.swift

@@ -2,7 +2,7 @@ import Foundation
 import Combine
 
 /// A "Store Store," which holds a list of type-erased stores.
-public class SecretStoreList: ObservableObject {
+public final class SecretStoreList: ObservableObject {
 
     /// The Stores managed by the SecretStoreList.
     @Published public var stores: [AnySecretStore] = []

Sources/Packages/Sources/SecretKit/Types/Secret.swift

@@ -20,6 +20,7 @@ public protocol Secret: Identifiable, Hashable {
 public enum Algorithm: Hashable {
 
     case ellipticCurve
+    case rsa
 
     /// Initializes the Algorithm with a secAttr representation of an algorithm.
     /// - Parameter secAttr: the secAttr, represented as an NSNumber.
@@ -28,8 +29,19 @@ public enum Algorithm: Hashable {
         switch secAttrString {
         case kSecAttrKeyTypeEC:
             self = .ellipticCurve
+        case kSecAttrKeyTypeRSA:
+            self = .rsa
         default:
             fatalError()
         }
     }
+    
+    public var secAttrKeyType: CFString {
+        switch self {
+        case .ellipticCurve:
+            return kSecAttrKeyTypeEC
+        case .rsa:
+            return kSecAttrKeyTypeRSA
+        }
+    }
 }

Sources/Packages/Sources/SecretKit/Types/SecretStore.swift

@@ -23,6 +23,14 @@ public protocol SecretStore: ObservableObject, Identifiable {
     /// - Returns: The signed data.
     func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data
 
+    /// Verifies that a signature is valid over a specified payload.
+    /// - Parameters:
+    ///   - signature: The signature over the data.
+    ///   - data: The data to verify the signature of.
+    ///   - secret: The secret whose signature to verify.
+    /// - Returns: Whether the signature was verified.
+    func verify(signature: Data, for data: Data, with secret: SecretType) throws -> Bool
+
     /// Checks to see if there is currently a valid persisted authentication for a given secret.
     /// - Parameters:
     ///   - secret: The ``Secret`` to check if there is a persisted authentication for.

Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift

@@ -1,4 +1,5 @@
 import Foundation
+import Combine
 import Security
 import CryptoTokenKit
 import LocalAuthentication
@@ -7,7 +8,7 @@ import SecretKit
 extension SecureEnclave {
 
     /// An implementation of Store backed by the Secure Enclave.
-    public class Store: SecretStoreModifiable {
+    public final class Store: SecretStoreModifiable {
 
         public var isAvailable: Bool {
             // For some reason, as of build time, CryptoKit.SecureEnclave.isAvailable always returns false
@@ -16,15 +17,15 @@ extension SecureEnclave {
             TKTokenWatcher().tokenIDs.contains("com.apple.setoken")
         }
         public let id = UUID()
-        public let name = NSLocalizedString("Secure Enclave", comment: "Secure Enclave")
+        public let name = String(localized: "secure_enclave")
         @Published public private(set) var secrets: [Secret] = []
 
         private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:]
 
         /// Initializes a Store.
         public init() {
-            DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { _ in
-                self.reloadSecretsInternal(notifyAgent: false)
+            DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { [reload = reloadSecretsInternal(notifyAgent:)] _ in
+                reload(false)
             }
             loadSecrets()
         }
@@ -48,7 +49,7 @@ extension SecureEnclave {
                 throw error.takeRetainedValue() as Error
             }
 
-            let attributes = [
+            let attributes = KeychainDictionary([
                 kSecAttrLabel: name,
                 kSecAttrKeyType: Constants.keyType,
                 kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
@@ -57,7 +58,7 @@ extension SecureEnclave {
                     kSecAttrIsPermanent: true,
                     kSecAttrAccessControl: access
                 ]
-            ] as CFDictionary
+            ])
 
             var createKeyError: SecurityError?
             let keypair = SecKeyCreateRandomKey(attributes, &createKeyError)
@@ -72,10 +73,10 @@ extension SecureEnclave {
         }
 
         public func delete(secret: Secret) throws {
-            let deleteAttributes = [
+            let deleteAttributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrApplicationLabel: secret.id as CFData
-            ] as CFDictionary
+            ])
             let status = SecItemDelete(deleteAttributes)
             if status != errSecSuccess {
                 throw KeychainError(statusCode: status)
@@ -84,14 +85,14 @@ extension SecureEnclave {
         }
 
         public func update(secret: Secret, name: String) throws {
-            let updateQuery = [
+            let updateQuery = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrApplicationLabel: secret.id as CFData
-            ] as CFDictionary
+            ])
 
-            let updatedAttributes = [
+            let updatedAttributes = KeychainDictionary([
                 kSecAttrLabel: name,
-            ] as CFDictionary
+            ])
 
             let status = SecItemUpdate(updateQuery, updatedAttributes)
             if status != errSecSuccess {
@@ -100,17 +101,17 @@ extension SecureEnclave {
             reloadSecretsInternal()
         }
         
-        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
             let context: LAContext
             if let existing = persistedAuthenticationContexts[secret], existing.valid {
                 context = existing.context
             } else {
                 let newContext = LAContext()
-                newContext.localizedCancelTitle = "Deny"
+                newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
                 context = newContext
             }
-            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
-            let attributes = [
+            context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
+            let attributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
                 kSecAttrApplicationLabel: secret.id as CFData,
@@ -119,7 +120,7 @@ extension SecureEnclave {
                 kSecAttrApplicationTag: Constants.keyTag,
                 kSecUseAuthenticationContext: context,
                 kSecReturnRef: true
-                ] as CFDictionary
+                ])
             var untyped: CFTypeRef?
             let status = SecItemCopyMatching(attributes, &untyped)
             if status != errSecSuccess {
@@ -137,6 +138,41 @@ extension SecureEnclave {
             return signature as Data
         }
 
+        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
+            let context = LAContext()
+            context.localizedReason = String(localized: "auth_context_request_verify_description_\(secret.name)")
+            context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+            let attributes = KeychainDictionary([
+                kSecClass: kSecClassKey,
+                kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+                kSecAttrApplicationLabel: secret.id as CFData,
+                kSecAttrKeyType: Constants.keyType,
+                kSecAttrTokenID: kSecAttrTokenIDSecureEnclave,
+                kSecAttrApplicationTag: Constants.keyTag,
+                kSecUseAuthenticationContext: context,
+                kSecReturnRef: true
+                ])
+            var verifyError: SecurityError?
+            var untyped: CFTypeRef?
+            let status = SecItemCopyMatching(attributes, &untyped)
+            if status != errSecSuccess {
+                throw KeychainError(statusCode: status)
+            }
+            guard let untypedSafe = untyped else {
+                throw KeychainError(statusCode: errSecSuccess)
+            }
+            let key = untypedSafe as! SecKey
+            let verified = SecKeyVerifySignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, signature as CFData, &verifyError)
+            if !verified, let verifyError {
+                if verifyError.takeUnretainedValue() ~= .verifyError {
+                    return false
+                } else {
+                    throw SigningError(error: verifyError)
+                }
+            }
+            return verified
+        }
+
         public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
             guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil }
             return persisted
@@ -145,16 +181,16 @@ extension SecureEnclave {
         public func persistAuthentication(secret: Secret, forDuration duration: TimeInterval) throws {
             let newContext = LAContext()
             newContext.touchIDAuthenticationAllowableReuseDuration = duration
-            newContext.localizedCancelTitle = "Deny"
+            newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
 
             let formatter = DateComponentsFormatter()
             formatter.unitsStyle = .spellOut
             formatter.allowedUnits = [.hour, .minute, .day]
 
             if let durationString = formatter.string(from: duration) {
-                newContext.localizedReason = "unlock secret \"\(secret.name)\" for \(durationString)"
+                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_\(secret.name)_\(durationString)")
             } else {
-                newContext.localizedReason = "unlock secret \"\(secret.name)\""
+                newContext.localizedReason = String(localized: "auth_context_persist_for_duration_unknown_\(secret.name)")
             }
             newContext.evaluatePolicy(LAPolicy.deviceOwnerAuthentication, localizedReason: newContext.localizedReason) { [weak self] success, _ in
                 guard success else { return }
@@ -189,7 +225,7 @@ extension SecureEnclave.Store {
 
     /// Loads all secrets from the store.
     private func loadSecrets() {
-        let publicAttributes = [
+        let publicAttributes = KeychainDictionary([
             kSecClass: kSecClassKey,
             kSecAttrKeyType: SecureEnclave.Constants.keyType,
             kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
@@ -197,11 +233,11 @@ extension SecureEnclave.Store {
             kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
-            ] as CFDictionary
+            ])
         var publicUntyped: CFTypeRef?
         SecItemCopyMatching(publicAttributes, &publicUntyped)
         guard let publicTyped = publicUntyped as? [[CFString: Any]] else { return }
-        let privateAttributes = [
+        let privateAttributes = KeychainDictionary([
             kSecClass: kSecClassKey,
             kSecAttrKeyType: SecureEnclave.Constants.keyType,
             kSecAttrApplicationTag: SecureEnclave.Constants.keyTag,
@@ -209,7 +245,7 @@ extension SecureEnclave.Store {
             kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
-            ] as CFDictionary
+            ])
         var privateUntyped: CFTypeRef?
         SecItemCopyMatching(privateAttributes, &privateUntyped)
         guard let privateTyped = privateUntyped as? [[CFString: Any]] else { return }
@@ -224,7 +260,7 @@ extension SecureEnclave.Store {
                                             nil)!
 
         let wrapped: [SecureEnclave.Secret] = publicTyped.map {
-            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
+            let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
             let id = $0[kSecAttrApplicationLabel] as! Data
             let publicKeyRef = $0[kSecValueRef] as! SecKey
             let publicKeyAttributes = SecKeyCopyAttributes(publicKeyRef) as! [CFString: Any]
@@ -247,7 +283,7 @@ extension SecureEnclave.Store {
     ///   - publicKey: The public key to save.
     ///   - name: A user-facing name for the key.
     private func savePublicKey(_ publicKey: SecKey, name: String) throws {
-        let attributes = [
+        let attributes = KeychainDictionary([
             kSecClass: kSecClassKey,
             kSecAttrKeyType: SecureEnclave.Constants.keyType,
             kSecAttrKeyClass: kSecAttrKeyClassPublic,
@@ -256,37 +292,15 @@ extension SecureEnclave.Store {
             kSecAttrIsPermanent: true,
             kSecReturnData: true,
             kSecAttrLabel: name
-            ] as CFDictionary
+            ])
         let status = SecItemAdd(attributes, nil)
         if status != errSecSuccess {
-            throw SecureEnclave.KeychainError(statusCode: status)
+            throw KeychainError(statusCode: status)
         }
     }
 
 }
 
-extension SecureEnclave {
-
-    /// A wrapper around an error code reported by a Keychain API.
-    public struct KeychainError: Error {
-        /// The status code involved, if one was reported.
-        public let statusCode: OSStatus?
-    }
-
-    /// A signing-related error.
-    public struct SigningError: Error {
-        /// The underlying error reported by the API, if one was returned.
-        public let error: SecurityError?
-    }
-
-}
-
-extension SecureEnclave {
-
-    public typealias SecurityError = Unmanaged<CFError>
-
-}
-
 extension SecureEnclave {
 
     enum Constants {

Sources/Packages/Sources/SmartCardSecretKit/Documentation.docc/SmartCard.md

@@ -6,9 +6,3 @@
 
 - ``Secret``
 - ``Store``
-
-### Errors
-
-- ``KeychainError``
-- ``SigningError``
-- ``SecurityError``

Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift

@@ -1,4 +1,5 @@
 import Foundation
+import Combine
 import Security
 import CryptoTokenKit
 import LocalAuthentication
@@ -7,11 +8,11 @@ import SecretKit
 extension SmartCard {
 
     /// An implementation of Store backed by a Smart Card.
-    public class Store: SecretStore {
+    public final class Store: SecretStore {
 
         @Published public var isAvailable: Bool = false
         public let id = UUID()
-        public private(set) var name = NSLocalizedString("Smart Card", comment: "Smart Card")
+        public private(set) var name = String(localized: "smart_card")
         @Published public private(set) var secrets: [Secret] = []
         private let watcher = TKTokenWatcher()
         private var tokenID: String?
@@ -19,12 +20,14 @@ extension SmartCard {
         /// Initializes a Store.
         public init() {
             tokenID = watcher.nonSecureEnclaveTokens.first
-            watcher.setInsertionHandler { string in
+            watcher.setInsertionHandler { [reload = reloadSecretsInternal] string in
                 guard self.tokenID == nil else { return }
                 guard !string.contains("setoken") else { return }
 
                 self.tokenID = string
-                self.reloadSecrets()
+                DispatchQueue.main.async {
+                    reload()
+                }
                 self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string)
             }
             if let tokenID = tokenID {
@@ -44,19 +47,19 @@ extension SmartCard {
             fatalError("Keys must be deleted on the smart card.")
         }
 
-        public func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data {
+        public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data {
             guard let tokenID = tokenID else { fatalError() }
             let context = LAContext()
-            context.localizedReason = "sign a request from \"\(provenance.origin.displayName)\" using secret \"\(secret.name)\""
-            context.localizedCancelTitle = "Deny"
-            let attributes = [
+            context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)")
+            context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+            let attributes = KeychainDictionary([
                 kSecClass: kSecClassKey,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate,
                 kSecAttrApplicationLabel: secret.id as CFData,
                 kSecAttrTokenID: tokenID,
                 kSecUseAuthenticationContext: context,
                 kSecReturnRef: true
-            ] as CFDictionary
+            ])
             var untyped: CFTypeRef?
             let status = SecItemCopyMatching(attributes, &untyped)
             if status != errSecSuccess {
@@ -67,39 +70,45 @@ extension SmartCard {
             }
             let key = untypedSafe as! SecKey
             var signError: SecurityError?
-            let signatureAlgorithm: SecKeyAlgorithm
-            switch (secret.algorithm, secret.keySize) {
-            case (.ellipticCurve, 256):
-                signatureAlgorithm = .ecdsaSignatureMessageX962SHA256
-            case (.ellipticCurve, 384):
-                signatureAlgorithm = .ecdsaSignatureMessageX962SHA384
-            default:
-                fatalError()
-            }
-            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm, data as CFData, &signError) else {
+            guard let signature = SecKeyCreateSignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, &signError) else {
                 throw SigningError(error: signError)
             }
             return signature as Data
         }
+        
+        public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool {
+            let attributes = KeychainDictionary([
+                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
+                kSecAttrKeySizeInBits: secret.keySize,
+                kSecAttrKeyClass: kSecAttrKeyClassPublic
+            ])
+            var verifyError: SecurityError?
+            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
+            guard let untypedSafe = untyped else {
+                throw KeychainError(statusCode: errSecSuccess)
+            }
+            let key = untypedSafe as! SecKey
+            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret, allowRSA: true), data as CFData, signature as CFData, &verifyError)
+            if !verified, let verifyError {
+                if verifyError.takeUnretainedValue() ~= .verifyError {
+                    return false
+                } else {
+                    throw SigningError(error: verifyError)
+                }
+            }
+            return verified
+        }
 
-        public func existingPersistedAuthenticationContext(secret: SmartCard.Secret) -> PersistedAuthenticationContext? {
+        public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? {
             nil
         }
 
-        public func persistAuthentication(secret: SmartCard.Secret, forDuration: TimeInterval) throws {
+        public func persistAuthentication(secret: Secret, forDuration: TimeInterval) throws {
         }
 
         /// Reloads all secrets from the store.
         public func reloadSecrets() {
-            DispatchQueue.main.async {
-                self.isAvailable = self.tokenID != nil
-                let before = self.secrets
-                self.secrets.removeAll()
-                self.loadSecrets()
-                if self.secrets != before {
-                    NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
-                }
-            }
+            reloadSecretsInternal()
         }
 
     }
@@ -108,6 +117,16 @@ extension SmartCard {
 
 extension SmartCard.Store {
 
+    private func reloadSecretsInternal() {
+        self.isAvailable = self.tokenID != nil
+        let before = self.secrets
+        self.secrets.removeAll()
+        self.loadSecrets()
+        if self.secrets != before {
+            NotificationCenter.default.post(name: .secretStoreReloaded, object: self)
+        }
+    }
+
     /// Resets the token ID and reloads secrets.
     /// - Parameter tokenID: The ID of the token that was removed.
     private func smartcardRemoved(for tokenID: String? = nil) {
@@ -119,36 +138,25 @@ extension SmartCard.Store {
     private func loadSecrets() {
         guard let tokenID = tokenID else { return }
 
-        let fallbackName = NSLocalizedString("Smart Card", comment: "Smart Card")
-        if #available(macOS 12.0, *) {
-            if let driverName = watcher.tokenInfo(forTokenID: tokenID)?.driverName {
-                name = driverName
-            } else {
-                name = fallbackName
-            }
+        let fallbackName = String(localized: "smart_card")
+        if let driverName = watcher.tokenInfo(forTokenID: tokenID)?.driverName {
+            name = driverName
         } else {
-            // Hack to read name if there's only one smart card
-            let slotNames = TKSmartCardSlotManager().slotNames
-            if watcher.nonSecureEnclaveTokens.count == 1 && slotNames.count == 1 {
-                name = slotNames.first!
-            } else {
-                name = fallbackName
-            }
+            name = fallbackName
         }
 
-        let attributes = [
+        let attributes = KeychainDictionary([
             kSecClass: kSecClassKey,
             kSecAttrTokenID: tokenID,
-            kSecAttrKeyType: kSecAttrKeyTypeEC, // Restrict to EC
             kSecReturnRef: true,
             kSecMatchLimit: kSecMatchLimitAll,
             kSecReturnAttributes: true
-        ] as CFDictionary
+        ])
         var untyped: CFTypeRef?
         SecItemCopyMatching(attributes, &untyped)
         guard let typed = untyped as? [[CFString: Any]] else { return }
-        let wrapped: [SmartCard.Secret] = typed.map {
-            let name = $0[kSecAttrLabel] as? String ?? "Unnamed"
+        let wrapped = typed.map {
+            let name = $0[kSecAttrLabel] as? String ?? String(localized: "unnamed_secret")
             let tokenID = $0[kSecAttrApplicationLabel] as! Data
             let algorithm = Algorithm(secAttr: $0[kSecAttrKeyType] as! NSNumber)
             let keySize = $0[kSecAttrKeySizeInBits] as! Int
@@ -163,6 +171,88 @@ extension SmartCard.Store {
 
 }
 
+
+// MARK: Smart Card specific encryption/decryption/verification
+extension SmartCard.Store {
+
+    /// Encrypts a payload with a specified key.
+    /// - Parameters:
+    ///   - data: The payload to encrypt.
+    ///   - secret: The secret to encrypt with.
+    /// - Returns: The encrypted data.
+    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
+    public func encrypt(data: Data, with secret: SecretType) throws -> Data {
+        let context = LAContext()
+        context.localizedReason = String(localized: "auth_context_request_encrypt_description_\(secret.name)")
+        context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+        let attributes = KeychainDictionary([
+            kSecAttrKeyType: secret.algorithm.secAttrKeyType,
+            kSecAttrKeySizeInBits: secret.keySize,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic,
+            kSecUseAuthenticationContext: context
+        ])
+        var encryptError: SecurityError?
+        let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &encryptError)
+        guard let untypedSafe = untyped else {
+            throw KeychainError(statusCode: errSecSuccess)
+        }
+        let key = untypedSafe as! SecKey
+        guard let signature = SecKeyCreateEncryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
+            throw SigningError(error: encryptError)
+        }
+        return signature as Data
+    }
+
+    /// Decrypts a payload with a specified key.
+    /// - Parameters:
+    ///   - data: The payload to decrypt.
+    ///   - secret: The secret to decrypt with.
+    /// - Returns: The decrypted data.
+    /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged.
+    public func decrypt(data: Data, with secret: SecretType) throws -> Data {
+        guard let tokenID = tokenID else { fatalError() }
+        let context = LAContext()
+        context.localizedReason = String(localized: "auth_context_request_decrypt_description_\(secret.name)")
+        context.localizedCancelTitle = String(localized: "auth_context_request_deny_button")
+        let attributes = KeychainDictionary([
+            kSecClass: kSecClassKey,
+            kSecAttrKeyClass: kSecAttrKeyClassPrivate,
+            kSecAttrApplicationLabel: secret.id as CFData,
+            kSecAttrTokenID: tokenID,
+            kSecUseAuthenticationContext: context,
+            kSecReturnRef: true
+        ])
+        var untyped: CFTypeRef?
+        let status = SecItemCopyMatching(attributes, &untyped)
+        if status != errSecSuccess {
+            throw KeychainError(statusCode: status)
+        }
+        guard let untypedSafe = untyped else {
+            throw KeychainError(statusCode: errSecSuccess)
+        }
+        let key = untypedSafe as! SecKey
+        var encryptError: SecurityError?
+        guard let signature = SecKeyCreateDecryptedData(key, encryptionAlgorithm(for: secret), data as CFData, &encryptError) else {
+            throw SigningError(error: encryptError)
+        }
+        return signature as Data
+    }
+
+    private func encryptionAlgorithm(for secret: SecretType) -> SecKeyAlgorithm {
+        switch (secret.algorithm, secret.keySize) {
+        case (.ellipticCurve, 256):
+            return .eciesEncryptionCofactorVariableIVX963SHA256AESGCM
+        case (.ellipticCurve, 384):
+            return .eciesEncryptionCofactorVariableIVX963SHA384AESGCM
+        case (.rsa, 1024), (.rsa, 2048):
+            return .rsaEncryptionOAEPSHA512AESGCM
+        default:
+            fatalError()
+        }
+    }
+
+}
+
 extension TKTokenWatcher {
 
     /// All available tokens, excluding the Secure Enclave.
@@ -171,25 +261,3 @@ extension TKTokenWatcher {
     }
 
 }
-
-extension SmartCard {
-
-    /// A wrapper around an error code reported by a Keychain API.
-    public struct KeychainError: Error {
-        /// The status code involved.
-        public let statusCode: OSStatus
-    }
-
-    /// A signing-related error.
-    public struct SigningError: Error {
-        /// The underlying error reported by the API, if one was returned.
-        public let error: SecurityError?
-    }
-
-}
-
-extension SmartCard {
-
-    public typealias SecurityError = Unmanaged<CFError>
-
-}

Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift

@@ -10,39 +10,39 @@ class AgentTests: XCTestCase {
 
     // MARK: Identity Listing
 
-    func testEmptyStores() {
+    func testEmptyStores() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
         let agent = Agent(storeList: SecretStoreList())
-        agent.handle(reader: stubReader, writer: stubWriter)
+        await agent.handle(reader: stubReader, writer: stubWriter)
         XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesEmpty)
     }
 
-    func testIdentitiesList() {
+    func testIdentitiesList() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        agent.handle(reader: stubReader, writer: stubWriter)
+        await agent.handle(reader: stubReader, writer: stubWriter)
         XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesMultiple)
     }
 
     // MARK: Signatures
 
-    func testNoMatchingIdentities() {
+    func testNoMatchingIdentities() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        agent.handle(reader: stubReader, writer: stubWriter)
+        await agent.handle(reader: stubReader, writer: stubWriter)
 //        XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
-    func testSignature() {
+    func testSignature() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...])
         _ = requestReader.readNextChunk()
         let dataToSign = requestReader.readNextChunk()
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let agent = Agent(storeList: list)
-        agent.handle(reader: stubReader, writer: stubWriter)
+        await agent.handle(reader: stubReader, writer: stubWriter)
         let outer = OpenSSHReader(data: stubWriter.data[5...])
         let payload = outer.readNextChunk()
         let inner = OpenSSHReader(data: payload)
@@ -61,24 +61,33 @@ class AgentTests: XCTestCase {
         var rs = r
         rs.append(s)
         let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs)
-        let valid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
-        XCTAssertTrue(valid)
+        let referenceValid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign)
+        let store = list.stores.first!
+        let derVerifies = try! store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
+        let invalidRandomSignature = try? store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret))
+        let invalidRandomData = try? store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret))
+        let invalidWrongKey = try? store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret))
+        XCTAssertTrue(referenceValid)
+        XCTAssertTrue(derVerifies)
+        XCTAssert(invalidRandomSignature == false)
+        XCTAssert(invalidRandomData == false)
+        XCTAssert(invalidWrongKey == false)
     }
 
     // MARK: Witness protocol
 
-    func testWitnessObjectionStopsRequest() {
+    func testWitnessObjectionStopsRequest() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
         let witness = StubWitness(speakNow: { _,_  in
             return true
         }, witness: { _, _ in })
         let agent = Agent(storeList: list, witness: witness)
-        agent.handle(reader: stubReader, writer: stubWriter)
+        await agent.handle(reader: stubReader, writer: stubWriter)
         XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
-    func testWitnessSignature() {
+    func testWitnessSignature() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
         var witnessed = false
@@ -88,11 +97,11 @@ class AgentTests: XCTestCase {
             witnessed = true
         })
         let agent = Agent(storeList: list, witness: witness)
-        agent.handle(reader: stubReader, writer: stubWriter)
+        await agent.handle(reader: stubReader, writer: stubWriter)
         XCTAssertTrue(witnessed)
     }
 
-    func testRequestTracing() {
+    func testRequestTracing() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret])
         var speakNowTrace: SigningRequestProvenance! = nil
@@ -104,7 +113,7 @@ class AgentTests: XCTestCase {
             witnessTrace = trace
         })
         let agent = Agent(storeList: list, witness: witness)
-        agent.handle(reader: stubReader, writer: stubWriter)
+        await agent.handle(reader: stubReader, writer: stubWriter)
         XCTAssertEqual(witnessTrace, speakNowTrace)
         XCTAssertEqual(witnessTrace.origin.displayName, "Finder")
         XCTAssertEqual(witnessTrace.origin.validSignature, true)
@@ -113,22 +122,22 @@ class AgentTests: XCTestCase {
 
     // MARK: Exception Handling
 
-    func testSignatureException() {
+    func testSignatureException() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature)
         let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret])
         let store = list.stores.first?.base as! Stub.Store
         store.shouldThrow = true
         let agent = Agent(storeList: list)
-        agent.handle(reader: stubReader, writer: stubWriter)
+        await agent.handle(reader: stubReader, writer: stubWriter)
         XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 
     // MARK: Unsupported
 
-    func testUnhandledAdd() {
+    func testUnhandledAdd() async {
         let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity)
         let agent = Agent(storeList: SecretStoreList())
-        agent.handle(reader: stubReader, writer: stubWriter)
+        await agent.handle(reader: stubReader, writer: stubWriter)
         XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure)
     }
 

Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift

@@ -6,7 +6,7 @@ struct Stub {}
 
 extension Stub {
 
-    public class Store: SecretStore {
+    public final class Store: SecretStore {
 
         public let isAvailable = true
         public let id = UUID()
@@ -27,7 +27,7 @@ extension Stub {
                                                 flags,
                                                 nil) as Any
 
-            let attributes = [
+            let attributes = KeychainDictionary([
                 kSecAttrLabel: name,
                 kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
                 kSecAttrKeySizeInBits: size,
@@ -35,11 +35,10 @@ extension Stub {
                     kSecAttrIsPermanent: true,
                     kSecAttrAccessControl: access
                 ]
-                ] as CFDictionary
+                ])
 
-            var privateKey: SecKey! = nil
-            var publicKey: SecKey! = nil
-            SecKeyGeneratePair(attributes, &publicKey, &privateKey)
+            let privateKey = SecKeyCreateRandomKey(attributes, nil)!
+            let publicKey = SecKeyCopyPublicKey(privateKey)!
             let publicAttributes = SecKeyCopyAttributes(publicKey) as! [CFString: Any]
             let privateAttributes = SecKeyCopyAttributes(privateKey) as! [CFString: Any]
             let publicData = (publicAttributes[kSecValueData] as! Data)
@@ -53,22 +52,36 @@ extension Stub {
             guard !shouldThrow else {
                 throw NSError(domain: "test", code: 0, userInfo: nil)
             }
-            let privateKey = SecKeyCreateWithData(secret.privateKey as CFData, [
+            let privateKey = SecKeyCreateWithData(secret.privateKey as CFData, KeychainDictionary([
                 kSecAttrKeyType: kSecAttrKeyTypeECSECPrimeRandom,
                 kSecAttrKeySizeInBits: secret.keySize,
                 kSecAttrKeyClass: kSecAttrKeyClassPrivate
-                ] as CFDictionary
+                ])
                 , nil)!
-            let signatureAlgorithm: SecKeyAlgorithm
-            switch secret.keySize {
-            case 256:
-                signatureAlgorithm = .ecdsaSignatureMessageX962SHA256
-            case 384:
-                signatureAlgorithm = .ecdsaSignatureMessageX962SHA384
-            default:
-                fatalError()
+            return SecKeyCreateSignature(privateKey, signatureAlgorithm(for: secret), data as CFData, nil)! as Data
+        }
+
+        public func verify(signature: Data, for data: Data, with secret: Stub.Secret) throws -> Bool {
+            let attributes = KeychainDictionary([
+                kSecAttrKeyType: secret.algorithm.secAttrKeyType,
+                kSecAttrKeySizeInBits: secret.keySize,
+                kSecAttrKeyClass: kSecAttrKeyClassPublic
+            ])
+            var verifyError: Unmanaged<CFError>?
+            let untyped: CFTypeRef? = SecKeyCreateWithData(secret.publicKey as CFData, attributes, &verifyError)
+            guard let untypedSafe = untyped else {
+                throw NSError(domain: "test", code: 0, userInfo: nil)
             }
-            return SecKeyCreateSignature(privateKey, signatureAlgorithm, data as CFData, nil)! as Data
+            let key = untypedSafe as! SecKey
+            let verified = SecKeyVerifySignature(key, signatureAlgorithm(for: secret), data as CFData, signature as CFData, &verifyError)
+            if let verifyError {
+                if verifyError.takeUnretainedValue() ~= .verifyError {
+                    return false
+                } else {
+                    throw NSError(domain: "test", code: 0, userInfo: nil)
+                }
+            }
+            return verified
         }
 
         public func existingPersistedAuthenticationContext(secret: Stub.Secret) -> PersistedAuthenticationContext? {

Sources/SecretAgent/AppDelegate.swift

@@ -27,9 +27,10 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         return SocketController(path: path)
     }()
     private var updateSink: AnyCancellable?
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "AppDelegate")
 
     func applicationDidFinishLaunching(_ aNotification: Notification) {
-        Logger().debug("SecretAgent finished launching")
+        logger.debug("SecretAgent finished launching")
         DispatchQueue.main.async {
             self.socketController.handler = self.agent.handle(reader:writer:)
         }

Sources/SecretAgent/Notifier.swift

@@ -10,8 +10,8 @@ class Notifier {
     private let notificationDelegate = NotificationDelegate()
 
     init() {
-        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: "Update", options: [])
-        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: "Ignore", options: [])
+        let updateAction = UNNotificationAction(identifier: Constants.updateActionIdentitifier, title: String(localized: "update_notification_update_button"), options: [])
+        let ignoreAction = UNNotificationAction(identifier: Constants.ignoreActionIdentitifier, title: String(localized: "update_notification_ignore_button"), options: [])
         let updateCategory = UNNotificationCategory(identifier: Constants.updateCategoryIdentitifier, actions: [updateAction, ignoreAction], intentIdentifiers: [], options: [])
         let criticalUpdateCategory = UNNotificationCategory(identifier: Constants.criticalUpdateCategoryIdentitifier, actions: [updateAction], intentIdentifiers: [], options: [])
 
@@ -22,7 +22,7 @@ class Notifier {
             Measurement(value: 24, unit: UnitDuration.hours)
         ]
 
-        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: "Do Not Unlock", options: [])
+        let doNotPersistAction = UNNotificationAction(identifier: Constants.doNotPersistActionIdentitifier, title: String(localized: "persist_authentication_decline_button"), options: [])
         var allPersistenceActions = [doNotPersistAction]
 
         let formatter = DateComponentsFormatter()
@@ -40,7 +40,7 @@ class Notifier {
 
         let persistAuthenticationCategory = UNNotificationCategory(identifier: Constants.persistAuthenticationCategoryIdentitifier, actions: allPersistenceActions, intentIdentifiers: [], options: [])
         if persistAuthenticationCategory.responds(to: Selector(("actionsMenuTitle"))) {
-            persistAuthenticationCategory.setValue("Leave Unlocked", forKey: "_actionsMenuTitle")
+            persistAuthenticationCategory.setValue(String(localized: "persist_authentication_accept_button"), forKey: "_actionsMenuTitle")
         }
         UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory])
         UNUserNotificationCenter.current().delegate = notificationDelegate
@@ -62,13 +62,11 @@ class Notifier {
         notificationDelegate.pendingPersistableStores[store.id.description] = store
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
-        notificationContent.title = "Signed Request from \(provenance.origin.displayName)"
-        notificationContent.subtitle = "Using secret \"\(secret.name)\""
+        notificationContent.title = String(localized: "signed_notification_title_\(provenance.origin.displayName)")
+        notificationContent.subtitle = String(localized: "signed_notification_description_\(secret.name)")
         notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description
         notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description
-        if #available(macOS 12.0, *) {
-            notificationContent.interruptionLevel = .timeSensitive
-        }
+        notificationContent.interruptionLevel = .timeSensitive
         if secret.requiresAuthentication && store.existingPersistedAuthenticationContext(secret: secret) == nil {
             notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier
         }
@@ -85,14 +83,12 @@ class Notifier {
         let notificationCenter = UNUserNotificationCenter.current()
         let notificationContent = UNMutableNotificationContent()
         if update.critical {
-            if #available(macOS 12.0, *) {
-                notificationContent.interruptionLevel = .critical
-            }
-            notificationContent.title = "Critical Security Update - \(update.name)"
+            notificationContent.interruptionLevel = .critical
+            notificationContent.title = String(localized: "update_notification_update_critical_title_\(update.name)")
         } else {
-            notificationContent.title = "Update Available - \(update.name)"
+            notificationContent.title = String(localized: "update_notification_update_normal_title_\(update.name)")
         }
-        notificationContent.subtitle = "Click to Update"
+        notificationContent.subtitle = String(localized: "update_notification_update_description")
         notificationContent.body = update.body
         notificationContent.categoryIdentifier = update.critical ? Constants.criticalUpdateCategoryIdentitifier : Constants.updateCategoryIdentitifier
         let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil)

Sources/Secretive.xcodeproj/project.pbxproj

@@ -3,7 +3,7 @@
 	archiveVersion = 1;
 	classes = {
 	};
-	objectVersion = 52;
+	objectVersion = 54;
 	objects = {
 
 /* Begin PBXBuildFile section */
@@ -18,6 +18,7 @@
 		5003EF612780081600DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF602780081600DF2006 /* SmartCardSecretKit */; };
 		5003EF632780081B00DF2006 /* SecureEnclaveSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF622780081B00DF2006 /* SecureEnclaveSecretKit */; };
 		5003EF652780081B00DF2006 /* SmartCardSecretKit in Frameworks */ = {isa = PBXBuildFile; productRef = 5003EF642780081B00DF2006 /* SmartCardSecretKit */; };
+		500B93C32B478D8400E157DE /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 500B93C22B478D8400E157DE /* Localizable.xcstrings */; };
 		501421622781262300BBAA70 /* Brief in Frameworks */ = {isa = PBXBuildFile; productRef = 501421612781262300BBAA70 /* Brief */; };
 		501421652781268000BBAA70 /* SecretAgent.app in CopyFiles */ = {isa = PBXBuildFile; fileRef = 50A3B78A24026B7500D209EA /* SecretAgent.app */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		50153E20250AFCB200525160 /* UpdateView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50153E1F250AFCB200525160 /* UpdateView.swift */; };
@@ -51,6 +52,7 @@
 		50B8550D24138C4F009958AC /* DeleteSecretView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50B8550C24138C4F009958AC /* DeleteSecretView.swift */; };
 		50BB046B2418AAAE00D6E079 /* EmptyStoreView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50BB046A2418AAAE00D6E079 /* EmptyStoreView.swift */; };
 		50C385A52407A76D00AF2719 /* SecretDetailView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50C385A42407A76D00AF2719 /* SecretDetailView.swift */; };
+		50E9CF422B51D596004AB36D /* Localizable.xcstrings in Resources */ = {isa = PBXBuildFile; fileRef = 500B93C22B478D8400E157DE /* Localizable.xcstrings */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -108,6 +110,7 @@
 		50020BAF24064869003D4025 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
 		50033AC227813F1700253856 /* BundleIDs.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = BundleIDs.swift; sourceTree = "<group>"; };
 		5003EF39278005C800DF2006 /* Packages */ = {isa = PBXFileReference; lastKnownFileType = wrapper; path = Packages; sourceTree = "<group>"; };
+		500B93C22B478D8400E157DE /* Localizable.xcstrings */ = {isa = PBXFileReference; lastKnownFileType = text.json.xcstrings; path = Localizable.xcstrings; sourceTree = "<group>"; };
 		50153E1F250AFCB200525160 /* UpdateView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = UpdateView.swift; sourceTree = "<group>"; };
 		50153E21250DECA300525160 /* SecretListItemView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretListItemView.swift; sourceTree = "<group>"; };
 		5018F54E24064786002EB505 /* Notifier.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = Notifier.swift; sourceTree = "<group>"; };
@@ -228,6 +231,7 @@
 				508BF28D25B4F005009EFB7E /* InternetAccessPolicy.plist */,
 				50617D8F23FCE48E0099B055 /* Secretive.entitlements */,
 				506772C62424784600034DED /* Credits.rtf */,
+				500B93C22B478D8400E157DE /* Localizable.xcstrings */,
 				50617D8823FCE48E0099B055 /* Preview Content */,
 			);
 			path = Secretive;
@@ -425,6 +429,13 @@
 			knownRegions = (
 				en,
 				Base,
+				it,
+				fr,
+				de,
+				"pt-BR",
+				fi,
+				ko,
+				ca,
 			);
 			mainGroup = 50617D7623FCE48D0099B055;
 			productRefGroup = 50617D8023FCE48E0099B055 /* Products */;
@@ -444,6 +455,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */,
+				500B93C32B478D8400E157DE /* Localizable.xcstrings in Resources */,
 				50617D8723FCE48E0099B055 /* Assets.xcassets in Resources */,
 				506772C72424784600034DED /* Credits.rtf in Resources */,
 				508BF28E25B4F005009EFB7E /* InternetAccessPolicy.plist in Resources */,
@@ -462,6 +474,7 @@
 			buildActionMask = 2147483647;
 			files = (
 				50A3B79724026B7600D209EA /* Main.storyboard in Resources */,
+				50E9CF422B51D596004AB36D /* Localizable.xcstrings in Resources */,
 				50A3B79424026B7600D209EA /* Preview Assets.xcassets in Resources */,
 				50A3B79124026B7600D209EA /* Assets.xcassets in Resources */,
 				508BF2AA25B4F1CB009EFB7E /* InternetAccessPolicy.plist in Resources */,
@@ -601,11 +614,12 @@
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
-				OTHER_SWIFT_FLAGS = "-Xfrontend -warn-concurrency -Xfrontend -enable-actor-data-race-checks";
+				OTHER_SWIFT_FLAGS = "";
 				SDKROOT = macosx;
 				STRIP_INSTALLED_PRODUCT = NO;
 				STRIP_SWIFT_SYMBOLS = NO;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
+				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 			};
 			name = Debug;
@@ -659,11 +673,12 @@
 				MACOSX_DEPLOYMENT_TARGET = 11.0;
 				MTL_ENABLE_DEBUG_INFO = NO;
 				MTL_FAST_MATH = YES;
-				OTHER_SWIFT_FLAGS = "-Xfrontend -warn-concurrency -Xfrontend -enable-actor-data-race-checks";
+				OTHER_SWIFT_FLAGS = "";
 				SDKROOT = macosx;
 				STRIP_INSTALLED_PRODUCT = NO;
 				STRIP_SWIFT_SYMBOLS = NO;
 				SWIFT_COMPILATION_MODE = wholemodule;
+				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
 			};
 			name = Release;
@@ -687,6 +702,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -714,6 +730,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -820,11 +837,12 @@
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
-				OTHER_SWIFT_FLAGS = "-Xfrontend -warn-concurrency -Xfrontend -enable-actor-data-race-checks";
+				OTHER_SWIFT_FLAGS = "";
 				SDKROOT = macosx;
 				STRIP_INSTALLED_PRODUCT = NO;
 				STRIP_SWIFT_SYMBOLS = NO;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
+				SWIFT_EMIT_LOC_STRINGS = YES;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 			};
 			name = Test;
@@ -845,6 +863,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -888,6 +907,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -911,6 +931,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";
@@ -935,6 +956,7 @@
 					"$(inherited)",
 					"@executable_path/../Frameworks",
 				);
+				MACOSX_DEPLOYMENT_TARGET = 12.0;
 				MARKETING_VERSION = 1;
 				PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent;
 				PRODUCT_NAME = "$(TARGET_NAME)";

Sources/Secretive/App.swift

@@ -45,18 +45,18 @@ struct Secretive: App {
         }
         .commands {
             CommandGroup(after: CommandGroupPlacement.newItem) {
-                Button("New Secret") {
+                Button("app_menu_new_secret_button") {
                     showingCreation = true
                 }
                 .keyboardShortcut(KeyboardShortcut(KeyEquivalent("N"), modifiers: [.command, .shift]))
             }
             CommandGroup(replacing: .help) {
-                Button("Help") {
+                Button("app_menu_help_button") {
                     NSWorkspace.shared.open(Constants.helpURL)
                 }
             }
             CommandGroup(after: .help) {
-                Button("Setup Secretive") {
+                Button("app_menu_setup_button") {
                     showingSetup = true
                 }
             }

Sources/Secretive/Controllers/LaunchAgentController.swift

@@ -6,8 +6,10 @@ import SecretKit
 
 struct LaunchAgentController {
     
+    private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController")
+
     func install(completion: (() -> Void)? = nil) {
-        Logger().debug("Installing agent")
+        logger.debug("Installing agent")
         _ = setEnabled(false)
         // This is definitely a bit of a "seems to work better" thing but:
         // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old
@@ -20,7 +22,7 @@ struct LaunchAgentController {
     }
 
     func forceLaunch(completion: ((Bool) -> Void)?) {
-        Logger().debug("Agent is not running, attempting to force launch")
+        logger.debug("Agent is not running, attempting to force launch")
         let url = Bundle.main.bundleURL.appendingPathComponent("Contents/Library/LoginItems/SecretAgent.app")
         let config = NSWorkspace.OpenConfiguration()
         config.activates = false
@@ -29,9 +31,9 @@ struct LaunchAgentController {
                 completion?(error == nil)
             }
             if let error = error {
-                Logger().error("Error force launching \(error.localizedDescription)")
+                logger.error("Error force launching \(error.localizedDescription)")
             } else {
-                Logger().debug("Agent force launched")
+                logger.debug("Agent force launched")
             }
         }
     }

Sources/Secretive/Preview Content/PreviewStore.swift

@@ -40,6 +40,10 @@ extension Preview {
             return data
         }
 
+        func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool {
+            true
+        }
+
         func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? {
             nil
         }

Sources/Secretive/Views/ContentView.swift

@@ -64,15 +64,15 @@ extension ContentView {
         }
     }
 
-    var updateNoticeContent: (String, Color)? {
+    var updateNoticeContent: (LocalizedStringKey, Color)? {
         guard let update = updater.update else { return nil }
         if update.critical {
-            return ("Critical Security Update Required", .red)
+            return ("update_critical_notice_title", .red)
         } else {
             if updater.testBuild {
-                return ("Test Build", .blue)
+                return ("update_test_notice_title", .blue)
             } else {
-                return ("Update Available", .orange)
+                return ("update_normal_notice_title", .orange)
             }
         }
     }
@@ -88,7 +88,7 @@ extension ContentView {
                     .foregroundColor(.white)
             })
             .buttonStyle(ToolbarButtonStyle(color: color))
-            .popover(item: $selectedUpdate, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) { update in
+            .popover(item: $selectedUpdate, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) { update in
                 UpdateDetailView(update: update)
             }
         }
@@ -121,9 +121,9 @@ extension ContentView {
         }, label: {
             Group {
                 if hasRunSetup && !agentStatusChecker.running {
-                    Text("Secret Agent Is Not Running")
+                    Text("agent_not_running_notice_title")
                 } else {
-                    Text("Setup Secretive")
+                    Text("agent_setup_notice_title")
                 }
             }
             .font(.headline)
@@ -138,7 +138,7 @@ extension ContentView {
             showingAgentInfo = true
         }, label: {
             HStack {
-                Text("Agent is Running")
+                Text("agent_running_notice_title")
                     .font(.headline)
                     .foregroundColor(colorScheme == .light ? Color(white: 0.3) : .white)
                 Circle()
@@ -147,12 +147,12 @@ extension ContentView {
             }
         })
         .buttonStyle(ToolbarButtonStyle(lightColor: .black.opacity(0.05), darkColor: .white.opacity(0.05)))
-        .popover(isPresented: $showingAgentInfo, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
+        .popover(isPresented: $showingAgentInfo, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) {
             VStack {
-                Text("SecretAgent is Running")
+                Text("agent_running_notice_detail_title")
                     .font(.title)
                     .padding(5)
-                Text("SecretAgent is a process that runs in the background to sign requests, so you don't need to keep Secretive open all the time.\n\n**You can close Secretive, and everything will still keep working.**")
+                Text("agent_running_notice_detail_description")
                     .frame(width: 300)
             }
             .padding()
@@ -166,19 +166,19 @@ extension ContentView {
                 showingAppPathNotice = true
             }, label: {
                 Group {
-                    Text("Secretive Is Not in Applications Folder")
+                    Text("app_not_in_applications_notice_title")
                 }
                 .font(.headline)
                 .foregroundColor(.white)
             })
             .buttonStyle(ToolbarButtonStyle(color: .orange))
-            .popover(isPresented: $showingAppPathNotice, attachmentAnchor: .point(.bottom), arrowEdge: .bottom) {
+            .popover(isPresented: $showingAppPathNotice, attachmentAnchor: attachmentAnchor, arrowEdge: .bottom) {
                 VStack {
                     Image(systemName: "exclamationmark.triangle")
                         .resizable()
                         .aspectRatio(contentMode: .fit)
                         .frame(width: 64)
-                    Text("Secretive needs to be in your Applications folder to work properly. Please move it and relaunch.")
+                    Text("app_not_in_applications_notice_detail_description")
                         .frame(maxWidth: 300)
                 }
                 .padding()
@@ -186,6 +186,11 @@ extension ContentView {
         }
     }
 
+    var attachmentAnchor: PopoverAttachmentAnchor {
+        // Ideally .point(.bottom), but broken on Sonoma (FB12726503)
+        .rect(.bounds)
+    }
+
 }
 
 #if DEBUG

Sources/Secretive/Views/CopyableView.swift

@@ -3,7 +3,7 @@ import UniformTypeIdentifiers
 
 struct CopyableView: View {
 
-    var title: String
+    var title: LocalizedStringKey
     var image: Image
     var text: String
 
@@ -66,12 +66,12 @@ struct CopyableView: View {
         )
     }
 
-    var hoverText: String {
+    var hoverText: LocalizedStringKey {
         switch interactionState {
         case .hovering:
-            return "Click to Copy"
+            return "copyable_click_to_copy_button"
         case .clicking:
-            return "Copied"
+            return "copyable_copied"
         case .normal:
             fatalError()
         }
@@ -122,9 +122,9 @@ struct CopyableView: View {
 struct CopyableView_Previews: PreviewProvider {
     static var previews: some View {
         Group {
-            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Hello world.")
+            CopyableView(title: "secret_detail_sha256_fingerprint_label", image: Image(systemName: "figure.wave"), text: "Hello world.")
                 .padding()
-            CopyableView(title: "Title", image: Image(systemName: "figure.wave"), text: "Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. ")
+            CopyableView(title: "secret_detail_sha256_fingerprint_label", image: Image(systemName: "figure.wave"), text: "Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. Long text. ")
                 .padding()
         }
     }

Sources/Secretive/Views/CreateSecretView.swift

@@ -14,43 +14,30 @@ struct CreateSecretView<StoreType: SecretStoreModifiable>: View {
             HStack {
                 VStack {
                     HStack {
-                        Text("Create a New Secret")
+                        Text("create_secret_title")
                             .font(.largeTitle)
                         Spacer()
                     }
                     HStack {
-                        Text("Name:")
-                        TextField("Shhhhh", text: $name)
+                        Text("create_secret_name_label")
+                        TextField("create_secret_name_placeholder", text: $name)
                             .focusable()
                     }
-                    if #available(macOS 12.0, *) {
-                        ThumbnailPickerView(items: [
-                            ThumbnailPickerView.Item(value: true, name: "Require Authentication", description: "You will be required to authenticate using Touch ID, Apple Watch, or password before each use.", thumbnail: AuthenticationView()),
-                            ThumbnailPickerView.Item(value: false, name: "Notify",
-                                                     description: "No authentication is required while your Mac is unlocked, but you will be notified when a secret is used.",
-                                                     thumbnail: NotificationView())
-                        ], selection: $requiresAuthentication)
-                    } else {
-                        HStack {
-                            VStack(spacing: 20) {
-                                Picker("", selection: $requiresAuthentication) {
-                                    Text("Requires Authentication (Biometrics or Password) before each use").tag(true)
-                                    Text("Authentication not required when Mac is unlocked").tag(false)
-                                }
-                                .pickerStyle(RadioGroupPickerStyle())
-                                Spacer(minLength: 10)
-                            }
-                        }
-                    }
+                    ThumbnailPickerView(items: [
+                        ThumbnailPickerView.Item(value: true, name: "create_secret_require_authentication_title", description: "create_secret_require_authentication_description", thumbnail: AuthenticationView()),
+                        ThumbnailPickerView.Item(value: false, name: "create_secret_notify_title",
+                                                 description: "create_secret_notify_description",
+                                                 thumbnail: NotificationView())
+                    ], selection: $requiresAuthentication)
                 }
             }
             HStack {
                 Spacer()
-                Button("Cancel") {
+                Button("create_secret_cancel_button") {
                     showing = false
                 }
                 .keyboardShortcut(.cancelAction)
-                Button("Create", action: save)
+                Button("create_secret_create_button", action: save)
                     .disabled(name.isEmpty)
                     .keyboardShortcut(.defaultAction)
             }
@@ -109,11 +96,11 @@ extension ThumbnailPickerView {
     struct Item<ValueType: Hashable>: Identifiable {
         let id = UUID()
         let value: ValueType
-        let name: String
-        let description: String
+        let name: LocalizedStringKey
+        let description: LocalizedStringKey
         let thumbnail: AnyView
 
-        init<ViewType: View>(value: ValueType, name: String, description: String, thumbnail: ViewType) {
+        init<ViewType: View>(value: ValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) {
             self.value = value
             self.name = name
             self.description = description
@@ -138,7 +125,6 @@ extension ThumbnailPickerView {
 
 }
 
-@available(macOS 12.0, *)
 struct SystemBackgroundView: View {
 
     let anchor: UnitPoint
@@ -157,7 +143,6 @@ struct SystemBackgroundView: View {
     }
 }
 
-@available(macOS 12.0, *)
 struct AuthenticationView: View {
 
     var body: some View {
@@ -169,15 +154,15 @@ struct AuthenticationView: View {
                         .resizable()
                         .aspectRatio(contentMode: .fit)
                         .foregroundColor(Color(.systemRed))
-                    Text("Touch ID Prompt")
+                    Text(verbatim: "Touch ID Prompt")
                         .font(.headline)
                         .foregroundColor(.primary)
                         .redacted(reason: .placeholder)
                     VStack {
-                        Text("Touch ID Detail prompt.Detail two.")
+                        Text(verbatim: "Touch ID Detail prompt.Detail two.")
                             .font(.caption2)
                             .foregroundColor(.primary)
-                        Text("Touch ID Detail prompt.Detail two.")
+                        Text(verbatim: "Touch ID Detail prompt.Detail two.")
                             .font(.caption2)
                             .foregroundColor(.primary)
                     }
@@ -203,7 +188,6 @@ struct AuthenticationView: View {
 
 }
 
-@available(macOS 12.0, *)
 struct NotificationView: View {
 
     var body: some View {
@@ -223,10 +207,10 @@ struct NotificationView: View {
                                 .frame(width: 64, height: 64)
                                 .foregroundColor(.primary)
                             VStack(alignment: .leading) {
-                                Text("Secretive")
+                                Text(verbatim: "Secretive")
                                     .font(.title)
                                     .foregroundColor(.primary)
-                                Text("Secretive wants to sign")
+                                Text(verbatim: "Secretive wants to sign")
                                     .font(.body)
                                     .foregroundColor(.primary)
                             }
@@ -253,14 +237,10 @@ struct CreateSecretView_Previews: PreviewProvider {
     static var previews: some View {
         Group {
             CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true))
-            if #available(macOS 12.0, *) {
                 AuthenticationView().environment(\.colorScheme, .dark)
                 AuthenticationView().environment(\.colorScheme, .light)
                 NotificationView().environment(\.colorScheme, .dark)
                 NotificationView().environment(\.colorScheme, .light)
-            } else {
-                // Fallback on earlier versions
-            }
         }
     }
 }

Sources/Secretive/Views/DeleteSecretView.swift

@@ -18,24 +18,24 @@ struct DeleteSecretView<StoreType: SecretStoreModifiable>: View {
                     .padding()
                 VStack {
                     HStack {
-                        Text("Delete \(secret.name)?").bold()
+                        Text("delete_confirmation_title_\(secret.name)").bold()
                         Spacer()
                     }
                     HStack {
-                        Text("If you delete \(secret.name), you will not be able to recover it. Type \"\(secret.name)\" to confirm.")
+                        Text("delete_confirmation_description_\(secret.name)_\(secret.name)")
                         Spacer()
                     }
                     HStack {
-                        Text("Confirm Name:")
+                        Text("delete_confirmation_confirm_name_label")
                         TextField(secret.name, text: $confirm)
                     }
                 }
             }
             HStack {
                 Spacer()
-                Button("Delete", action: delete)
+                Button("delete_confirmation_delete_button", action: delete)
                     .disabled(confirm != secret.name)
-                Button("Don't Delete") {
+                Button("delete_confirmation_cancel_button") {
                     dismissalBlock(false)
                 }
                 .keyboardShortcut(.cancelAction)

Sources/Secretive/Views/EmptyStoreView.swift

@@ -9,11 +9,11 @@ struct EmptyStoreView: View {
     var body: some View {
         if store is AnySecretStoreModifiable {
             NavigationLink(destination: EmptyStoreModifiableView(), tag: Constants.emptyStoreModifiableTag, selection: $activeSecret) {
-                Text("No Secrets")
+                Text("empty_store_modifiable_title")
             }
         } else {
             NavigationLink(destination: EmptyStoreImmutableView(), tag: Constants.emptyStoreTag, selection: $activeSecret) {
-                Text("No Secrets")
+                Text("empty_store_nonmodifiable_title")
             }
         }
     }
@@ -23,7 +23,7 @@ extension EmptyStoreView {
     
     enum Constants {
         static let emptyStoreModifiableTag: AnyHashable = "emptyStoreModifiableTag"
-        static let emptyStoreTag: AnyHashable = "emptyStoreModifiableTag"
+        static let emptyStoreTag: AnyHashable = "emptyStoreTag"
     }
 
 }
@@ -32,9 +32,9 @@ struct EmptyStoreImmutableView: View {
     
     var body: some View {
         VStack {
-            Text("No Secrets").bold()
-            Text("Use your Smart Card's management tool to create a secret.")
-            Text("Secretive only supports Elliptic Curve keys.")
+            Text("empty_store_nonmodifiable_title").bold()
+            Text("empty_store_nonmodifiable_description")
+            Text("empty_store_nonmodifiable_supported_key_types")
         }.frame(maxWidth: .infinity, maxHeight: .infinity)
     }
     
@@ -63,8 +63,8 @@ struct EmptyStoreModifiableView: View {
                         path.addLine(to: CGPoint(x: g.size.width - 3, y: 0))
                     }.fill()
                 }.frame(height: (windowGeometry.size.height/2) - 20).padding()
-                Text("No Secrets").bold()
-                Text("Create a new one by clicking here.")
+                Text("empty_store_modifiable_click_here_title").bold()
+                Text("empty_store_modifiable_click_here_description")
                 Spacer()
             }.frame(maxWidth: .infinity, maxHeight: .infinity)
         }

Sources/Secretive/Views/NoStoresView.swift

@@ -4,9 +4,10 @@ struct NoStoresView: View {
 
     var body: some View {
         VStack {
-            Text("No Secure Storage Available").bold()
-            Text("Your Mac doesn't have a Secure Enclave, and there's not a compatible Smart Card inserted.")
-            Link("If you're looking to add one to your Mac, the YubiKey 5 Series are great.", destination: URL(string: "https://www.yubico.com/products/compare-yubikey-5-series/")!)
+            Text("no_secure_storage_title")
+                .bold()
+            Text("no_secure_storage_description")
+            Link("no_secure_storage_yubico_link", destination: URL(string: "https://www.yubico.com/products/compare-yubikey-5-series/")!)
         }.padding()
     }
     

Sources/Secretive/Views/RenameSecretView.swift

@@ -18,7 +18,7 @@ struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
                     .padding()
                 VStack {
                     HStack {
-                        Text("Type your new name for \"\(secret.name)\" below.")
+                        Text("rename_title_\(secret.name)")
                         Spacer()
                     }
                     HStack {
@@ -28,10 +28,10 @@ struct RenameSecretView<StoreType: SecretStoreModifiable>: View {
             }
             HStack {
                 Spacer()
-                Button("Rename", action: rename)
+                Button("rename_rename_button", action: rename)
                     .disabled(newName.count == 0)
                     .keyboardShortcut(.return)
-                Button("Cancel") {
+                Button("rename_cancel_button") {
                     dismissalBlock(false)
                 }.keyboardShortcut(.cancelAction)
             }

Sources/Secretive/Views/SecretDetailView.swift

@@ -12,16 +12,16 @@ struct SecretDetailView<SecretType: Secret>: View {
         ScrollView {
             Form {
                 Section {
-                    CopyableView(title: "SHA256 Fingerprint", image: Image(systemName: "touchid"), text: keyWriter.openSSHSHA256Fingerprint(secret: secret))
+                    CopyableView(title: "secret_detail_sha256_fingerprint_label", image: Image(systemName: "touchid"), text: keyWriter.openSSHSHA256Fingerprint(secret: secret))
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(title: "MD5 Fingerprint", image: Image(systemName: "touchid"), text: keyWriter.openSSHMD5Fingerprint(secret: secret))
+                    CopyableView(title: "secret_detail_md5_fingerprint_label", image: Image(systemName: "touchid"), text: keyWriter.openSSHMD5Fingerprint(secret: secret))
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(title: "Public Key", image: Image(systemName: "key"), text: keyString)
+                    CopyableView(title: "secret_detail_public_key_label", image: Image(systemName: "key"), text: keyString)
                     Spacer()
                         .frame(height: 20)
-                    CopyableView(title: "Public Key Path", image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret))
+                    CopyableView(title: "secret_detail_public_key_path_label", image: Image(systemName: "lock.doc"), text: publicKeyFileStoreController.publicKeyPath(for: secret))
                     Spacer()
                 }
             }

Sources/Secretive/Views/SecretListItemView.swift

@@ -33,10 +33,10 @@ struct SecretListItemView: View {
         .contextMenu {
             if store is AnySecretStoreModifiable {
                 Button(action: { isRenaming = true }) {
-                    Text("Rename")
+                    Text("secret_list_rename_button")
                 }
                 Button(action: { isDeleting = true }) {
-                    Text("Delete")
+                    Text("secret_list_delete_button")
                 }
             }
         }

Sources/Secretive/Views/SetupView.swift

@@ -26,7 +26,7 @@ struct SetupView: View {
                 }
             }
         }
-        .frame(idealWidth: 500, idealHeight: 500)
+        .frame(minWidth: 500, idealWidth: 500, minHeight: 500, idealHeight: 500)
     }
 
 
@@ -61,7 +61,7 @@ struct StepView: View {
                             Circle()
                                 .foregroundColor(.green)
                                 .frame(width: Constants.circleWidth, height: Constants.circleWidth)
-                            Text("✓")
+                            Text("setup_step_complete_symbol")
                                 .foregroundColor(.white)
                                 .bold()
                         } else {
@@ -101,14 +101,14 @@ extension StepView {
 
 struct SetupStepView<Content> : View where Content : View {
 
-    let title: String
+    let title: LocalizedStringKey
     let image: Image
-    let bodyText: String
-    let buttonTitle: String
+    let bodyText: LocalizedStringKey
+    let buttonTitle: LocalizedStringKey
     let buttonAction: () -> Void
     let content: Content
 
-    init(title: String, image: Image, bodyText: String, buttonTitle: String, buttonAction: @escaping () -> Void = {}, @ViewBuilder content: () -> Content) {
+    init(title: LocalizedStringKey, image: Image, bodyText: LocalizedStringKey, buttonTitle: LocalizedStringKey, buttonAction: @escaping () -> Void = {}, @ViewBuilder content: () -> Content) {
         self.title = title
         self.image = image
         self.bodyText = bodyText
@@ -145,12 +145,12 @@ struct SecretAgentSetupView: View {
     let buttonAction: () -> Void
 
     var body: some View {
-        SetupStepView(title: "Setup Secret Agent",
+        SetupStepView(title: "setup_agent_title",
                       image: Image(nsImage: NSApplication.shared.applicationIconImage),
-                      bodyText: "Secretive needs to set up a helper app to work properly. It will sign requests from SSH clients in the background, so you don't need to keep the main Secretive app open.",
-                      buttonTitle: "Install",
+                      bodyText: "setup_agent_description",
+                      buttonTitle: "setup_agent_install_button",
                       buttonAction: install) {
-            (Text("This helper app is called ") + Text("Secret Agent").bold().underline() + Text(" and you may see it in Activity Manager from time to time."))
+            Text("setup_agent_activity_monitor_description")
                 .multilineTextAlignment(.center)
         }
     }
@@ -170,12 +170,12 @@ struct SSHAgentSetupView: View {
     @State private var selectedShellInstruction: ShellConfigInstruction = controller.shellInstructions.first!
 
     var body: some View {
-        SetupStepView(title: "Configure your SSH Agent",
+        SetupStepView(title: "setup_ssh_title",
                       image: Image(systemName: "terminal"),
-                      bodyText: "Add this line to your shell config telling SSH to talk to Secret Agent when it wants to authenticate. Secretive can either do this for you automatically, or you can copy and paste this into your config file.",
-                      buttonTitle: "I Added it Manually",
+                      bodyText: "setup_ssh_description",
+                      buttonTitle: "setup_ssh_added_manually_button",
                       buttonAction: buttonAction) {
-        Link("If you're trying to set up a third party app, check out the FAQ.", destination: URL(string: "https://github.com/maxgoedjen/secretive/blob/main/APP_CONFIG.md")!)
+        Link("setup_third_party_faq_link", destination: URL(string: "https://github.com/maxgoedjen/secretive/blob/main/APP_CONFIG.md")!)
             Picker(selection: $selectedShellInstruction, label: EmptyView()) {
                 ForEach(SSHAgentSetupView.controller.shellInstructions) { instruction in
                     Text(instruction.shell)
@@ -183,8 +183,8 @@ struct SSHAgentSetupView: View {
                         .padding()
                 }
             }.pickerStyle(SegmentedPickerStyle())
-            CopyableView(title: "Add to \(selectedShellInstruction.shellConfigPath)", image: Image(systemName: "greaterthan.square"), text: selectedShellInstruction.text)
-            Button("Add it For Me") {
+            CopyableView(title: "setup_ssh_add_to_config_button_\(selectedShellInstruction.shellConfigPath)", image: Image(systemName: "greaterthan.square"), text: selectedShellInstruction.text)
+            Button("setup_ssh_add_for_me_button") {
                 let controller = ShellConfigurationController()
                 if controller.addToShell(shellInstructions: selectedShellInstruction) {
                     buttonAction()
@@ -214,12 +214,12 @@ struct UpdaterExplainerView: View {
     let buttonAction: () -> Void
 
     var body: some View {
-        SetupStepView(title: "Updates",
+        SetupStepView(title: "setup_updates_title",
                       image: Image(systemName: "dot.radiowaves.left.and.right"),
-                      bodyText: "Secretive will periodically check with GitHub to see if there's a new release. If you see any network requests to GitHub, that's why.",
-                      buttonTitle: "Okay",
+                      bodyText: "setup_updates_description",
+                      buttonTitle: "setup_updates_ok",
                       buttonAction: buttonAction) {
-            Link("Read more about this here.", destination: SetupView.Constants.updaterFAQURL)
+            Link("setup_updates_readmore", destination: SetupView.Constants.updaterFAQURL)
         }
     }
 

Sources/Secretive/Views/UpdateView.swift

@@ -9,20 +9,20 @@ struct UpdateDetailView<UpdaterType: Updater>: View {
 
     var body: some View {
         VStack {
-            Text("Secretive \(update.name)").font(.title)
-            GroupBox(label: Text("Release Notes")) {
+            Text("update_version_name_\(update.name)").font(.title)
+            GroupBox(label: Text("update_release_notes_title")) {
                 ScrollView {
                     attributedBody
                 }
             }
             HStack {
                 if !update.critical {
-                    Button("Ignore") {
+                    Button("update_ignore_button") {
                         updater.ignore(release: update)
                     }
                     Spacer()
                 }
-                Button("Update") {
+                Button("update_update_button") {
                     NSWorkspace.shared.open(update.html_url)
                 }
                 .keyboardShortcut(.defaultAction)
@@ -34,24 +34,24 @@ struct UpdateDetailView<UpdaterType: Updater>: View {
     }
 
     var attributedBody: Text {
-        var text = Text("")
+        var text = Text(verbatim: "")
         for line in update.body.split(whereSeparator: \.isNewline) {
             let attributed: Text
             let split = line.split(separator: " ")
-            let unprefixed = split.dropFirst().joined()
+            let unprefixed = split.dropFirst().joined(separator: " ")
             if let prefix = split.first {
                 switch prefix {
                 case "#":
-                    attributed = Text(unprefixed).font(.title) + Text("\n")
+                    attributed = Text(unprefixed).font(.title) + Text(verbatim: "\n")
                 case "##":
-                    attributed = Text(unprefixed).font(.title2) + Text("\n")
+                    attributed = Text(unprefixed).font(.title2) + Text(verbatim: "\n")
                 case "###":
-                    attributed = Text(unprefixed).font(.title3) + Text("\n")
+                    attributed = Text(unprefixed).font(.title3) + Text(verbatim: "\n")
                 default:
-                    attributed = Text(line) + Text("\n\n")
+                    attributed = Text(line) + Text(verbatim: "\n\n")
                 }
             } else {
-                attributed = Text(line) + Text("\n\n")
+                attributed = Text(line) + Text(verbatim: "\n\n")
             }
             text = text + attributed
         }