From 8ea8f0510c82b8606d05facb24e8801c609f765e Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Wed, 25 Dec 2024 11:59:24 -0500 Subject: [PATCH 01/12] Enable language mode --- Sources/Packages/Package.swift | 19 +++++++++++++------ Sources/Secretive.xcodeproj/project.pbxproj | 12 +++--------- 2 files changed, 16 insertions(+), 15 deletions(-) diff --git a/Sources/Packages/Package.swift b/Sources/Packages/Package.swift index 9fa196a0..4c382272 100644 --- a/Sources/Packages/Package.swift +++ b/Sources/Packages/Package.swift @@ -1,4 +1,4 @@ -// swift-tools-version:5.9 +// swift-tools-version:6.0 // The swift-tools-version declares the minimum version of Swift required to build this package. import PackageDescription @@ -34,27 +34,27 @@ let package = Package( .target( name: "SecretKit", dependencies: [], - swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] + swiftSettings: swiftSettings ), .testTarget( name: "SecretKitTests", dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"], - swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] + swiftSettings: swiftSettings ), .target( name: "SecureEnclaveSecretKit", dependencies: ["SecretKit"], - swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] + swiftSettings: swiftSettings ), .target( name: "SmartCardSecretKit", dependencies: ["SecretKit"], - swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] + swiftSettings: swiftSettings ), .target( name: "SecretAgentKit", dependencies: ["SecretKit", "SecretAgentKitHeaders"], - swiftSettings: [.unsafeFlags(["-warnings-as-errors"])] + swiftSettings: swiftSettings ), .systemLibrary( name: "SecretAgentKitHeaders" @@ -73,3 +73,10 @@ let package = Package( ), ] ) + +var swiftSettings: [PackageDescription.SwiftSetting] { + [ + .swiftLanguageMode(.v6), + .unsafeFlags(["-warnings-as-errors"]) + ] +} diff --git a/Sources/Secretive.xcodeproj/project.pbxproj b/Sources/Secretive.xcodeproj/project.pbxproj index 1edd651f..72a1b3af 100644 --- a/Sources/Secretive.xcodeproj/project.pbxproj +++ b/Sources/Secretive.xcodeproj/project.pbxproj @@ -621,6 +621,7 @@ SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG; SWIFT_EMIT_LOC_STRINGS = YES; SWIFT_OPTIMIZATION_LEVEL = "-Onone"; + SWIFT_VERSION = 6.0; }; name = Debug; }; @@ -680,6 +681,7 @@ SWIFT_COMPILATION_MODE = wholemodule; SWIFT_EMIT_LOC_STRINGS = YES; SWIFT_OPTIMIZATION_LEVEL = "-O"; + SWIFT_VERSION = 6.0; }; name = Release; }; @@ -707,7 +709,6 @@ PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host; PRODUCT_NAME = "$(TARGET_NAME)"; PROVISIONING_PROFILE_SPECIFIER = ""; - SWIFT_VERSION = 5.0; }; name = Debug; }; @@ -735,7 +736,6 @@ PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host; PRODUCT_NAME = "$(TARGET_NAME)"; PROVISIONING_PROFILE_SPECIFIER = "Secretive - Host"; - SWIFT_VERSION = 5.0; }; name = Release; }; @@ -755,7 +755,6 @@ ); PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests; PRODUCT_NAME = "$(TARGET_NAME)"; - SWIFT_VERSION = 5.0; TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive"; }; name = Debug; @@ -776,7 +775,6 @@ ); PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests; PRODUCT_NAME = "$(TARGET_NAME)"; - SWIFT_VERSION = 5.0; TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive"; }; name = Release; @@ -844,6 +842,7 @@ SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG; SWIFT_EMIT_LOC_STRINGS = YES; SWIFT_OPTIMIZATION_LEVEL = "-Onone"; + SWIFT_VERSION = 6.0; }; name = Test; }; @@ -867,7 +866,6 @@ MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host; PRODUCT_NAME = "$(TARGET_NAME)"; - SWIFT_VERSION = 5.0; }; name = Test; }; @@ -888,7 +886,6 @@ PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests; PRODUCT_NAME = "$(TARGET_NAME)"; PROVISIONING_PROFILE_SPECIFIER = ""; - SWIFT_VERSION = 5.0; TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive"; }; name = Test; @@ -911,7 +908,6 @@ MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent; PRODUCT_NAME = "$(TARGET_NAME)"; - SWIFT_VERSION = 5.0; }; name = Test; }; @@ -935,7 +931,6 @@ MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent; PRODUCT_NAME = "$(TARGET_NAME)"; - SWIFT_VERSION = 5.0; }; name = Debug; }; @@ -961,7 +956,6 @@ PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent; PRODUCT_NAME = "$(TARGET_NAME)"; PROVISIONING_PROFILE_SPECIFIER = "Secretive - Secret Agent"; - SWIFT_VERSION = 5.0; }; name = Release; }; From 2dc317d3988247b93a1d4d9d6d00b720a15b5496 Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Wed, 25 Dec 2024 18:25:01 -0500 Subject: [PATCH 02/12] WIP --- Sources/Packages/Package.swift | 2 +- Sources/Packages/Sources/Brief/Release.swift | 2 +- Sources/Packages/Sources/Brief/SemVer.swift | 2 +- Sources/Packages/Sources/Brief/Updater.swift | 22 ++++-- .../Sources/Brief/UpdaterProtocol.swift | 2 +- .../Sources/SecretAgentKit/Agent.swift | 16 ++--- .../SecretAgentKit/SigningWitness.swift | 4 +- .../Sources/SecretKit/Erasers/AnySecret.swift | 2 +- .../SecretKit/Erasers/AnySecretStore.swift | 69 +++++++++---------- .../Sources/SecretKit/SecretStoreList.swift | 15 ++-- .../Sources/SecretKit/Types/Secret.swift | 4 +- .../Sources/SecretKit/Types/SecretStore.swift | 18 ++--- .../SecureEnclaveStore.swift | 56 ++++++++------- .../SmartCardSecretKit/SmartCardStore.swift | 9 +-- Sources/SecretAgent/AppDelegate.swift | 22 +++--- Sources/SecretAgent/Notifier.swift | 26 ++++--- Sources/Secretive.xcodeproj/project.pbxproj | 12 +--- Sources/Secretive/App.swift | 28 ++++---- .../Controllers/LaunchAgentController.swift | 26 ++++--- .../Preview Content/PreviewUpdater.swift | 24 +++++-- .../Secretive/Views/CreateSecretView.swift | 11 +-- .../Secretive/Views/DeleteSecretView.swift | 5 +- Sources/Secretive/Views/EmptyStoreView.swift | 6 +- .../Secretive/Views/RenameSecretView.swift | 5 +- .../Secretive/Views/SecretListItemView.swift | 2 +- Sources/Secretive/Views/SetupView.swift | 6 +- 26 files changed, 208 insertions(+), 188 deletions(-) diff --git a/Sources/Packages/Package.swift b/Sources/Packages/Package.swift index 4c382272..15945806 100644 --- a/Sources/Packages/Package.swift +++ b/Sources/Packages/Package.swift @@ -6,7 +6,7 @@ import PackageDescription let package = Package( name: "SecretivePackages", platforms: [ - .macOS(.v12) + .macOS(.v15) ], products: [ .library( diff --git a/Sources/Packages/Sources/Brief/Release.swift b/Sources/Packages/Sources/Brief/Release.swift index 847dffe7..ffc32935 100644 --- a/Sources/Packages/Sources/Brief/Release.swift +++ b/Sources/Packages/Sources/Brief/Release.swift @@ -1,7 +1,7 @@ import Foundation /// A release is a representation of a downloadable update. -public struct Release: Codable { +public struct Release: Codable, Sendable { /// The user-facing name of the release. Typically "Secretive 1.2.3" public let name: String diff --git a/Sources/Packages/Sources/Brief/SemVer.swift b/Sources/Packages/Sources/Brief/SemVer.swift index 8308521a..8df8c4ab 100644 --- a/Sources/Packages/Sources/Brief/SemVer.swift +++ b/Sources/Packages/Sources/Brief/SemVer.swift @@ -1,7 +1,7 @@ import Foundation /// A representation of a Semantic Version. -public struct SemVer { +public struct SemVer: Sendable { /// The SemVer broken into an array of integers. let versionNumbers: [Int] diff --git a/Sources/Packages/Sources/Brief/Updater.swift b/Sources/Packages/Sources/Brief/Updater.swift index 6c88d82f..d64bf408 100644 --- a/Sources/Packages/Sources/Brief/Updater.swift +++ b/Sources/Packages/Sources/Brief/Updater.swift @@ -1,10 +1,14 @@ import Foundation -import Combine +import Observation +import Synchronization /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version. -public final class Updater: ObservableObject, UpdaterProtocol { +@Observable public final class Updater: UpdaterProtocol, ObservableObject, Sendable { - @Published public var update: Release? + public var update: Release? { + _update.withLock { $0 } + } + private let _update: Mutex = .init(nil) public let testBuild: Bool /// The current OS version. @@ -46,8 +50,10 @@ public final class Updater: ObservableObject, UpdaterProtocol { public func ignore(release: Release) { guard !release.critical else { return } defaults.set(true, forKey: release.name) - DispatchQueue.main.async { - self.update = nil + Task { @MainActor in + _update.withLock { value in + value = nil + } } } @@ -67,8 +73,10 @@ extension Updater { guard !release.prerelease else { return } let latestVersion = SemVer(release.name) if latestVersion > currentVersion { - DispatchQueue.main.async { - self.update = release + Task { @MainActor in + _update.withLock { value in + value = release + } } } } diff --git a/Sources/Packages/Sources/Brief/UpdaterProtocol.swift b/Sources/Packages/Sources/Brief/UpdaterProtocol.swift index a5c5edcc..c4da349d 100644 --- a/Sources/Packages/Sources/Brief/UpdaterProtocol.swift +++ b/Sources/Packages/Sources/Brief/UpdaterProtocol.swift @@ -1,5 +1,5 @@ import Foundation -import Combine +import Synchronization /// A protocol for retreiving the latest available version of an app. public protocol UpdaterProtocol: ObservableObject { diff --git a/Sources/Packages/Sources/SecretAgentKit/Agent.swift b/Sources/Packages/Sources/SecretAgentKit/Agent.swift index 7209635d..c2b0044f 100644 --- a/Sources/Packages/Sources/SecretAgentKit/Agent.swift +++ b/Sources/Packages/Sources/SecretAgentKit/Agent.swift @@ -54,7 +54,7 @@ extension Agent { func handle(requestType: SSHAgent.RequestType, data: Data, reader: FileHandleReader) async -> Data { // Depending on the launch context (such as after macOS update), the agent may need to reload secrets before acting - reloadSecretsIfNeccessary() + await reloadSecretsIfNeccessary() var response = Data() do { switch requestType { @@ -65,7 +65,7 @@ extension Agent { case .signRequest: let provenance = requestTracer.provenance(from: reader) response.append(SSHAgent.ResponseType.agentSignResponse.data) - response.append(try sign(data: data, provenance: provenance)) + response.append(try await sign(data: data, provenance: provenance)) logger.debug("Agent returned \(SSHAgent.ResponseType.agentSignResponse.debugDescription)") } } catch { @@ -112,7 +112,7 @@ extension Agent { /// - data: The data to sign. /// - provenance: A ``SecretKit.SigningRequestProvenance`` object describing the origin of the request. /// - Returns: An OpenSSH formatted Data payload containing the signed data response. - func sign(data: Data, provenance: SigningRequestProvenance) throws -> Data { + func sign(data: Data, provenance: SigningRequestProvenance) async throws -> Data { let reader = OpenSSHReader(data: data) let payloadHash = reader.readNextChunk() let hash: Data @@ -129,11 +129,11 @@ extension Agent { } if let witness = witness { - try witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance) + try await witness.speakNowOrForeverHoldYourPeace(forAccessTo: secret, from: store, by: provenance) } let dataToSign = reader.readNextChunk() - let signed = try store.sign(data: dataToSign, with: secret, for: provenance) + let signed = try await store.sign(data: dataToSign, with: secret, for: provenance) let derSignature = signed let curveData = writer.curveType(for: secret.algorithm, length: secret.keySize).data(using: .utf8)! @@ -175,7 +175,7 @@ extension Agent { signedData.append(writer.lengthAndData(of: sub)) if let witness = witness { - try witness.witness(accessTo: secret, from: store, by: provenance) + try await witness.witness(accessTo: secret, from: store, by: provenance) } logger.debug("Agent signed request") @@ -188,11 +188,11 @@ extension Agent { extension Agent { /// Gives any store with no loaded secrets a chance to reload. - func reloadSecretsIfNeccessary() { + func reloadSecretsIfNeccessary() async { for store in storeList.stores { if store.secrets.isEmpty { logger.debug("Store \(store.name, privacy: .public) has no loaded secrets. Reloading.") - store.reloadSecrets() + await store.reloadSecrets() } } } diff --git a/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift b/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift index b090bd3c..2527fef8 100644 --- a/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift +++ b/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift @@ -10,13 +10,13 @@ public protocol SigningWitness { /// - store: The `Store` being asked to sign the request.. /// - provenance: A `SigningRequestProvenance` object describing the origin of the request. /// - Note: This method being called does not imply that the requst has been authorized. If a secret requires authentication, authentication will still need to be performed by the user before the request will be performed. If the user declines or fails to authenticate, the request will fail. - func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws + func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws /// Notifies the callee that a signing operation has been performed for a given secret. /// - Parameters: /// - secret: The `Secret` that will was used to sign the request. /// - store: The `Store` that signed the request.. /// - provenance: A `SigningRequestProvenance` object describing the origin of the request. - func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws + func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws } diff --git a/Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift b/Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift index f6e8bef8..88991dcb 100644 --- a/Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift +++ b/Sources/Packages/Sources/SecretKit/Erasers/AnySecret.swift @@ -1,7 +1,7 @@ import Foundation /// Type eraser for Secret. -public struct AnySecret: Secret { +public struct AnySecret: Secret, @unchecked Sendable { let base: Any private let hashable: AnyHashable diff --git a/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift b/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift index bf5a74d2..3e831b0a 100644 --- a/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift +++ b/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift @@ -9,13 +9,11 @@ public class AnySecretStore: SecretStore { private let _id: () -> UUID private let _name: () -> String private let _secrets: () -> [AnySecret] - private let _sign: (Data, AnySecret, SigningRequestProvenance) throws -> Data - private let _verify: (Data, Data, AnySecret) throws -> Bool - private let _existingPersistedAuthenticationContext: (AnySecret) -> PersistedAuthenticationContext? - private let _persistAuthentication: (AnySecret, TimeInterval) throws -> Void - private let _reloadSecrets: () -> Void - - private var sink: AnyCancellable? + private let _sign: (Data, AnySecret, SigningRequestProvenance) async throws -> Data + private let _verify: (Data, Data, AnySecret) async throws -> Bool + private let _existingPersistedAuthenticationContext: (AnySecret) async -> PersistedAuthenticationContext? + private let _persistAuthentication: (AnySecret, TimeInterval) async throws -> Void + private let _reloadSecrets: () async -> Void public init(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore { base = secretStore @@ -23,14 +21,11 @@ public class AnySecretStore: SecretStore { _name = { secretStore.name } _id = { secretStore.id } _secrets = { secretStore.secrets.map { AnySecret($0) } } - _sign = { try secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) } - _verify = { try secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) } - _existingPersistedAuthenticationContext = { secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) } - _persistAuthentication = { try secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) } - _reloadSecrets = { secretStore.reloadSecrets() } - sink = secretStore.objectWillChange.sink { _ in - self.objectWillChange.send() - } + _sign = { try await secretStore.sign(data: $0, with: $1.base as! SecretStoreType.SecretType, for: $2) } + _verify = { try await secretStore.verify(signature: $0, for: $1, with: $2.base as! SecretStoreType.SecretType) } + _existingPersistedAuthenticationContext = { await secretStore.existingPersistedAuthenticationContext(secret: $0.base as! SecretStoreType.SecretType) } + _persistAuthentication = { try await secretStore.persistAuthentication(secret: $0.base as! SecretStoreType.SecretType, forDuration: $1) } + _reloadSecrets = { await secretStore.reloadSecrets() } } public var isAvailable: Bool { @@ -49,51 +44,51 @@ public class AnySecretStore: SecretStore { return _secrets() } - public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) throws -> Data { - try _sign(data, secret, provenance) + public func sign(data: Data, with secret: AnySecret, for provenance: SigningRequestProvenance) async throws -> Data { + try await _sign(data, secret, provenance) } - public func verify(signature: Data, for data: Data, with secret: AnySecret) throws -> Bool { - try _verify(signature, data, secret) + public func verify(signature: Data, for data: Data, with secret: AnySecret) async throws -> Bool { + try await _verify(signature, data, secret) } - public func existingPersistedAuthenticationContext(secret: AnySecret) -> PersistedAuthenticationContext? { - _existingPersistedAuthenticationContext(secret) + public func existingPersistedAuthenticationContext(secret: AnySecret) async -> PersistedAuthenticationContext? { + await _existingPersistedAuthenticationContext(secret) } - public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) throws { - try _persistAuthentication(secret, duration) + public func persistAuthentication(secret: AnySecret, forDuration duration: TimeInterval) async throws { + try await _persistAuthentication(secret, duration) } - public func reloadSecrets() { - _reloadSecrets() + public func reloadSecrets() async { + await _reloadSecrets() } } public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable { - private let _create: (String, Bool) throws -> Void - private let _delete: (AnySecret) throws -> Void - private let _update: (AnySecret, String) throws -> Void + private let _create: (String, Bool) async throws -> Void + private let _delete: (AnySecret) async throws -> Void + private let _update: (AnySecret, String) async throws -> Void public init(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable { - _create = { try secretStore.create(name: $0, requiresAuthentication: $1) } - _delete = { try secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) } - _update = { try secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) } + _create = { try await secretStore.create(name: $0, requiresAuthentication: $1) } + _delete = { try await secretStore.delete(secret: $0.base as! SecretStoreType.SecretType) } + _update = { try await secretStore.update(secret: $0.base as! SecretStoreType.SecretType, name: $1) } super.init(secretStore) } - public func create(name: String, requiresAuthentication: Bool) throws { - try _create(name, requiresAuthentication) + public func create(name: String, requiresAuthentication: Bool) async throws { + try await _create(name, requiresAuthentication) } - public func delete(secret: AnySecret) throws { - try _delete(secret) + public func delete(secret: AnySecret) async throws { + try await _delete(secret) } - public func update(secret: AnySecret, name: String) throws { - try _update(secret, name) + public func update(secret: AnySecret, name: String) async throws { + try await _update(secret, name) } } diff --git a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift index eb8456fd..0f1da098 100644 --- a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift +++ b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift @@ -1,14 +1,13 @@ import Foundation -import Combine +import Observation /// A "Store Store," which holds a list of type-erased stores. -public final class SecretStoreList: ObservableObject { +@Observable public final class SecretStoreList: ObservableObject { /// The Stores managed by the SecretStoreList. - @Published public var stores: [AnySecretStore] = [] + public var stores: [AnySecretStore] = [] /// A modifiable store, if one is available. - @Published public var modifiableStore: AnySecretStoreModifiable? - private var cancellables: Set = [] + public var modifiableStore: AnySecretStoreModifiable? /// Initializes a SecretStoreList. public init() { @@ -41,9 +40,9 @@ extension SecretStoreList { private func addInternal(store: AnySecretStore) { stores.append(store) - store.objectWillChange.sink { - self.objectWillChange.send() - }.store(in: &cancellables) +// store.objectWillChange.sink { +// self.objectWillChange.send() +// }.store(in: &cancellables) } } diff --git a/Sources/Packages/Sources/SecretKit/Types/Secret.swift b/Sources/Packages/Sources/SecretKit/Types/Secret.swift index 8f9656cd..e4cdb227 100644 --- a/Sources/Packages/Sources/SecretKit/Types/Secret.swift +++ b/Sources/Packages/Sources/SecretKit/Types/Secret.swift @@ -1,7 +1,7 @@ import Foundation /// The base protocol for describing a Secret -public protocol Secret: Identifiable, Hashable { +public protocol Secret: Identifiable, Hashable, Sendable { /// A user-facing string identifying the Secret. var name: String { get } @@ -17,7 +17,7 @@ public protocol Secret: Identifiable, Hashable { } /// The type of algorithm the Secret uses. Currently, only elliptic curve algorithms are supported. -public enum Algorithm: Hashable { +public enum Algorithm: Hashable, Sendable { case ellipticCurve case rsa diff --git a/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift b/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift index f7802017..f0a465b1 100644 --- a/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift +++ b/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift @@ -2,7 +2,7 @@ import Foundation import Combine /// Manages access to Secrets, and performs signature operations on data using those Secrets. -public protocol SecretStore: ObservableObject, Identifiable { +public protocol SecretStore: Identifiable { associatedtype SecretType: Secret @@ -21,7 +21,7 @@ public protocol SecretStore: ObservableObject, Identifiable { /// - secret: The ``Secret`` to sign with. /// - provenance: A ``SigningRequestProvenance`` describing where the request came from. /// - Returns: The signed data. - func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) throws -> Data + func sign(data: Data, with secret: SecretType, for provenance: SigningRequestProvenance) async throws -> Data /// Verifies that a signature is valid over a specified payload. /// - Parameters: @@ -29,23 +29,23 @@ public protocol SecretStore: ObservableObject, Identifiable { /// - data: The data to verify the signature of. /// - secret: The secret whose signature to verify. /// - Returns: Whether the signature was verified. - func verify(signature: Data, for data: Data, with secret: SecretType) throws -> Bool + func verify(signature: Data, for data: Data, with secret: SecretType) async throws -> Bool /// Checks to see if there is currently a valid persisted authentication for a given secret. /// - Parameters: /// - secret: The ``Secret`` to check if there is a persisted authentication for. /// - Returns: A persisted authentication context, if a valid one exists. - func existingPersistedAuthenticationContext(secret: SecretType) -> PersistedAuthenticationContext? + func existingPersistedAuthenticationContext(secret: SecretType) async -> PersistedAuthenticationContext? /// Persists user authorization for access to a secret. /// - Parameters: /// - secret: The ``Secret`` to persist the authorization for. /// - duration: The duration that the authorization should persist for. /// - Note: This is used for temporarily unlocking access to a secret which would otherwise require authentication every single use. This is useful for situations where the user anticipates several rapid accesses to a authorization-guarded secret. - func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) throws + func persistAuthentication(secret: SecretType, forDuration duration: TimeInterval) async throws /// Requests that the store reload secrets from any backing store, if neccessary. - func reloadSecrets() + func reloadSecrets() async } @@ -56,18 +56,18 @@ public protocol SecretStoreModifiable: SecretStore { /// - Parameters: /// - name: The user-facing name for the ``Secret``. /// - requiresAuthentication: A boolean indicating whether or not the user will be required to authenticate before performing signature operations with the secret. - func create(name: String, requiresAuthentication: Bool) throws + func create(name: String, requiresAuthentication: Bool) async throws /// Deletes a Secret in the store. /// - Parameters: /// - secret: The ``Secret`` to delete. - func delete(secret: SecretType) throws + func delete(secret: SecretType) async throws /// Updates the name of a Secret in the store. /// - Parameters: /// - secret: The ``Secret`` to update. /// - name: The new name for the Secret. - func update(secret: SecretType, name: String) throws + func update(secret: SecretType, name: String) async throws } diff --git a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift index 19b6168a..216033bc 100644 --- a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift +++ b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift @@ -1,38 +1,42 @@ import Foundation -import Combine +import Observation import Security -import CryptoTokenKit +import CryptoKit import LocalAuthentication import SecretKit +import Synchronization extension SecureEnclave { /// An implementation of Store backed by the Secure Enclave. - public final class Store: SecretStoreModifiable { + @Observable public final class Store: SecretStoreModifiable { public var isAvailable: Bool { - // For some reason, as of build time, CryptoKit.SecureEnclave.isAvailable always returns false - // error msg "Received error sending GET UNIQUE DEVICE command" - // Verify it with TKTokenWatcher manually. - TKTokenWatcher().tokenIDs.contains("com.apple.setoken") + CryptoKit.SecureEnclave.isAvailable } public let id = UUID() public let name = String(localized: "secure_enclave") - @Published public private(set) var secrets: [Secret] = [] + public var secrets: [Secret] { + _secrets.withLock { $0 } + } + private let _secrets: Mutex<[Secret]> = .init([]) private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:] /// Initializes a Store. public init() { - DistributedNotificationCenter.default().addObserver(forName: .secretStoreUpdated, object: nil, queue: .main) { [reload = reloadSecretsInternal(notifyAgent:)] _ in - reload(false) - } + // FIXME: THIS +// Task { +// for await _ in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) { +// await reloadSecretsInternal(notifyAgent: false) +// } +// } loadSecrets() } // MARK: Public API - public func create(name: String, requiresAuthentication: Bool) throws { + public func create(name: String, requiresAuthentication: Bool) async throws { var accessError: SecurityError? let flags: SecAccessControlCreateFlags if requiresAuthentication { @@ -69,10 +73,10 @@ extension SecureEnclave { throw KeychainError(statusCode: nil) } try savePublicKey(publicKey, name: name) - reloadSecretsInternal() + await reloadSecretsInternal() } - public func delete(secret: Secret) throws { + public func delete(secret: Secret) async throws { let deleteAttributes = KeychainDictionary([ kSecClass: kSecClassKey, kSecAttrApplicationLabel: secret.id as CFData @@ -81,10 +85,10 @@ extension SecureEnclave { if status != errSecSuccess { throw KeychainError(statusCode: status) } - reloadSecretsInternal() + await reloadSecretsInternal() } - public func update(secret: Secret, name: String) throws { + public func update(secret: Secret, name: String) async throws { let updateQuery = KeychainDictionary([ kSecClass: kSecClassKey, kSecAttrApplicationLabel: secret.id as CFData @@ -98,7 +102,7 @@ extension SecureEnclave { if status != errSecSuccess { throw KeychainError(statusCode: status) } - reloadSecretsInternal() + await reloadSecretsInternal() } public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data { @@ -199,8 +203,8 @@ extension SecureEnclave { } } - public func reloadSecrets() { - reloadSecretsInternal(notifyAgent: false) + public func reloadSecrets() async { + await reloadSecretsInternal(notifyAgent: false) } } @@ -211,9 +215,11 @@ extension SecureEnclave.Store { /// Reloads all secrets from the store. /// - Parameter notifyAgent: A boolean indicating whether a distributed notification should be posted, notifying other processes (ie, the SecretAgent) to reload their stores as well. - private func reloadSecretsInternal(notifyAgent: Bool = true) { + private func reloadSecretsInternal(notifyAgent: Bool = true) async { let before = secrets - secrets.removeAll() + _secrets.withLock { + $0.removeAll() + } loadSecrets() if secrets != before { NotificationCenter.default.post(name: .secretStoreReloaded, object: self) @@ -275,7 +281,9 @@ extension SecureEnclave.Store { } return SecureEnclave.Secret(id: id, name: name, requiresAuthentication: requiresAuth, publicKey: publicKey) } - secrets.append(contentsOf: wrapped) + _secrets.withLock { + $0.append(contentsOf: wrapped) + } } /// Saves a public key. @@ -304,8 +312,8 @@ extension SecureEnclave.Store { extension SecureEnclave { enum Constants { - static let keyTag = "com.maxgoedjen.secretive.secureenclave.key".data(using: .utf8)! as CFData - static let keyType = kSecAttrKeyTypeECSECPrimeRandom + static let keyTag = Data("com.maxgoedjen.secretive.secureenclave.key".utf8) + static let keyType = kSecAttrKeyTypeECSECPrimeRandom as String static let unauthenticatedThreshold: TimeInterval = 0.05 } diff --git a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift index c8c3281c..12805086 100644 --- a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift +++ b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift @@ -20,14 +20,15 @@ extension SmartCard { /// Initializes a Store. public init() { tokenID = watcher.nonSecureEnclaveTokens.first - watcher.setInsertionHandler { [reload = reloadSecretsInternal] string in + // FIXME: THIS + watcher.setInsertionHandler { string in guard self.tokenID == nil else { return } guard !string.contains("setoken") else { return } self.tokenID = string - DispatchQueue.main.async { - reload() - } +// DispatchQueue.main.async { +// reload() +// } self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string) } if let tokenID = tokenID { diff --git a/Sources/SecretAgent/AppDelegate.swift b/Sources/SecretAgent/AppDelegate.swift index ab6a3cdd..13b0a9b3 100644 --- a/Sources/SecretAgent/AppDelegate.swift +++ b/Sources/SecretAgent/AppDelegate.swift @@ -7,7 +7,7 @@ import SmartCardSecretKit import SecretAgentKit import Brief -@NSApplicationMain +@main class AppDelegate: NSObject, NSApplicationDelegate { private let storeList: SecretStoreList = { @@ -31,18 +31,18 @@ class AppDelegate: NSObject, NSApplicationDelegate { func applicationDidFinishLaunching(_ aNotification: Notification) { logger.debug("SecretAgent finished launching") - DispatchQueue.main.async { - self.socketController.handler = self.agent.handle(reader:writer:) - } - NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in - try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) - } +// DispatchQueue.main.async { +// self.socketController.handler = self.agent.handle(reader:writer:) +// } +// NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in +// try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) +// } try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) notifier.prompt() - updateSink = updater.$update.sink { update in - guard let update = update else { return } - self.notifier.notify(update: update, ignore: self.updater.ignore(release:)) - } +// updateSink = updater.$update.sink { update in +// guard let update = update else { return } +// self.notifier.notify(update: update, ignore: self.updater.ignore(release:)) +// } } } diff --git a/Sources/SecretAgent/Notifier.swift b/Sources/SecretAgent/Notifier.swift index 69b29bbd..5b1fe440 100644 --- a/Sources/SecretAgent/Notifier.swift +++ b/Sources/SecretAgent/Notifier.swift @@ -47,7 +47,7 @@ class Notifier { notificationDelegate.persistAuthentication = { secret, store, duration in guard let duration = duration else { return } - try? store.persistAuthentication(secret: secret, forDuration: duration) + try? await store.persistAuthentication(secret: secret, forDuration: duration) } } @@ -57,7 +57,7 @@ class Notifier { notificationCenter.requestAuthorization(options: .alert) { _, _ in } } - func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) { + func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async { notificationDelegate.pendingPersistableSecrets[secret.id.description] = secret notificationDelegate.pendingPersistableStores[store.id.description] = store let notificationCenter = UNUserNotificationCenter.current() @@ -67,7 +67,7 @@ class Notifier { notificationContent.userInfo[Constants.persistSecretIDKey] = secret.id.description notificationContent.userInfo[Constants.persistStoreIDKey] = store.id.description notificationContent.interruptionLevel = .timeSensitive - if secret.requiresAuthentication && store.existingPersistedAuthenticationContext(secret: secret) == nil { + if await store.existingPersistedAuthenticationContext(secret: secret) == nil && secret.requiresAuthentication { notificationContent.categoryIdentifier = Constants.persistAuthenticationCategoryIdentitifier } if let iconURL = provenance.origin.iconURL, let attachment = try? UNNotificationAttachment(identifier: "icon", url: iconURL, options: nil) { @@ -99,11 +99,11 @@ class Notifier { extension Notifier: SigningWitness { - func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws { + func speakNowOrForeverHoldYourPeace(forAccessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws { } - func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) throws { - notify(accessTo: secret, from: store, by: provenance) + func witness(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async throws { + await notify(accessTo: secret, from: store, by: provenance) } } @@ -133,7 +133,7 @@ class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate { fileprivate var release: Release? fileprivate var ignore: ((Release) -> Void)? - fileprivate var persistAuthentication: ((AnySecret, AnySecretStore, TimeInterval?) -> Void)? + fileprivate var persistAuthentication: ((AnySecret, AnySecretStore, TimeInterval?) async -> Void)? fileprivate var persistOptions: [String: TimeInterval] = [:] fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:] fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:] @@ -141,19 +141,17 @@ class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate { func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) { } - - func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) { + + func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse) async { let category = response.notification.request.content.categoryIdentifier switch category { case Notifier.Constants.updateCategoryIdentitifier: handleUpdateResponse(response: response) case Notifier.Constants.persistAuthenticationCategoryIdentitifier: - handlePersistAuthenticationResponse(response: response) + await handlePersistAuthenticationResponse(response: response) default: break } - - completionHandler() } func handleUpdateResponse(response: UNNotificationResponse) { @@ -168,12 +166,12 @@ class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate { } } - func handlePersistAuthenticationResponse(response: UNNotificationResponse) { + func handlePersistAuthenticationResponse(response: UNNotificationResponse) async { guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String, let secret = pendingPersistableSecrets[secretID], let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String, let store = pendingPersistableStores[storeID] else { return } pendingPersistableSecrets[secretID] = nil - persistAuthentication?(secret, store, persistOptions[response.actionIdentifier]) + await persistAuthentication?(secret, store, persistOptions[response.actionIdentifier]) } func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) { diff --git a/Sources/Secretive.xcodeproj/project.pbxproj b/Sources/Secretive.xcodeproj/project.pbxproj index 72a1b3af..61fd17b4 100644 --- a/Sources/Secretive.xcodeproj/project.pbxproj +++ b/Sources/Secretive.xcodeproj/project.pbxproj @@ -610,7 +610,7 @@ GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; GCC_WARN_UNUSED_FUNCTION = YES; GCC_WARN_UNUSED_VARIABLE = YES; - MACOSX_DEPLOYMENT_TARGET = 11.0; + MACOSX_DEPLOYMENT_TARGET = 15.0; MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE; MTL_FAST_MATH = YES; ONLY_ACTIVE_ARCH = YES; @@ -671,7 +671,7 @@ GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; GCC_WARN_UNUSED_FUNCTION = YES; GCC_WARN_UNUSED_VARIABLE = YES; - MACOSX_DEPLOYMENT_TARGET = 11.0; + MACOSX_DEPLOYMENT_TARGET = 15.0; MTL_ENABLE_DEBUG_INFO = NO; MTL_FAST_MATH = YES; OTHER_SWIFT_FLAGS = ""; @@ -704,7 +704,6 @@ "$(inherited)", "@executable_path/../Frameworks", ); - MACOSX_DEPLOYMENT_TARGET = 12.0; MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host; PRODUCT_NAME = "$(TARGET_NAME)"; @@ -731,7 +730,6 @@ "$(inherited)", "@executable_path/../Frameworks", ); - MACOSX_DEPLOYMENT_TARGET = 12.0; MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host; PRODUCT_NAME = "$(TARGET_NAME)"; @@ -831,7 +829,7 @@ GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE; GCC_WARN_UNUSED_FUNCTION = YES; GCC_WARN_UNUSED_VARIABLE = YES; - MACOSX_DEPLOYMENT_TARGET = 11.0; + MACOSX_DEPLOYMENT_TARGET = 15.0; MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE; MTL_FAST_MATH = YES; ONLY_ACTIVE_ARCH = YES; @@ -862,7 +860,6 @@ "$(inherited)", "@executable_path/../Frameworks", ); - MACOSX_DEPLOYMENT_TARGET = 12.0; MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.Host; PRODUCT_NAME = "$(TARGET_NAME)"; @@ -904,7 +901,6 @@ "$(inherited)", "@executable_path/../Frameworks", ); - MACOSX_DEPLOYMENT_TARGET = 12.0; MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent; PRODUCT_NAME = "$(TARGET_NAME)"; @@ -927,7 +923,6 @@ "$(inherited)", "@executable_path/../Frameworks", ); - MACOSX_DEPLOYMENT_TARGET = 12.0; MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent; PRODUCT_NAME = "$(TARGET_NAME)"; @@ -951,7 +946,6 @@ "$(inherited)", "@executable_path/../Frameworks", ); - MACOSX_DEPLOYMENT_TARGET = 12.0; MARKETING_VERSION = 1; PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.Secretive.SecretAgent; PRODUCT_NAME = "$(TARGET_NAME)"; diff --git a/Sources/Secretive/App.swift b/Sources/Secretive/App.swift index 81555ab9..fbd7e5ed 100644 --- a/Sources/Secretive/App.swift +++ b/Sources/Secretive/App.swift @@ -69,24 +69,26 @@ struct Secretive: App { extension Secretive { private func reinstallAgent() { - justUpdatedChecker.check() - LaunchAgentController().install { - // Wait a second for launchd to kick in (next runloop isn't enough). - DispatchQueue.main.asyncAfter(deadline: .now() + 1) { - agentStatusChecker.check() - if !agentStatusChecker.running { - forceLaunchAgent() - } - } - } +// justUpdatedChecker.check() + // FIXME: THIS +// LaunchAgentController().install { +// // Wait a second for launchd to kick in (next runloop isn't enough). +// DispatchQueue.main.asyncAfter(deadline: .now() + 1) { +// agentStatusChecker.check() +// if !agentStatusChecker.running { +// forceLaunchAgent() +// } +// } +// } } private func forceLaunchAgent() { // We've run setup, we didn't just update, launchd is just not doing it's thing. // Force a launch directly. - LaunchAgentController().forceLaunch { _ in - agentStatusChecker.check() - } + // FIXME: THIS +// LaunchAgentController().forceLaunch { _ in +// agentStatusChecker.check() +// } } } diff --git a/Sources/Secretive/Controllers/LaunchAgentController.swift b/Sources/Secretive/Controllers/LaunchAgentController.swift index 7f512aa4..2cf72e2e 100644 --- a/Sources/Secretive/Controllers/LaunchAgentController.swift +++ b/Sources/Secretive/Controllers/LaunchAgentController.swift @@ -8,37 +8,35 @@ struct LaunchAgentController { private let logger = Logger(subsystem: "com.maxgoedjen.secretive", category: "LaunchAgentController") - func install(completion: (() -> Void)? = nil) { + func install() async { logger.debug("Installing agent") _ = setEnabled(false) // This is definitely a bit of a "seems to work better" thing but: // Seems to more reliably hit if these are on separate runloops, otherwise it seems like it sometimes doesn't kill old // and start new? - DispatchQueue.main.asyncAfter(deadline: .now() + 0.1) { + try? await Task.sleep(for: .seconds(1)) + await MainActor.run { _ = setEnabled(true) - completion?() } - } - func forceLaunch(completion: ((Bool) -> Void)?) { + func forceLaunch() async -> Bool { logger.debug("Agent is not running, attempting to force launch") let url = Bundle.main.bundleURL.appendingPathComponent("Contents/Library/LoginItems/SecretAgent.app") let config = NSWorkspace.OpenConfiguration() config.activates = false - NSWorkspace.shared.openApplication(at: url, configuration: config) { app, error in - DispatchQueue.main.async { - completion?(error == nil) - } - if let error = error { - logger.error("Error force launching \(error.localizedDescription)") - } else { - logger.debug("Agent force launched") - } + do { + let app = try await NSWorkspace.shared.openApplication(at: url, configuration: config) + logger.debug("Agent force launched") + return true + } catch { + logger.error("Error force launching \(error.localizedDescription)") + return false } } private func setEnabled(_ enabled: Bool) -> Bool { + // FIXME: THIS SMLoginItemSetEnabled(Bundle.main.agentBundleID as CFString, enabled) } diff --git a/Sources/Secretive/Preview Content/PreviewUpdater.swift b/Sources/Secretive/Preview Content/PreviewUpdater.swift index a993d87e..6979615d 100644 --- a/Sources/Secretive/Preview Content/PreviewUpdater.swift +++ b/Sources/Secretive/Preview Content/PreviewUpdater.swift @@ -1,20 +1,32 @@ import Foundation -import Combine +import Synchronization +import Observation import Brief -class PreviewUpdater: UpdaterProtocol { +@Observable class PreviewUpdater: UpdaterProtocol { + + var update: Release? { + _update.withLock { $0 } + } + let _update: Mutex = .init(nil) - let update: Release? let testBuild = false init(update: Update = .none) { switch update { case .none: - self.update = nil + _update.withLock { + $0 = nil + } case .advisory: - self.update = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Some regular update") + _update.withLock { + $0 = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Some regular update") + } case .critical: - self.update = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update") + _update.withLock { + $0 = Release(name: "10.10.10", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update") + + } } } diff --git a/Sources/Secretive/Views/CreateSecretView.swift b/Sources/Secretive/Views/CreateSecretView.swift index accd8bea..4190c997 100644 --- a/Sources/Secretive/Views/CreateSecretView.swift +++ b/Sources/Secretive/Views/CreateSecretView.swift @@ -3,7 +3,7 @@ import SecretKit struct CreateSecretView: View { - @ObservedObject var store: StoreType + @State var store: StoreType @Binding var showing: Bool @State private var name = "" @@ -45,7 +45,8 @@ struct CreateSecretView: View { } func save() { - try! store.create(name: name, requiresAuthentication: requiresAuthentication) + // FIXME: THIS +// try! store.create(name: name, requiresAuthentication: requiresAuthentication) showing = false } @@ -93,14 +94,14 @@ struct ThumbnailPickerView: View { extension ThumbnailPickerView { - struct Item: Identifiable { + struct Item: Identifiable { let id = UUID() - let value: ValueType + let value: InnerValueType let name: LocalizedStringKey let description: LocalizedStringKey let thumbnail: AnyView - init(value: ValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) { + init(value: InnerValueType, name: LocalizedStringKey, description: LocalizedStringKey, thumbnail: ViewType) { self.value = value self.name = name self.description = description diff --git a/Sources/Secretive/Views/DeleteSecretView.swift b/Sources/Secretive/Views/DeleteSecretView.swift index 5e3a6f99..d5c4e19f 100644 --- a/Sources/Secretive/Views/DeleteSecretView.swift +++ b/Sources/Secretive/Views/DeleteSecretView.swift @@ -3,7 +3,7 @@ import SecretKit struct DeleteSecretView: View { - @ObservedObject var store: StoreType + @State var store: StoreType let secret: StoreType.SecretType var dismissalBlock: (Bool) -> () @@ -49,7 +49,8 @@ struct DeleteSecretView: View { } func delete() { - try! store.delete(secret: secret) + // FIXME: THIS +// try! store.delete(secret: secret) dismissalBlock(true) } diff --git a/Sources/Secretive/Views/EmptyStoreView.swift b/Sources/Secretive/Views/EmptyStoreView.swift index 6a88c2b9..1bd3eae5 100644 --- a/Sources/Secretive/Views/EmptyStoreView.swift +++ b/Sources/Secretive/Views/EmptyStoreView.swift @@ -3,7 +3,7 @@ import SecretKit struct EmptyStoreView: View { - @ObservedObject var store: AnySecretStore + @State var store: AnySecretStore @Binding var activeSecret: AnySecret.ID? var body: some View { @@ -22,8 +22,8 @@ struct EmptyStoreView: View { extension EmptyStoreView { enum Constants { - static let emptyStoreModifiableTag: AnyHashable = "emptyStoreModifiableTag" - static let emptyStoreTag: AnyHashable = "emptyStoreTag" + static let emptyStoreModifiableTag = "emptyStoreModifiableTag" + static let emptyStoreTag = "emptyStoreTag" } } diff --git a/Sources/Secretive/Views/RenameSecretView.swift b/Sources/Secretive/Views/RenameSecretView.swift index 915b2b28..1a2b664b 100644 --- a/Sources/Secretive/Views/RenameSecretView.swift +++ b/Sources/Secretive/Views/RenameSecretView.swift @@ -3,7 +3,7 @@ import SecretKit struct RenameSecretView: View { - @ObservedObject var store: StoreType + @State var store: StoreType let secret: StoreType.SecretType var dismissalBlock: (_ renamed: Bool) -> () @@ -44,7 +44,8 @@ struct RenameSecretView: View { } func rename() { - try? store.update(secret: secret, name: newName) + // FIXME: THIS +// try? await store.update(secret: secret, name: newName) dismissalBlock(true) } } diff --git a/Sources/Secretive/Views/SecretListItemView.swift b/Sources/Secretive/Views/SecretListItemView.swift index 8f6bbf43..c498eaa1 100644 --- a/Sources/Secretive/Views/SecretListItemView.swift +++ b/Sources/Secretive/Views/SecretListItemView.swift @@ -3,7 +3,7 @@ import SecretKit struct SecretListItemView: View { - @ObservedObject var store: AnySecretStore + @State var store: AnySecretStore var secret: AnySecret @Binding var activeSecret: AnySecret.ID? diff --git a/Sources/Secretive/Views/SetupView.swift b/Sources/Secretive/Views/SetupView.swift index ffd142c7..b2124550 100644 --- a/Sources/Secretive/Views/SetupView.swift +++ b/Sources/Secretive/Views/SetupView.swift @@ -156,8 +156,10 @@ struct SecretAgentSetupView: View { } func install() { - LaunchAgentController().install() - buttonAction() + Task { + await LaunchAgentController().install() + buttonAction() + } } } From 970e407e298d9b4db0d3cc3f1270ea1226dfa2e9 Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Thu, 26 Dec 2024 19:28:30 -0500 Subject: [PATCH 03/12] WIP --- .../SecretKit/Erasers/AnySecretStore.swift | 32 ++--- .../Sources/SecretKit/SecretStoreList.swift | 15 +- .../PersistedAuthenticationContext.swift | 2 +- .../Sources/SecretKit/Types/SecretStore.swift | 2 +- .../SecureEnclaveStore.swift | 87 ++++++------ .../SmartCardSecretKit/SmartCardStore.swift | 97 ++++++++----- Sources/Secretive/App.swift | 28 ++-- .../Preview Content/PreviewStore.swift | 132 +++++++++--------- Sources/Secretive/Views/ContentView.swift | 74 +++++----- .../Secretive/Views/CreateSecretView.swift | 39 +++--- .../Secretive/Views/DeleteSecretView.swift | 7 +- .../Secretive/Views/RenameSecretView.swift | 7 +- .../Secretive/Views/SecretDetailView.swift | 18 +-- 13 files changed, 282 insertions(+), 258 deletions(-) diff --git a/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift b/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift index 3e831b0a..93d24602 100644 --- a/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift +++ b/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift @@ -2,21 +2,19 @@ import Foundation import Combine /// Type eraser for SecretStore. -public class AnySecretStore: SecretStore { - - let base: Any - private let _isAvailable: () -> Bool - private let _id: () -> UUID - private let _name: () -> String - private let _secrets: () -> [AnySecret] - private let _sign: (Data, AnySecret, SigningRequestProvenance) async throws -> Data - private let _verify: (Data, Data, AnySecret) async throws -> Bool - private let _existingPersistedAuthenticationContext: (AnySecret) async -> PersistedAuthenticationContext? - private let _persistAuthentication: (AnySecret, TimeInterval) async throws -> Void - private let _reloadSecrets: () async -> Void +public class AnySecretStore: SecretStore, @unchecked Sendable { + + private let _isAvailable: @Sendable () -> Bool + private let _id: @Sendable () -> UUID + private let _name: @Sendable () -> String + private let _secrets: @Sendable () -> [AnySecret] + private let _sign: @Sendable (Data, AnySecret, SigningRequestProvenance) async throws -> Data + private let _verify: @Sendable (Data, Data, AnySecret) async throws -> Bool + private let _existingPersistedAuthenticationContext: @Sendable (AnySecret) async -> PersistedAuthenticationContext? + private let _persistAuthentication: @Sendable (AnySecret, TimeInterval) async throws -> Void + private let _reloadSecrets: @Sendable () async -> Void public init(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore { - base = secretStore _isAvailable = { secretStore.isAvailable } _name = { secretStore.name } _id = { secretStore.id } @@ -66,11 +64,11 @@ public class AnySecretStore: SecretStore { } -public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable { +public final class AnySecretStoreModifiable: AnySecretStore, SecretStoreModifiable, @unchecked Sendable { - private let _create: (String, Bool) async throws -> Void - private let _delete: (AnySecret) async throws -> Void - private let _update: (AnySecret, String) async throws -> Void + private let _create: @Sendable (String, Bool) async throws -> Void + private let _delete: @Sendable (AnySecret) async throws -> Void + private let _update: @Sendable (AnySecret, String) async throws -> Void public init(modifiable secretStore: SecretStoreType) where SecretStoreType: SecretStoreModifiable { _create = { try await secretStore.create(name: $0, requiresAuthentication: $1) } diff --git a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift index 0f1da098..af0dc9e6 100644 --- a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift +++ b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift @@ -15,14 +15,14 @@ import Observation /// Adds a non-type-erased SecretStore to the list. public func add(store: SecretStoreType) { - addInternal(store: AnySecretStore(store)) + stores.append(AnySecretStore(store)) } /// Adds a non-type-erased modifiable SecretStore. public func add(store: SecretStoreType) { let modifiable = AnySecretStoreModifiable(modifiable: store) modifiableStore = modifiable - addInternal(store: modifiable) + stores.append(modifiable) } /// A boolean describing whether there are any Stores available. @@ -35,14 +35,3 @@ import Observation } } - -extension SecretStoreList { - - private func addInternal(store: AnySecretStore) { - stores.append(store) -// store.objectWillChange.sink { -// self.objectWillChange.send() -// }.store(in: &cancellables) - } - -} diff --git a/Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift b/Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift index 65ceaf8e..edd6dea2 100644 --- a/Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift +++ b/Sources/Packages/Sources/SecretKit/Types/PersistedAuthenticationContext.swift @@ -1,7 +1,7 @@ import Foundation /// Protocol describing a persisted authentication context. This is an authorization that can be reused for multiple access to a secret that requires authentication for a specific period of time. -public protocol PersistedAuthenticationContext { +public protocol PersistedAuthenticationContext: Sendable { /// Whether the context remains valid. var valid: Bool { get } /// The date at which the authorization expires and the context becomes invalid. diff --git a/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift b/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift index f0a465b1..0114af72 100644 --- a/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift +++ b/Sources/Packages/Sources/SecretKit/Types/SecretStore.swift @@ -2,7 +2,7 @@ import Foundation import Combine /// Manages access to Secrets, and performs signature operations on data using those Secrets. -public protocol SecretStore: Identifiable { +public protocol SecretStore: Identifiable, Sendable { associatedtype SecretType: Secret diff --git a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift index 216033bc..371cdd59 100644 --- a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift +++ b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift @@ -21,16 +21,15 @@ extension SecureEnclave { } private let _secrets: Mutex<[Secret]> = .init([]) - private var persistedAuthenticationContexts: [Secret: PersistentAuthenticationContext] = [:] + private let persistedAuthenticationContexts: Mutex<[Secret: PersistentAuthenticationContext]> = .init([:]) /// Initializes a Store. public init() { - // FIXME: THIS -// Task { -// for await _ in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) { -// await reloadSecretsInternal(notifyAgent: false) -// } -// } + Task { + for await _ in DistributedNotificationCenter.default().notifications(named: .secretStoreUpdated) { + await reloadSecretsInternal(notifyAgent: false) + } + } loadSecrets() } @@ -106,40 +105,42 @@ extension SecureEnclave { } public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data { - let context: LAContext - if let existing = persistedAuthenticationContexts[secret], existing.valid { - context = existing.context - } else { + let context: Mutex +// if let existing = persistedAuthenticationContexts.withLock({ $0 })[secret], existing.valid { +// context = existing.context +// } else { let newContext = LAContext() newContext.localizedCancelTitle = String(localized: "auth_context_request_deny_button") - context = newContext - } - context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)") - let attributes = KeychainDictionary([ - kSecClass: kSecClassKey, - kSecAttrKeyClass: kSecAttrKeyClassPrivate, - kSecAttrApplicationLabel: secret.id as CFData, - kSecAttrKeyType: Constants.keyType, - kSecAttrTokenID: kSecAttrTokenIDSecureEnclave, - kSecAttrApplicationTag: Constants.keyTag, - kSecUseAuthenticationContext: context, - kSecReturnRef: true + context = .init(newContext) +// } + return try context.withLock { context in + context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)") + let attributes = KeychainDictionary([ + kSecClass: kSecClassKey, + kSecAttrKeyClass: kSecAttrKeyClassPrivate, + kSecAttrApplicationLabel: secret.id as CFData, + kSecAttrKeyType: Constants.keyType, + kSecAttrTokenID: kSecAttrTokenIDSecureEnclave, + kSecAttrApplicationTag: Constants.keyTag, + kSecUseAuthenticationContext: context, + kSecReturnRef: true ]) - var untyped: CFTypeRef? - let status = SecItemCopyMatching(attributes, &untyped) - if status != errSecSuccess { - throw KeychainError(statusCode: status) - } - guard let untypedSafe = untyped else { - throw KeychainError(statusCode: errSecSuccess) - } - let key = untypedSafe as! SecKey - var signError: SecurityError? - - guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else { - throw SigningError(error: signError) + var untyped: CFTypeRef? + let status = SecItemCopyMatching(attributes, &untyped) + if status != errSecSuccess { + throw KeychainError(statusCode: status) + } + guard let untypedSafe = untyped else { + throw KeychainError(statusCode: errSecSuccess) + } + let key = untypedSafe as! SecKey + var signError: SecurityError? + + guard let signature = SecKeyCreateSignature(key, .ecdsaSignatureMessageX962SHA256, data as CFData, &signError) else { + throw SigningError(error: signError) + } + return signature as Data } - return signature as Data } public func verify(signature: Data, for data: Data, with secret: Secret) throws -> Bool { @@ -178,7 +179,7 @@ extension SecureEnclave { } public func existingPersistedAuthenticationContext(secret: Secret) -> PersistedAuthenticationContext? { - guard let persisted = persistedAuthenticationContexts[secret], persisted.valid else { return nil } + guard let persisted = persistedAuthenticationContexts.withLock({ $0 })[secret], persisted.valid else { return nil } return persisted } @@ -197,9 +198,11 @@ extension SecureEnclave { newContext.localizedReason = String(localized: "auth_context_persist_for_duration_unknown_\(secret.name)") } newContext.evaluatePolicy(LAPolicy.deviceOwnerAuthentication, localizedReason: newContext.localizedReason) { [weak self] success, _ in - guard success else { return } + guard success, let self else { return } let context = PersistentAuthenticationContext(secret: secret, context: newContext, duration: duration) - self?.persistedAuthenticationContexts[secret] = context + self.persistedAuthenticationContexts.withLock { + $0[secret] = context + } } } @@ -322,12 +325,12 @@ extension SecureEnclave { extension SecureEnclave { /// A context describing a persisted authentication. - private struct PersistentAuthenticationContext: PersistedAuthenticationContext { + private final class PersistentAuthenticationContext: PersistedAuthenticationContext { /// The Secret to persist authentication for. let secret: Secret /// The LAContext used to authorize the persistent context. - let context: LAContext + nonisolated(unsafe) let context: LAContext /// An expiration date for the context. /// - Note - Monotonic time instead of Date() to prevent people setting the clock back. let monotonicExpiration: UInt64 diff --git a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift index 12805086..1aead353 100644 --- a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift +++ b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift @@ -1,5 +1,6 @@ import Foundation -import Combine +import Synchronization +import Observation import Security import CryptoTokenKit import LocalAuthentication @@ -8,32 +9,54 @@ import SecretKit extension SmartCard { /// An implementation of Store backed by a Smart Card. - public final class Store: SecretStore { + @Observable public final class Store: SecretStore { + + public var isAvailable: Bool { + _isAvailable.withLock { $0 } + } + private let _isAvailable: Mutex = .init(false) - @Published public var isAvailable: Bool = false public let id = UUID() - public private(set) var name = String(localized: "smart_card") - @Published public private(set) var secrets: [Secret] = [] - private let watcher = TKTokenWatcher() - private var tokenID: String? + public var name: String { + _name.withLock { $0 } + } + private let _name: Mutex = .init(String(localized: "smart_card")) + public var secrets: [Secret] { + _secrets.withLock { $0 } + } + private let _secrets: Mutex<[Secret]> = .init([]) + private let watcher: Mutex = .init(TKTokenWatcher()) + private let tokenID: Mutex = .init(nil) /// Initializes a Store. public init() { - tokenID = watcher.nonSecureEnclaveTokens.first - // FIXME: THIS - watcher.setInsertionHandler { string in - guard self.tokenID == nil else { return } - guard !string.contains("setoken") else { return } - - self.tokenID = string -// DispatchQueue.main.async { -// reload() -// } - self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string) + tokenID.withLock { tokenID in + watcher.withLock { watcher in + let id = watcher.nonSecureEnclaveTokens.first + watcher.setInsertionHandler { string in +// guard self.tokenID == nil else { return } +// guard !string.contains("setoken") else { return } +// +//// self.tokenID.withLock { +//// $0 = string +//// } +// // DispatchQueue.main.async { +// // reload() +// // } +// watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string) + } + tokenID = id + } } - if let tokenID = tokenID { - self.isAvailable = true - self.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID) + // FIXME: THIS + if let tokenID = tokenID.withLock({ $0 }) { + _isAvailable.withLock { + $0 = true + } + watcher.withLock { + $0.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID) + + } } loadSecrets() } @@ -49,7 +72,7 @@ extension SmartCard { } public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data { - guard let tokenID = tokenID else { fatalError() } + guard let tokenID = tokenID.withLock({ $0 }) else { fatalError() } let context = LAContext() context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)") context.localizedCancelTitle = String(localized: "auth_context_request_deny_button") @@ -119,9 +142,13 @@ extension SmartCard { extension SmartCard.Store { private func reloadSecretsInternal() { - self.isAvailable = self.tokenID != nil + _isAvailable.withLock { + $0 = tokenID.withLock({ $0 }) != nil + } let before = self.secrets - self.secrets.removeAll() + self._secrets.withLock { + $0.removeAll() + } self.loadSecrets() if self.secrets != before { NotificationCenter.default.post(name: .secretStoreReloaded, object: self) @@ -131,19 +158,23 @@ extension SmartCard.Store { /// Resets the token ID and reloads secrets. /// - Parameter tokenID: The ID of the token that was removed. private func smartcardRemoved(for tokenID: String? = nil) { - self.tokenID = nil + self.tokenID.withLock { + $0 = nil + } reloadSecrets() } /// Loads all secrets from the store. private func loadSecrets() { - guard let tokenID = tokenID else { return } + guard let tokenID = tokenID.withLock({ $0 }) else { return } let fallbackName = String(localized: "smart_card") - if let driverName = watcher.tokenInfo(forTokenID: tokenID)?.driverName { - name = driverName - } else { - name = fallbackName + _name.withLock { + if let driverName = watcher.withLock({ $0.tokenInfo(forTokenID: tokenID)?.driverName }) { + $0 = driverName + } else { + $0 = fallbackName + } } let attributes = KeychainDictionary([ @@ -167,7 +198,9 @@ extension SmartCard.Store { let publicKey = publicKeyAttributes[kSecValueData] as! Data return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey) } - secrets.append(contentsOf: wrapped) + _secrets.withLock { + $0.append(contentsOf: wrapped) + } } } @@ -211,7 +244,7 @@ extension SmartCard.Store { /// - Returns: The decrypted data. /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged. public func decrypt(data: Data, with secret: SecretType) throws -> Data { - guard let tokenID = tokenID else { fatalError() } + guard let tokenID = tokenID.withLock({ $0 }) else { fatalError() } let context = LAContext() context.localizedReason = String(localized: "auth_context_request_decrypt_description_\(secret.name)") context.localizedCancelTitle = String(localized: "auth_context_request_deny_button") diff --git a/Sources/Secretive/App.swift b/Sources/Secretive/App.swift index fbd7e5ed..8d6ed8b2 100644 --- a/Sources/Secretive/App.swift +++ b/Sources/Secretive/App.swift @@ -69,26 +69,24 @@ struct Secretive: App { extension Secretive { private func reinstallAgent() { -// justUpdatedChecker.check() - // FIXME: THIS -// LaunchAgentController().install { -// // Wait a second for launchd to kick in (next runloop isn't enough). -// DispatchQueue.main.asyncAfter(deadline: .now() + 1) { -// agentStatusChecker.check() -// if !agentStatusChecker.running { -// forceLaunchAgent() -// } -// } -// } + justUpdatedChecker.check() + Task { + await LaunchAgentController().install() + try? await Task.sleep(for: .seconds(1)) + agentStatusChecker.check() + if !agentStatusChecker.running { + forceLaunchAgent() + } + } } private func forceLaunchAgent() { // We've run setup, we didn't just update, launchd is just not doing it's thing. // Force a launch directly. - // FIXME: THIS -// LaunchAgentController().forceLaunch { _ in -// agentStatusChecker.check() -// } + Task { + _ = await LaunchAgentController().forceLaunch() + agentStatusChecker.check() + } } } diff --git a/Sources/Secretive/Preview Content/PreviewStore.swift b/Sources/Secretive/Preview Content/PreviewStore.swift index 9480c88f..f9d631cb 100644 --- a/Sources/Secretive/Preview Content/PreviewStore.swift +++ b/Sources/Secretive/Preview Content/PreviewStore.swift @@ -18,69 +18,69 @@ extension Preview { } -extension Preview { - - class Store: SecretStore, ObservableObject { - - let isAvailable = true - let id = UUID() - var name: String { "Preview Store" } - @Published var secrets: [Secret] = [] - - init(secrets: [Secret]) { - self.secrets.append(contentsOf: secrets) - } - - init(numberOfRandomSecrets: Int = 5) { - let new = (0.. Data { - return data - } - - func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool { - true - } - - func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? { - nil - } - - func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws { - } - - func reloadSecrets() { - } - - } - - class StoreModifiable: Store, SecretStoreModifiable { - override var name: String { "Modifiable Preview Store" } - - func create(name: String, requiresAuthentication: Bool) throws { - } - - func delete(secret: Preview.Secret) throws { - } - - func update(secret: Preview.Secret, name: String) throws { - } - } -} - -extension Preview { - - static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList { - let list = SecretStoreList() - for store in stores { - list.add(store: store) - } - for storeModifiable in modifiableStores { - list.add(store: storeModifiable) - } - return list - } - -} +//extension Preview { +// +// class Store: SecretStore, ObservableObject { +// +// let isAvailable = true +// let id = UUID() +// var name: String { "Preview Store" } +// @Published var secrets: [Secret] = [] +// +// init(secrets: [Secret]) { +// self.secrets.append(contentsOf: secrets) +// } +// +// init(numberOfRandomSecrets: Int = 5) { +// let new = (0.. Data { +// return data +// } +// +// func verify(signature data: Data, for signature: Data, with secret: Preview.Secret) throws -> Bool { +// true +// } +// +// func existingPersistedAuthenticationContext(secret: Preview.Secret) -> PersistedAuthenticationContext? { +// nil +// } +// +// func persistAuthentication(secret: Preview.Secret, forDuration duration: TimeInterval) throws { +// } +// +// func reloadSecrets() { +// } +// +// } +// +// class StoreModifiable: Store, SecretStoreModifiable { +// override var name: String { "Modifiable Preview Store" } +// +// func create(name: String, requiresAuthentication: Bool) throws { +// } +// +// func delete(secret: Preview.Secret) throws { +// } +// +// func update(secret: Preview.Secret, name: String) throws { +// } +// } +//} +// +//extension Preview { +// +// static func storeList(stores: [Store] = [], modifiableStores: [StoreModifiable] = []) -> SecretStoreList { +// let list = SecretStoreList() +// for store in stores { +// list.add(store: store) +// } +// for storeModifiable in modifiableStores { +// list.add(store: storeModifiable) +// } +// return list +// } +// +//} diff --git a/Sources/Secretive/Views/ContentView.swift b/Sources/Secretive/Views/ContentView.swift index c48991c5..c556e644 100644 --- a/Sources/Secretive/Views/ContentView.swift +++ b/Sources/Secretive/Views/ContentView.swift @@ -193,41 +193,41 @@ extension ContentView { } -#if DEBUG - -struct ContentView_Previews: PreviewProvider { - - private static let storeList: SecretStoreList = { - let list = SecretStoreList() - list.add(store: SecureEnclave.Store()) - list.add(store: SmartCard.Store()) - return list - }() - private static let agentStatusChecker = AgentStatusChecker() - private static let justUpdatedChecker = JustUpdatedChecker() - - @State var hasRunSetup = false - @State private var showingSetup = false - @State private var showingCreation = false - - static var previews: some View { - Group { - // Empty on modifiable and nonmodifiable - ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true)) - .environmentObject(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)])) - .environmentObject(PreviewUpdater()) - .environmentObject(agentStatusChecker) - - // 5 items on modifiable and nonmodifiable - ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true)) - .environmentObject(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()])) - .environmentObject(PreviewUpdater()) - .environmentObject(agentStatusChecker) - } - .environmentObject(agentStatusChecker) - - } -} - -#endif +//#if DEBUG +// +//struct ContentView_Previews: PreviewProvider { +// +// private static let storeList: SecretStoreList = { +// let list = SecretStoreList() +// list.add(store: SecureEnclave.Store()) +// list.add(store: SmartCard.Store()) +// return list +// }() +// private static let agentStatusChecker = AgentStatusChecker() +// private static let justUpdatedChecker = JustUpdatedChecker() +// +// @State var hasRunSetup = false +// @State private var showingSetup = false +// @State private var showingCreation = false +// +// static var previews: some View { +// Group { +// // Empty on modifiable and nonmodifiable +// ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true)) +// .environmentObject(Preview.storeList(stores: [Preview.Store(numberOfRandomSecrets: 0)], modifiableStores: [Preview.StoreModifiable(numberOfRandomSecrets: 0)])) +// .environmentObject(PreviewUpdater()) +// .environmentObject(agentStatusChecker) +// +// // 5 items on modifiable and nonmodifiable +// ContentView(showingCreation: .constant(false), runningSetup: .constant(false), hasRunSetup: .constant(true)) +// .environmentObject(Preview.storeList(stores: [Preview.Store()], modifiableStores: [Preview.StoreModifiable()])) +// .environmentObject(PreviewUpdater()) +// .environmentObject(agentStatusChecker) +// } +// .environmentObject(agentStatusChecker) +// +// } +//} +// +//#endif diff --git a/Sources/Secretive/Views/CreateSecretView.swift b/Sources/Secretive/Views/CreateSecretView.swift index 4190c997..60eac1f2 100644 --- a/Sources/Secretive/Views/CreateSecretView.swift +++ b/Sources/Secretive/Views/CreateSecretView.swift @@ -45,9 +45,10 @@ struct CreateSecretView: View { } func save() { - // FIXME: THIS -// try! store.create(name: name, requiresAuthentication: requiresAuthentication) - showing = false + Task { + try! await store.create(name: name, requiresAuthentication: requiresAuthentication) + showing = false + } } } @@ -231,19 +232,19 @@ struct NotificationView: View { } -#if DEBUG - -struct CreateSecretView_Previews: PreviewProvider { - - static var previews: some View { - Group { - CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true)) - AuthenticationView().environment(\.colorScheme, .dark) - AuthenticationView().environment(\.colorScheme, .light) - NotificationView().environment(\.colorScheme, .dark) - NotificationView().environment(\.colorScheme, .light) - } - } -} - -#endif +//#if DEBUG +// +//struct CreateSecretView_Previews: PreviewProvider { +// +// static var previews: some View { +// Group { +// CreateSecretView(store: Preview.StoreModifiable(), showing: .constant(true)) +// AuthenticationView().environment(\.colorScheme, .dark) +// AuthenticationView().environment(\.colorScheme, .light) +// NotificationView().environment(\.colorScheme, .dark) +// NotificationView().environment(\.colorScheme, .light) +// } +// } +//} +// +//#endif diff --git a/Sources/Secretive/Views/DeleteSecretView.swift b/Sources/Secretive/Views/DeleteSecretView.swift index d5c4e19f..3be07c28 100644 --- a/Sources/Secretive/Views/DeleteSecretView.swift +++ b/Sources/Secretive/Views/DeleteSecretView.swift @@ -49,9 +49,10 @@ struct DeleteSecretView: View { } func delete() { - // FIXME: THIS -// try! store.delete(secret: secret) - dismissalBlock(true) + Task { + try! await store.delete(secret: secret) + dismissalBlock(true) + } } } diff --git a/Sources/Secretive/Views/RenameSecretView.swift b/Sources/Secretive/Views/RenameSecretView.swift index 1a2b664b..0a417cbd 100644 --- a/Sources/Secretive/Views/RenameSecretView.swift +++ b/Sources/Secretive/Views/RenameSecretView.swift @@ -44,8 +44,9 @@ struct RenameSecretView: View { } func rename() { - // FIXME: THIS -// try? await store.update(secret: secret, name: newName) - dismissalBlock(true) + Task { + try? await store.update(secret: secret, name: newName) + dismissalBlock(true) + } } } diff --git a/Sources/Secretive/Views/SecretDetailView.swift b/Sources/Secretive/Views/SecretDetailView.swift index aefe49d7..62a77ca9 100644 --- a/Sources/Secretive/Views/SecretDetailView.swift +++ b/Sources/Secretive/Views/SecretDetailView.swift @@ -47,12 +47,12 @@ struct SecretDetailView: View { } -#if DEBUG - -struct SecretDetailView_Previews: PreviewProvider { - static var previews: some View { - SecretDetailView(secret: Preview.Store(numberOfRandomSecrets: 1).secrets[0]) - } -} - -#endif +//#if DEBUG +// +//struct SecretDetailView_Previews: PreviewProvider { +// static var previews: some View { +// SecretDetailView(secret: Preview.Store(numberOfRandomSecrets: 1).secrets[0]) +// } +//} +// +//#endif From c2563be4046932859a82482a4ed3614a317e7c07 Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Sat, 4 Jan 2025 01:06:54 -0800 Subject: [PATCH 04/12] Fix concurrency issues in SmartCardStore --- .../SmartCardSecretKit/SmartCardStore.swift | 101 +++++++++--------- 1 file changed, 51 insertions(+), 50 deletions(-) diff --git a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift index 1aead353..199e4cde 100644 --- a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift +++ b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift @@ -7,55 +7,44 @@ import LocalAuthentication import SecretKit extension SmartCard { + + private struct State { + var isAvailable = false + var name = String(localized: "smart_card") + var secrets: [Secret] = [] + let watcher = TKTokenWatcher() + var tokenID: String? = nil + } /// An implementation of Store backed by a Smart Card. @Observable public final class Store: SecretStore { + private let state: Mutex = .init(.init()) public var isAvailable: Bool { - _isAvailable.withLock { $0 } + state.withLock { $0.isAvailable } } - private let _isAvailable: Mutex = .init(false) public let id = UUID() public var name: String { - _name.withLock { $0 } + state.withLock { $0.name } } - private let _name: Mutex = .init(String(localized: "smart_card")) public var secrets: [Secret] { - _secrets.withLock { $0 } + state.withLock { $0.secrets } } - private let _secrets: Mutex<[Secret]> = .init([]) - private let watcher: Mutex = .init(TKTokenWatcher()) - private let tokenID: Mutex = .init(nil) /// Initializes a Store. public init() { - tokenID.withLock { tokenID in - watcher.withLock { watcher in - let id = watcher.nonSecureEnclaveTokens.first - watcher.setInsertionHandler { string in -// guard self.tokenID == nil else { return } -// guard !string.contains("setoken") else { return } -// -//// self.tokenID.withLock { -//// $0 = string -//// } -// // DispatchQueue.main.async { -// // reload() -// // } -// watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string) - } - tokenID = id + state.withLock { state in + if let tokenID = state.tokenID { + state.isAvailable = true + state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID) } - } - // FIXME: THIS - if let tokenID = tokenID.withLock({ $0 }) { - _isAvailable.withLock { - $0 = true - } - watcher.withLock { - $0.addRemovalHandler(self.smartcardRemoved, forTokenID: tokenID) - + state.watcher.setInsertionHandler { id in + // Setting insertion handler will cause it to be called immediately. + // Make a thread jump so we don't hit a recursive lock attempt. + Task { + self.smartcardInserted(for: id) + } } } loadSecrets() @@ -72,7 +61,7 @@ extension SmartCard { } public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data { - guard let tokenID = tokenID.withLock({ $0 }) else { fatalError() } + guard let tokenID = state.withLock({ $0.tokenID }) else { fatalError() } let context = LAContext() context.localizedReason = String(localized: "auth_context_request_signature_description_\(provenance.origin.displayName)_\(secret.name)") context.localizedCancelTitle = String(localized: "auth_context_request_deny_button") @@ -142,12 +131,11 @@ extension SmartCard { extension SmartCard.Store { private func reloadSecretsInternal() { - _isAvailable.withLock { - $0 = tokenID.withLock({ $0 }) != nil - } - let before = self.secrets - self._secrets.withLock { - $0.removeAll() + let before = state.withLock { + $0.isAvailable = $0.tokenID != nil + let before = $0.secrets + $0.secrets.removeAll() + return before } self.loadSecrets() if self.secrets != before { @@ -155,25 +143,38 @@ extension SmartCard.Store { } } + /// Resets the token ID and reloads secrets. + /// - Parameter tokenID: The ID of the token that was inserted. + private func smartcardInserted(for tokenID: String? = nil) { + state.withLock { state in + guard let string = state.watcher.nonSecureEnclaveTokens.first else { return } + guard state.tokenID == nil else { return } + guard !string.contains("setoken") else { return } + state.tokenID = string + state.watcher.addRemovalHandler(self.smartcardRemoved, forTokenID: string) + state.tokenID = string + } + } + /// Resets the token ID and reloads secrets. /// - Parameter tokenID: The ID of the token that was removed. private func smartcardRemoved(for tokenID: String? = nil) { - self.tokenID.withLock { - $0 = nil + state.withLock { + $0.tokenID = nil } reloadSecrets() } /// Loads all secrets from the store. private func loadSecrets() { - guard let tokenID = tokenID.withLock({ $0 }) else { return } + guard let tokenID = state.withLock({ $0.tokenID }) else { return } let fallbackName = String(localized: "smart_card") - _name.withLock { - if let driverName = watcher.withLock({ $0.tokenInfo(forTokenID: tokenID)?.driverName }) { - $0 = driverName + state.withLock { + if let driverName = $0.watcher.tokenInfo(forTokenID: tokenID)?.driverName { + $0.name = driverName } else { - $0 = fallbackName + $0.name = fallbackName } } @@ -198,8 +199,8 @@ extension SmartCard.Store { let publicKey = publicKeyAttributes[kSecValueData] as! Data return SmartCard.Secret(id: tokenID, name: name, algorithm: algorithm, keySize: keySize, publicKey: publicKey) } - _secrets.withLock { - $0.append(contentsOf: wrapped) + state.withLock { + $0.secrets.append(contentsOf: wrapped) } } @@ -244,7 +245,7 @@ extension SmartCard.Store { /// - Returns: The decrypted data. /// - Warning: Encryption functions are deliberately only exposed on a library level, and are not exposed in Secretive itself to prevent users from data loss. Any pull requests which expose this functionality in the app will not be merged. public func decrypt(data: Data, with secret: SecretType) throws -> Data { - guard let tokenID = tokenID.withLock({ $0 }) else { fatalError() } + guard let tokenID = state.withLock({ $0.tokenID }) else { fatalError() } let context = LAContext() context.localizedReason = String(localized: "auth_context_request_decrypt_description_\(secret.name)") context.localizedCancelTitle = String(localized: "auth_context_request_deny_button") From 28a4dafad4449fc1f212a3677178cb36111a9519 Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Sat, 4 Jan 2025 01:10:57 -0800 Subject: [PATCH 05/12] Switch to SMAppService --- .../Controllers/LaunchAgentController.swift | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/Sources/Secretive/Controllers/LaunchAgentController.swift b/Sources/Secretive/Controllers/LaunchAgentController.swift index 2cf72e2e..a65f8b0b 100644 --- a/Sources/Secretive/Controllers/LaunchAgentController.swift +++ b/Sources/Secretive/Controllers/LaunchAgentController.swift @@ -26,7 +26,7 @@ struct LaunchAgentController { let config = NSWorkspace.OpenConfiguration() config.activates = false do { - let app = try await NSWorkspace.shared.openApplication(at: url, configuration: config) + try await NSWorkspace.shared.openApplication(at: url, configuration: config) logger.debug("Agent force launched") return true } catch { @@ -36,8 +36,17 @@ struct LaunchAgentController { } private func setEnabled(_ enabled: Bool) -> Bool { - // FIXME: THIS - SMLoginItemSetEnabled(Bundle.main.agentBundleID as CFString, enabled) + let service = SMAppService.loginItem(identifier: Bundle.main.agentBundleID) + do { + if enabled { + try service.register() + } else { + try service.unregister() + } + return true + } catch { + return false + } } } From c09ad3ecc12d29f814ef8c780243095b1d84965d Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Sat, 4 Jan 2025 15:26:49 -0800 Subject: [PATCH 06/12] Bump runners --- .github/workflows/nightly.yml | 4 ++-- .github/workflows/release.yml | 8 ++++---- .github/workflows/test.yml | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index a8e40ab4..37b75654 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -6,7 +6,7 @@ on: jobs: build: # runs-on: macOS-latest - runs-on: macos-14 + runs-on: macos-15 timeout-minutes: 10 steps: - uses: actions/checkout@v4 @@ -20,7 +20,7 @@ jobs: APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} run: ./.github/scripts/signing.sh - name: Set Environment - run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app + run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app - name: Update Build Number env: RUN_ID: ${{ github.run_id }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a1352031..b6818b4a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,7 +7,7 @@ on: jobs: test: # runs-on: macOS-latest - runs-on: macos-14 + runs-on: macos-15 timeout-minutes: 10 steps: - uses: actions/checkout@v4 @@ -21,7 +21,7 @@ jobs: APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} run: ./.github/scripts/signing.sh - name: Set Environment - run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app + run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app - name: Test run: | pushd Sources/Packages @@ -29,7 +29,7 @@ jobs: popd build: # runs-on: macOS-latest - runs-on: macos-14 + runs-on: macos-15 timeout-minutes: 10 steps: - uses: actions/checkout@v4 @@ -43,7 +43,7 @@ jobs: APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }} run: ./.github/scripts/signing.sh - name: Set Environment - run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app + run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app - name: Update Build Number env: TAG_NAME: ${{ github.ref }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 74bc0666..3f0f70be 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -4,12 +4,12 @@ on: [push, pull_request] jobs: test: # runs-on: macOS-latest - runs-on: macos-14 + runs-on: macos-15 timeout-minutes: 10 steps: - uses: actions/checkout@v4 - name: Set Environment - run: sudo xcrun xcode-select -s /Applications/Xcode_15.4.app + run: sudo xcrun xcode-select -s /Applications/Xcode_16.2.app - name: Test run: | pushd Sources/Packages From e332b7cb9dfdd53bb9ca07d3c657ab8dd2e99405 Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Sat, 4 Jan 2025 23:16:47 -0800 Subject: [PATCH 07/12] Base --- .../Sources/SecretKit/Erasers/AnySecretStore.swift | 2 ++ .../Tests/SecretAgentKitTests/AgentTests.swift | 10 +++++----- .../SecretAgentKitTests/StubFileHandleWriter.swift | 2 +- .../Packages/Tests/SecretAgentKitTests/StubStore.swift | 2 +- 4 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift b/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift index 93d24602..af6e9b3f 100644 --- a/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift +++ b/Sources/Packages/Sources/SecretKit/Erasers/AnySecretStore.swift @@ -4,6 +4,7 @@ import Combine /// Type eraser for SecretStore. public class AnySecretStore: SecretStore, @unchecked Sendable { + let base: Any private let _isAvailable: @Sendable () -> Bool private let _id: @Sendable () -> UUID private let _name: @Sendable () -> String @@ -15,6 +16,7 @@ public class AnySecretStore: SecretStore, @unchecked Sendable { private let _reloadSecrets: @Sendable () async -> Void public init(_ secretStore: SecretStoreType) where SecretStoreType: SecretStore { + base = secretStore _isAvailable = { secretStore.isAvailable } _name = { secretStore.name } _id = { secretStore.id } diff --git a/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift b/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift index d5ffd377..87534568 100644 --- a/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift +++ b/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift @@ -35,7 +35,7 @@ class AgentTests: XCTestCase { // XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure) } - func testSignature() async { + func testSignature() async throws { let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...]) _ = requestReader.readNextChunk() @@ -63,10 +63,10 @@ class AgentTests: XCTestCase { let signature = try! P256.Signing.ECDSASignature(rawRepresentation: rs) let referenceValid = try! P256.Signing.PublicKey(x963Representation: Constants.Secrets.ecdsa256Secret.publicKey).isValidSignature(signature, for: dataToSign) let store = list.stores.first! - let derVerifies = try! store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret)) - let invalidRandomSignature = try? store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret)) - let invalidRandomData = try? store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret)) - let invalidWrongKey = try? store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret)) + let derVerifies = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret)) + let invalidRandomSignature = try await store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret)) + let invalidRandomData = try await store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret)) + let invalidWrongKey = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret)) XCTAssertTrue(referenceValid) XCTAssertTrue(derVerifies) XCTAssert(invalidRandomSignature == false) diff --git a/Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift b/Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift index 5b35aefb..798a7e2f 100644 --- a/Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift +++ b/Sources/Packages/Tests/SecretAgentKitTests/StubFileHandleWriter.swift @@ -1,7 +1,7 @@ import Foundation import SecretAgentKit -class StubFileHandleWriter: FileHandleWriter { +class StubFileHandleWriter: FileHandleWriter, @unchecked Sendable { var data = Data() diff --git a/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift b/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift index f990f976..a390e251 100644 --- a/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift +++ b/Sources/Packages/Tests/SecretAgentKitTests/StubStore.swift @@ -6,7 +6,7 @@ struct Stub {} extension Stub { - public final class Store: SecretStore { + public final class Store: SecretStore, @unchecked Sendable { public let isAvailable = true public let id = UUID() From 8e707545d1011cd93777165161d20f24b8365097 Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Sun, 5 Jan 2025 00:22:11 -0800 Subject: [PATCH 08/12] Finish Testing migration --- .../BriefTests/ReleaseParsingTests.swift | 78 +++++----- .../Tests/BriefTests/SemVerTests.swift | 37 ++--- .../SecretAgentKitTests/AgentTests.swift | 54 +++---- .../Tests/SecretKitTests/AnySecretTests.swift | 16 +- .../SecretKitTests/OpenSSHReaderTests.swift | 12 +- .../SecretKitTests/OpenSSHWriterTests.swift | 36 ++--- Sources/Secretive.xcodeproj/project.pbxproj | 143 ------------------ Sources/SecretiveTests/Info.plist | 22 --- Sources/SecretiveTests/SecretiveTests.swift | 20 --- 9 files changed, 120 insertions(+), 298 deletions(-) delete mode 100644 Sources/SecretiveTests/Info.plist delete mode 100644 Sources/SecretiveTests/SecretiveTests.swift diff --git a/Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift b/Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift index 74af9eed..044a0569 100644 --- a/Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift +++ b/Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift @@ -1,54 +1,66 @@ -import XCTest +import Testing +import Foundation @testable import Brief -class ReleaseParsingTests: XCTestCase { - func testNonCritical() { +@Suite struct ReleaseParsingTests { + + @Test + func nonCritical() { let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release") - XCTAssert(release.critical == false) + #expect(release.critical == false) } - func testCritical() { + @Test + func critical() { let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update") - XCTAssert(release.critical == true) + #expect(release.critical == true) } - func testOSMissing() { + @Test + func osMissing() { let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update") - XCTAssert(release.minimumOSVersion == SemVer("11.0.0")) + #expect(release.minimumOSVersion == SemVer("11.0.0")) } - func testOSPresentWithContentBelow() { + @Test + func osPresentWithContentBelow() { let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update ##Minimum macOS Version\n1.2.3\nBuild info") - XCTAssert(release.minimumOSVersion == SemVer("1.2.3")) + #expect(release.minimumOSVersion == SemVer("1.2.3")) } - func testOSPresentAtEnd() { + @Test + func osPresentAtEnd() { let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3") - XCTAssert(release.minimumOSVersion == SemVer("1.2.3")) + #expect(release.minimumOSVersion == SemVer("1.2.3")) } - func testOSWithMacOSPrefix() { + @Test + func osWithMacOSPrefix() { let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: macOS 1.2.3") - XCTAssert(release.minimumOSVersion == SemVer("1.2.3")) + #expect(release.minimumOSVersion == SemVer("1.2.3")) } - func testOSGreaterThanMinimum() { + @Test + func osGreaterThanMinimum() { let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3") - XCTAssert(release.minimumOSVersion < SemVer("11.0.0")) + #expect(release.minimumOSVersion < SemVer("11.0.0")) } - func testOSEqualToMinimum() { + @Test + func osEqualToMinimum() { let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 11.2.3") - XCTAssert(release.minimumOSVersion <= SemVer("11.2.3")) + #expect(release.minimumOSVersion <= SemVer("11.2.3")) } - func testOSLessThanMinimum() { + @Test + func osLessThanMinimum() { let release = Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Critical Security Update Minimum macOS Version: 1.2.3") - XCTAssert(release.minimumOSVersion > SemVer("1.0.0")) + #expect(release.minimumOSVersion > SemVer("1.0.0")) } - func testGreatestSelectedIfOldPatchIsPublishedLater() { + @Test + func greatestSelectedIfOldPatchIsPublishedLater() async throws { // If 2.x.x series has been published, and a patch for 1.x.x is issued // 2.x.x should still be selected if user can run it. let updater = Updater(checkOnLaunch: false, osVersion: SemVer("2.2.3"), currentVersion: SemVer("1.0.0")) @@ -60,16 +72,13 @@ class ReleaseParsingTests: XCTestCase { Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"), ] - let expectation = XCTestExpectation() updater.evaluate(releases: releases) - DispatchQueue.main.async { - XCTAssert(updater.update == two) - expectation.fulfill() - } - wait(for: [expectation], timeout: 1) + try await Task.sleep(nanoseconds: 500) + #expect(updater.update == two) } - func testLatestVersionIsRunnable() { + @Test + func latestVersionIsRunnable() async throws { // If the 2.x.x series has been published but the user can't run it // the last version the user can run should be selected. let updater = Updater(checkOnLaunch: false, osVersion: SemVer("1.2.3"), currentVersion: SemVer("1.0.0")) @@ -80,16 +89,13 @@ class ReleaseParsingTests: XCTestCase { Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available! Minimum macOS Version: 2.2.3"), Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"), ] - let expectation = XCTestExpectation() updater.evaluate(releases: releases) - DispatchQueue.main.async { - XCTAssert(updater.update == oneOhTwo) - expectation.fulfill() - } - wait(for: [expectation], timeout: 1) + try await Task.sleep(nanoseconds: 500) + #expect(updater.update == oneOhTwo) } - func testSorting() { + @Test + func sorting() { let two = Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available!") let releases = [ Release(name: "1.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Initial release"), @@ -98,7 +104,7 @@ class ReleaseParsingTests: XCTestCase { Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch!"), ] let sorted = releases.sorted().reversed().first - XCTAssert(sorted == two) + #expect(sorted == two) } } diff --git a/Sources/Packages/Tests/BriefTests/SemVerTests.swift b/Sources/Packages/Tests/BriefTests/SemVerTests.swift index f7ee3321..5cd57385 100644 --- a/Sources/Packages/Tests/BriefTests/SemVerTests.swift +++ b/Sources/Packages/Tests/BriefTests/SemVerTests.swift @@ -1,51 +1,52 @@ -import XCTest +import Testing +import Foundation @testable import Brief -class SemVerTests: XCTestCase { +@Suite struct SemVerTests { - func testEqual() { + @Test func equal() { let current = SemVer("1.0.2") let old = SemVer("1.0.2") - XCTAssert(!(current > old)) + #expect(!(current > old)) } - func testPatchGreaterButMinorLess() { + @Test func patchGreaterButMinorLess() { let current = SemVer("1.1.0") let old = SemVer("1.0.2") - XCTAssert(current > old) + #expect(current > old) } - func testMajorSameMinorGreater() { + @Test func majorSameMinorGreater() { let current = SemVer("1.0.2") let new = SemVer("1.0.3") - XCTAssert(current < new) + #expect(current < new) } - func testMajorGreaterMinorLesser() { + @Test func majorGreaterMinorLesser() { let current = SemVer("1.0.2") let new = SemVer("2.0.0") - XCTAssert(current < new) + #expect(current < new) } - func testRegularParsing() { + @Test func regularParsing() { let current = SemVer("1.0.2") - XCTAssert(current.versionNumbers == [1, 0, 2]) + #expect(current.versionNumbers == [1, 0, 2]) } - func testNoPatch() { + @Test func noPatch() { let current = SemVer("1.1") - XCTAssert(current.versionNumbers == [1, 1, 0]) + #expect(current.versionNumbers == [1, 1, 0]) } - func testGarbage() { + @Test func garbage() { let current = SemVer("Test") - XCTAssert(current.versionNumbers == [0, 0, 0]) + #expect(current.versionNumbers == [0, 0, 0]) } - func testBeta() { + @Test func beta() { let current = SemVer("1.0.2") let new = SemVer("1.1.0_beta1") - XCTAssert(current < new) + #expect(current < new) } } diff --git a/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift b/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift index 87534568..c99ae985 100644 --- a/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift +++ b/Sources/Packages/Tests/SecretAgentKitTests/AgentTests.swift @@ -1,41 +1,41 @@ import Foundation -import XCTest +import Testing import CryptoKit @testable import SecretKit @testable import SecretAgentKit -class AgentTests: XCTestCase { +@Suite struct AgentTests { let stubWriter = StubFileHandleWriter() // MARK: Identity Listing - func testEmptyStores() async { + @Test func emptyStores() async { let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities) let agent = Agent(storeList: SecretStoreList()) await agent.handle(reader: stubReader, writer: stubWriter) - XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesEmpty) + #expect(stubWriter.data == Constants.Responses.requestIdentitiesEmpty) } - func testIdentitiesList() async { + @Test func identitiesList() async { let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestIdentities) let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret]) let agent = Agent(storeList: list) await agent.handle(reader: stubReader, writer: stubWriter) - XCTAssertEqual(stubWriter.data, Constants.Responses.requestIdentitiesMultiple) + #expect(stubWriter.data == Constants.Responses.requestIdentitiesMultiple) } // MARK: Signatures - func testNoMatchingIdentities() async { + @Test func noMatchingIdentities() async { let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignatureWithNoneMatching) let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret]) let agent = Agent(storeList: list) await agent.handle(reader: stubReader, writer: stubWriter) -// XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure) + #expect(stubWriter.data == Constants.Responses.requestFailure) } - func testSignature() async throws { + @Test func signature() async throws { let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let requestReader = OpenSSHReader(data: Constants.Requests.requestSignature[5...]) _ = requestReader.readNextChunk() @@ -67,16 +67,16 @@ class AgentTests: XCTestCase { let invalidRandomSignature = try await store.verify(signature: "invalid".data(using: .utf8)!, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa256Secret)) let invalidRandomData = try await store.verify(signature: signature.derRepresentation, for: "invalid".data(using: .utf8)!, with: AnySecret(Constants.Secrets.ecdsa256Secret)) let invalidWrongKey = try await store.verify(signature: signature.derRepresentation, for: dataToSign, with: AnySecret(Constants.Secrets.ecdsa384Secret)) - XCTAssertTrue(referenceValid) - XCTAssertTrue(derVerifies) - XCTAssert(invalidRandomSignature == false) - XCTAssert(invalidRandomData == false) - XCTAssert(invalidWrongKey == false) + #expect(referenceValid) + #expect(derVerifies) + #expect(invalidRandomSignature == false) + #expect(invalidRandomData == false) + #expect(invalidWrongKey == false) } // MARK: Witness protocol - func testWitnessObjectionStopsRequest() async { + @Test func witnessObjectionStopsRequest() async { let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let list = storeList(with: [Constants.Secrets.ecdsa256Secret]) let witness = StubWitness(speakNow: { _,_ in @@ -84,10 +84,10 @@ class AgentTests: XCTestCase { }, witness: { _, _ in }) let agent = Agent(storeList: list, witness: witness) await agent.handle(reader: stubReader, writer: stubWriter) - XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure) + #expect(stubWriter.data == Constants.Responses.requestFailure) } - func testWitnessSignature() async { + @Test func witnessSignature() async { let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let list = storeList(with: [Constants.Secrets.ecdsa256Secret]) var witnessed = false @@ -98,10 +98,10 @@ class AgentTests: XCTestCase { }) let agent = Agent(storeList: list, witness: witness) await agent.handle(reader: stubReader, writer: stubWriter) - XCTAssertTrue(witnessed) + #expect(witnessed) } - func testRequestTracing() async { + @Test func requestTracing() async { let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let list = storeList(with: [Constants.Secrets.ecdsa256Secret]) var speakNowTrace: SigningRequestProvenance! = nil @@ -114,31 +114,31 @@ class AgentTests: XCTestCase { }) let agent = Agent(storeList: list, witness: witness) await agent.handle(reader: stubReader, writer: stubWriter) - XCTAssertEqual(witnessTrace, speakNowTrace) - XCTAssertEqual(witnessTrace.origin.displayName, "Finder") - XCTAssertEqual(witnessTrace.origin.validSignature, true) - XCTAssertEqual(witnessTrace.origin.parentPID, 1) + #expect(witnessTrace == speakNowTrace) + #expect(witnessTrace.origin.displayName == "Finder") + #expect(witnessTrace.origin.validSignature == true) + #expect(witnessTrace.origin.parentPID == 1) } // MARK: Exception Handling - func testSignatureException() async { + @Test func signatureException() async { let stubReader = StubFileHandleReader(availableData: Constants.Requests.requestSignature) let list = storeList(with: [Constants.Secrets.ecdsa256Secret, Constants.Secrets.ecdsa384Secret]) let store = list.stores.first?.base as! Stub.Store store.shouldThrow = true let agent = Agent(storeList: list) await agent.handle(reader: stubReader, writer: stubWriter) - XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure) + #expect(stubWriter.data == Constants.Responses.requestFailure) } // MARK: Unsupported - func testUnhandledAdd() async { + @Test func unhandledAdd() async { let stubReader = StubFileHandleReader(availableData: Constants.Requests.addIdentity) let agent = Agent(storeList: SecretStoreList()) await agent.handle(reader: stubReader, writer: stubWriter) - XCTAssertEqual(stubWriter.data, Constants.Responses.requestFailure) + #expect(stubWriter.data == Constants.Responses.requestFailure) } } diff --git a/Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift b/Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift index ee2646b1..f8229bd1 100644 --- a/Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift +++ b/Sources/Packages/Tests/SecretKitTests/AnySecretTests.swift @@ -1,19 +1,19 @@ import Foundation -import XCTest +import Testing @testable import SecretKit @testable import SecureEnclaveSecretKit @testable import SmartCardSecretKit -class AnySecretTests: XCTestCase { +@Suite struct AnySecretTests { - func testEraser() { + @Test func eraser() { let secret = SmartCard.Secret(id: UUID().uuidString.data(using: .utf8)!, name: "Name", algorithm: .ellipticCurve, keySize: 256, publicKey: UUID().uuidString.data(using: .utf8)!) let erased = AnySecret(secret) - XCTAssert(erased.id == secret.id as AnyHashable) - XCTAssert(erased.name == secret.name) - XCTAssert(erased.algorithm == secret.algorithm) - XCTAssert(erased.keySize == secret.keySize) - XCTAssert(erased.publicKey == secret.publicKey) + #expect(erased.id == secret.id as AnyHashable) + #expect(erased.name == secret.name) + #expect(erased.algorithm == secret.algorithm) + #expect(erased.keySize == secret.keySize) + #expect(erased.publicKey == secret.publicKey) } } diff --git a/Sources/Packages/Tests/SecretKitTests/OpenSSHReaderTests.swift b/Sources/Packages/Tests/SecretKitTests/OpenSSHReaderTests.swift index 5ad74945..39c3029d 100644 --- a/Sources/Packages/Tests/SecretKitTests/OpenSSHReaderTests.swift +++ b/Sources/Packages/Tests/SecretKitTests/OpenSSHReaderTests.swift @@ -1,19 +1,19 @@ import Foundation -import XCTest +import Testing @testable import SecretKit @testable import SecureEnclaveSecretKit @testable import SmartCardSecretKit -class OpenSSHReaderTests: XCTestCase { +@Suite struct OpenSSHReaderTests { - func testSignatureRequest() { + @Test func signatureRequest() { let reader = OpenSSHReader(data: Constants.signatureRequest) let hash = reader.readNextChunk() - XCTAssert(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ==")) + #expect(hash == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBEqCbkJbOHy5S1wVCaJoKPmpS0egM4frMqllgnlRRQ/Uvnn6EVS8oV03cPA2Bz0EdESyRKA/sbmn0aBtgjIwGELxu45UXEW1TEz6TxyS0u3vuIqR3Wo1CrQWRDnkrG/pBQ==")) let dataToSign = reader.readNextChunk() - XCTAssert(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU=")) + #expect(dataToSign == Data(base64Encoded: "AAAAICi5xf1ixOestUlxdjvt/BDcM+rzhwy7Vo8cW5YcxA8+MgAAAANnaXQAAAAOc3NoLWNvbm5lY3Rpb24AAAAJcHVibGlja2V5AQAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAAiAAAABNlY2RzYS1zaGEyLW5pc3RwMzg0AAAACG5pc3RwMzg0AAAAYQRKgm5CWzh8uUtcFQmiaCj5qUtHoDOH6zKpZYJ5UUUP1L55+hFUvKFdN3DwNgc9BHREskSgP7G5p9GgbYIyMBhC8buOVFxFtUxM+k8cktLt77iKkd1qNQq0FkQ55Kxv6QU=")) let empty = reader.readNextChunk() - XCTAssert(empty.isEmpty) + #expect(empty.isEmpty) } } diff --git a/Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift b/Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift index 6e9718fc..e4719922 100644 --- a/Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift +++ b/Sources/Packages/Tests/SecretKitTests/OpenSSHWriterTests.swift @@ -1,45 +1,45 @@ import Foundation -import XCTest +import Testing @testable import SecretKit @testable import SecureEnclaveSecretKit @testable import SmartCardSecretKit -class OpenSSHWriterTests: XCTestCase { +@Suite struct OpenSSHWriterTests { let writer = OpenSSHKeyWriter() - func testECDSA256MD5Fingerprint() { - XCTAssertEqual(writer.openSSHMD5Fingerprint(secret: Constants.ecdsa256Secret), "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5") + @Test func ecdsa256MD5Fingerprint() { + #expect(writer.openSSHMD5Fingerprint(secret: Constants.ecdsa256Secret) == "dc:60:4d:ff:c2:d9:18:8b:2f:24:40:b5:7f:43:47:e5") } - func testECDSA256SHA256Fingerprint() { - XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret: Constants.ecdsa256Secret), "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650") + @Test func ecdsa256SHA256Fingerprint() { + #expect(writer.openSSHSHA256Fingerprint(secret: Constants.ecdsa256Secret) == "SHA256:/VQFeGyM8qKA8rB6WGMuZZxZLJln2UgXLk3F0uTF650") } - func testECDSA256PublicKey() { - XCTAssertEqual(writer.openSSHString(secret: Constants.ecdsa256Secret), + @Test func ecdsa256PublicKey() { + #expect(writer.openSSHString(secret: Constants.ecdsa256Secret) == "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=") } - func testECDSA256Hash() { - XCTAssertEqual(writer.data(secret: Constants.ecdsa256Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")) + @Test func ecdsa256Hash() { + #expect(writer.data(secret: Constants.ecdsa256Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOVEjgAA5PHqRgwykjN5qM21uWCHFSY/Sqo5gkHAkn+e1MMQKHOLga7ucB9b3mif33MBid59GRK9GEPVlMiSQwo=")) } - func testECDSA384MD5Fingerprint() { - XCTAssertEqual(writer.openSSHMD5Fingerprint(secret: Constants.ecdsa384Secret), "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e") + @Test func ecdsa384MD5Fingerprint() { + #expect(writer.openSSHMD5Fingerprint(secret: Constants.ecdsa384Secret) == "66:e0:66:d7:41:ed:19:8e:e2:20:df:ce:ac:7e:2b:6e") } - func testECDSA384SHA256Fingerprint() { - XCTAssertEqual(writer.openSSHSHA256Fingerprint(secret: Constants.ecdsa384Secret), "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I") + @Test func ecdsa384SHA256Fingerprint() { + #expect(writer.openSSHSHA256Fingerprint(secret: Constants.ecdsa384Secret) == "SHA256:GJUEymQNL9ymaMRRJCMGY4rWIJHu/Lm8Yhao/PAiz1I") } - func testECDSA384PublicKey() { - XCTAssertEqual(writer.openSSHString(secret: Constants.ecdsa384Secret), + @Test func ecdsa384PublicKey() { + #expect(writer.openSSHString(secret: Constants.ecdsa384Secret) == "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==") } - func testECDSA384Hash() { - XCTAssertEqual(writer.data(secret: Constants.ecdsa384Secret), Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")) + @Test func ecdsa384Hash() { + #expect(writer.data(secret: Constants.ecdsa384Secret) == Data(base64Encoded: "AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBG2MNc/C5OTHFE2tBvbZCVcpOGa8vBMquiTLkH4lwkeqOPxhi+PyYUfQZMTRJNPiTyWPoMBqNiCIFRVv60yPN/AHufHaOgbdTP42EgMlMMImkAjYUEv9DESHTVIs2PW1yQ==")) } } diff --git a/Sources/Secretive.xcodeproj/project.pbxproj b/Sources/Secretive.xcodeproj/project.pbxproj index 61fd17b4..de462b1f 100644 --- a/Sources/Secretive.xcodeproj/project.pbxproj +++ b/Sources/Secretive.xcodeproj/project.pbxproj @@ -30,7 +30,6 @@ 50617D8523FCE48E0099B055 /* ContentView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D8423FCE48E0099B055 /* ContentView.swift */; }; 50617D8723FCE48E0099B055 /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8623FCE48E0099B055 /* Assets.xcassets */; }; 50617D8A23FCE48E0099B055 /* Preview Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 50617D8923FCE48E0099B055 /* Preview Assets.xcassets */; }; - 50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617D9823FCE48E0099B055 /* SecretiveTests.swift */; }; 50617DD223FCEFA90099B055 /* PreviewStore.swift in Sources */ = {isa = PBXBuildFile; fileRef = 50617DD123FCEFA90099B055 /* PreviewStore.swift */; }; 5065E313295517C500E16645 /* ToolbarButtonStyle.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */; }; 5066A6C22516F303004B5A36 /* SetupView.swift in Sources */ = {isa = PBXBuildFile; fileRef = 5066A6C12516F303004B5A36 /* SetupView.swift */; }; @@ -63,13 +62,6 @@ remoteGlobalIDString = 50A3B78924026B7500D209EA; remoteInfo = SecretAgent; }; - 50617D9523FCE48E0099B055 /* PBXContainerItemProxy */ = { - isa = PBXContainerItemProxy; - containerPortal = 50617D7723FCE48D0099B055 /* Project object */; - proxyType = 1; - remoteGlobalIDString = 50617D7E23FCE48D0099B055; - remoteInfo = Secretive; - }; /* End PBXContainerItemProxy section */ /* Begin PBXCopyFilesBuildPhase section */ @@ -123,9 +115,6 @@ 50617D8923FCE48E0099B055 /* Preview Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = "Preview Assets.xcassets"; sourceTree = ""; }; 50617D8E23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = ""; }; 50617D8F23FCE48E0099B055 /* Secretive.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Secretive.entitlements; sourceTree = ""; }; - 50617D9423FCE48E0099B055 /* SecretiveTests.xctest */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = SecretiveTests.xctest; sourceTree = BUILT_PRODUCTS_DIR; }; - 50617D9823FCE48E0099B055 /* SecretiveTests.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SecretiveTests.swift; sourceTree = ""; }; - 50617D9A23FCE48E0099B055 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = Info.plist; sourceTree = ""; }; 50617DD123FCEFA90099B055 /* PreviewStore.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = PreviewStore.swift; sourceTree = ""; }; 5065E312295517C500E16645 /* ToolbarButtonStyle.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = ToolbarButtonStyle.swift; sourceTree = ""; }; 5066A6C12516F303004B5A36 /* SetupView.swift */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.swift; path = SetupView.swift; sourceTree = ""; }; @@ -166,13 +155,6 @@ ); runOnlyForDeploymentPostprocessing = 0; }; - 50617D9123FCE48E0099B055 /* Frameworks */ = { - isa = PBXFrameworksBuildPhase; - buildActionMask = 2147483647; - files = ( - ); - runOnlyForDeploymentPostprocessing = 0; - }; 50A3B78724026B7500D209EA /* Frameworks */ = { isa = PBXFrameworksBuildPhase; buildActionMask = 2147483647; @@ -201,7 +183,6 @@ children = ( 5003EF39278005C800DF2006 /* Packages */, 50617D8123FCE48E0099B055 /* Secretive */, - 50617D9723FCE48E0099B055 /* SecretiveTests */, 50A3B78B24026B7500D209EA /* SecretAgent */, 508A58AF241E144C0069DC07 /* Config */, 50617D8023FCE48E0099B055 /* Products */, @@ -213,7 +194,6 @@ isa = PBXGroup; children = ( 50617D7F23FCE48E0099B055 /* Secretive.app */, - 50617D9423FCE48E0099B055 /* SecretiveTests.xctest */, 50A3B78A24026B7500D209EA /* SecretAgent.app */, ); name = Products; @@ -248,15 +228,6 @@ path = "Preview Content"; sourceTree = ""; }; - 50617D9723FCE48E0099B055 /* SecretiveTests */ = { - isa = PBXGroup; - children = ( - 50617D9823FCE48E0099B055 /* SecretiveTests.swift */, - 50617D9A23FCE48E0099B055 /* Info.plist */, - ); - path = SecretiveTests; - sourceTree = ""; - }; 508A58AF241E144C0069DC07 /* Config */ = { isa = PBXGroup; children = ( @@ -357,24 +328,6 @@ productReference = 50617D7F23FCE48E0099B055 /* Secretive.app */; productType = "com.apple.product-type.application"; }; - 50617D9323FCE48E0099B055 /* SecretiveTests */ = { - isa = PBXNativeTarget; - buildConfigurationList = 50617DA023FCE48E0099B055 /* Build configuration list for PBXNativeTarget "SecretiveTests" */; - buildPhases = ( - 50617D9023FCE48E0099B055 /* Sources */, - 50617D9123FCE48E0099B055 /* Frameworks */, - 50617D9223FCE48E0099B055 /* Resources */, - ); - buildRules = ( - ); - dependencies = ( - 50617D9623FCE48E0099B055 /* PBXTargetDependency */, - ); - name = SecretiveTests; - productName = SecretiveTests; - productReference = 50617D9423FCE48E0099B055 /* SecretiveTests.xctest */; - productType = "com.apple.product-type.bundle.unit-test"; - }; 50A3B78924026B7500D209EA /* SecretAgent */ = { isa = PBXNativeTarget; buildConfigurationList = 50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */; @@ -413,10 +366,6 @@ 50617D7E23FCE48D0099B055 = { CreatedOnToolsVersion = 11.3; }; - 50617D9323FCE48E0099B055 = { - CreatedOnToolsVersion = 11.3; - TestTargetID = 50617D7E23FCE48D0099B055; - }; 50A3B78924026B7500D209EA = { CreatedOnToolsVersion = 11.4; }; @@ -443,7 +392,6 @@ projectRoot = ""; targets = ( 50617D7E23FCE48D0099B055 /* Secretive */, - 50617D9323FCE48E0099B055 /* SecretiveTests */, 50A3B78924026B7500D209EA /* SecretAgent */, ); }; @@ -462,13 +410,6 @@ ); runOnlyForDeploymentPostprocessing = 0; }; - 50617D9223FCE48E0099B055 /* Resources */ = { - isa = PBXResourcesBuildPhase; - buildActionMask = 2147483647; - files = ( - ); - runOnlyForDeploymentPostprocessing = 0; - }; 50A3B78824026B7500D209EA /* Resources */ = { isa = PBXResourcesBuildPhase; buildActionMask = 2147483647; @@ -514,14 +455,6 @@ ); runOnlyForDeploymentPostprocessing = 0; }; - 50617D9023FCE48E0099B055 /* Sources */ = { - isa = PBXSourcesBuildPhase; - buildActionMask = 2147483647; - files = ( - 50617D9923FCE48E0099B055 /* SecretiveTests.swift in Sources */, - ); - runOnlyForDeploymentPostprocessing = 0; - }; 50A3B78624026B7500D209EA /* Sources */ = { isa = PBXSourcesBuildPhase; buildActionMask = 2147483647; @@ -539,11 +472,6 @@ target = 50A3B78924026B7500D209EA /* SecretAgent */; targetProxy = 50142166278126B500BBAA70 /* PBXContainerItemProxy */; }; - 50617D9623FCE48E0099B055 /* PBXTargetDependency */ = { - isa = PBXTargetDependency; - target = 50617D7E23FCE48D0099B055 /* Secretive */; - targetProxy = 50617D9523FCE48E0099B055 /* PBXContainerItemProxy */; - }; /* End PBXTargetDependency section */ /* Begin PBXVariantGroup section */ @@ -737,46 +665,6 @@ }; name = Release; }; - 50617DA123FCE48E0099B055 /* Debug */ = { - isa = XCBuildConfiguration; - buildSettings = { - ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES; - BUNDLE_LOADER = "$(TEST_HOST)"; - CODE_SIGN_STYLE = Automatic; - COMBINE_HIDPI_IMAGES = YES; - DEVELOPMENT_TEAM = Z72PRUAWF6; - INFOPLIST_FILE = SecretiveTests/Info.plist; - LD_RUNPATH_SEARCH_PATHS = ( - "$(inherited)", - "@executable_path/../Frameworks", - "@loader_path/../Frameworks", - ); - PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests; - PRODUCT_NAME = "$(TARGET_NAME)"; - TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive"; - }; - name = Debug; - }; - 50617DA223FCE48E0099B055 /* Release */ = { - isa = XCBuildConfiguration; - buildSettings = { - ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES; - BUNDLE_LOADER = "$(TEST_HOST)"; - CODE_SIGN_STYLE = Automatic; - COMBINE_HIDPI_IMAGES = YES; - DEVELOPMENT_TEAM = Z72PRUAWF6; - INFOPLIST_FILE = SecretiveTests/Info.plist; - LD_RUNPATH_SEARCH_PATHS = ( - "$(inherited)", - "@executable_path/../Frameworks", - "@loader_path/../Frameworks", - ); - PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests; - PRODUCT_NAME = "$(TARGET_NAME)"; - TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive"; - }; - name = Release; - }; 508A5914241EF1A00069DC07 /* Test */ = { isa = XCBuildConfiguration; baseConfigurationReference = 508A58AB241E121B0069DC07 /* Config.xcconfig */; @@ -866,27 +754,6 @@ }; name = Test; }; - 508A5916241EF1A00069DC07 /* Test */ = { - isa = XCBuildConfiguration; - buildSettings = { - ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES; - BUNDLE_LOADER = "$(TEST_HOST)"; - CODE_SIGN_IDENTITY = "-"; - CODE_SIGN_STYLE = Manual; - COMBINE_HIDPI_IMAGES = YES; - INFOPLIST_FILE = SecretiveTests/Info.plist; - LD_RUNPATH_SEARCH_PATHS = ( - "$(inherited)", - "@executable_path/../Frameworks", - "@loader_path/../Frameworks", - ); - PRODUCT_BUNDLE_IDENTIFIER = com.maxgoedjen.SecretiveTests; - PRODUCT_NAME = "$(TARGET_NAME)"; - PROVISIONING_PROFILE_SPECIFIER = ""; - TEST_HOST = "$(BUILT_PRODUCTS_DIR)/Secretive.app/Contents/MacOS/Secretive"; - }; - name = Test; - }; 508A5917241EF1A00069DC07 /* Test */ = { isa = XCBuildConfiguration; buildSettings = { @@ -976,16 +843,6 @@ defaultConfigurationIsVisible = 0; defaultConfigurationName = Release; }; - 50617DA023FCE48E0099B055 /* Build configuration list for PBXNativeTarget "SecretiveTests" */ = { - isa = XCConfigurationList; - buildConfigurations = ( - 50617DA123FCE48E0099B055 /* Debug */, - 508A5916241EF1A00069DC07 /* Test */, - 50617DA223FCE48E0099B055 /* Release */, - ); - defaultConfigurationIsVisible = 0; - defaultConfigurationName = Release; - }; 50A3B79A24026B7600D209EA /* Build configuration list for PBXNativeTarget "SecretAgent" */ = { isa = XCConfigurationList; buildConfigurations = ( diff --git a/Sources/SecretiveTests/Info.plist b/Sources/SecretiveTests/Info.plist deleted file mode 100644 index 64d65ca4..00000000 --- a/Sources/SecretiveTests/Info.plist +++ /dev/null @@ -1,22 +0,0 @@ - - - - - CFBundleDevelopmentRegion - $(DEVELOPMENT_LANGUAGE) - CFBundleExecutable - $(EXECUTABLE_NAME) - CFBundleIdentifier - $(PRODUCT_BUNDLE_IDENTIFIER) - CFBundleInfoDictionaryVersion - 6.0 - CFBundleName - $(PRODUCT_NAME) - CFBundlePackageType - $(PRODUCT_BUNDLE_PACKAGE_TYPE) - CFBundleShortVersionString - 1.0 - CFBundleVersion - 1 - - diff --git a/Sources/SecretiveTests/SecretiveTests.swift b/Sources/SecretiveTests/SecretiveTests.swift deleted file mode 100644 index d596a412..00000000 --- a/Sources/SecretiveTests/SecretiveTests.swift +++ /dev/null @@ -1,20 +0,0 @@ -import XCTest -@testable import Secretive - -class SecretiveTests: XCTestCase { - - override func setUp() { - // Put setup code here. This method is called before the invocation of each test method in the class. - } - - override func tearDown() { - // Put teardown code here. This method is called after the invocation of each test method in the class. - } - - func testExample() { - // This is an example of a functional test case. - // Use XCTAssert and related functions to verify your tests produce the correct results. - } - - -} From 304741e01951fac57f948edd34ba73f52f019779 Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Sun, 5 Jan 2025 00:37:03 -0800 Subject: [PATCH 09/12] Tweak async for updater --- Sources/Packages/Sources/Brief/Updater.swift | 30 ++++++++++--------- .../BriefTests/ReleaseParsingTests.swift | 8 ++--- Sources/Secretive/Views/UpdateView.swift | 4 ++- 3 files changed, 23 insertions(+), 19 deletions(-) diff --git a/Sources/Packages/Sources/Brief/Updater.swift b/Sources/Packages/Sources/Brief/Updater.swift index d64bf408..334689d5 100644 --- a/Sources/Packages/Sources/Brief/Updater.swift +++ b/Sources/Packages/Sources/Brief/Updater.swift @@ -28,29 +28,31 @@ import Synchronization testBuild = currentVersion == SemVer("0.0.0") if checkOnLaunch { // Don't do a launch check if the user hasn't seen the setup prompt explaining updater yet. - checkForUpdates() + Task { + await checkForUpdates() + } } - let timer = Timer.scheduledTimer(withTimeInterval: checkFrequency, repeats: true) { _ in - self.checkForUpdates() + Task { + while !Task.isCancelled { + try? await Task.sleep(for: .seconds(Int(checkFrequency))) + await checkForUpdates() + } } - timer.tolerance = 60*60 } /// Manually trigger an update check. - public func checkForUpdates() { - URLSession.shared.dataTask(with: Constants.updateURL) { data, _, _ in - guard let data = data else { return } - guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return } - self.evaluate(releases: releases) - }.resume() + public func checkForUpdates() async { + guard let (data, _) = try? await URLSession.shared.data(from: Constants.updateURL) else { return } + guard let releases = try? JSONDecoder().decode([Release].self, from: data) else { return } + await evaluate(releases: releases) } /// Ignores a specified release. `update` will be nil if the user has ignored the latest available release. /// - Parameter release: The release to ignore. - public func ignore(release: Release) { + public func ignore(release: Release) async { guard !release.critical else { return } defaults.set(true, forKey: release.name) - Task { @MainActor in + await MainActor.run { _update.withLock { value in value = nil } @@ -63,7 +65,7 @@ extension Updater { /// Evaluates the available downloadable releases, and selects the newest non-prerelease release that the user is able to run. /// - Parameter releases: An array of ``Release`` objects. - func evaluate(releases: [Release]) { + func evaluate(releases: [Release]) async { guard let release = releases .sorted() .reversed() @@ -73,7 +75,7 @@ extension Updater { guard !release.prerelease else { return } let latestVersion = SemVer(release.name) if latestVersion > currentVersion { - Task { @MainActor in + await MainActor.run { _update.withLock { value in value = release } diff --git a/Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift b/Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift index 044a0569..1fc63647 100644 --- a/Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift +++ b/Sources/Packages/Tests/BriefTests/ReleaseParsingTests.swift @@ -72,8 +72,8 @@ import Foundation Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"), ] - updater.evaluate(releases: releases) - try await Task.sleep(nanoseconds: 500) + await updater.evaluate(releases: releases) + try await Task.sleep(nanoseconds: 1) #expect(updater.update == two) } @@ -89,8 +89,8 @@ import Foundation Release(name: "2.0.0", prerelease: false, html_url: URL(string: "https://example.com")!, body: "2.0 available! Minimum macOS Version: 2.2.3"), Release(name: "1.0.2", prerelease: false, html_url: URL(string: "https://example.com")!, body: "Emergency patch! Minimum macOS Version: 1.2.3"), ] - updater.evaluate(releases: releases) - try await Task.sleep(nanoseconds: 500) + await updater.evaluate(releases: releases) + try await Task.sleep(nanoseconds: 1) #expect(updater.update == oneOhTwo) } diff --git a/Sources/Secretive/Views/UpdateView.swift b/Sources/Secretive/Views/UpdateView.swift index a997d3a4..b262861d 100644 --- a/Sources/Secretive/Views/UpdateView.swift +++ b/Sources/Secretive/Views/UpdateView.swift @@ -18,7 +18,9 @@ struct UpdateDetailView: View { HStack { if !update.critical { Button("update_ignore_button") { - updater.ignore(release: update) + Task { + await updater.ignore(release: update) + } } Spacer() } From 576e625b8f425ef1eb83bba9a3ce6fc4eae3dd4e Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Sun, 5 Jan 2025 16:07:11 -0800 Subject: [PATCH 10/12] More --- .../Sources/Brief/UpdaterProtocol.swift | 2 +- .../Sources/SecretAgentKit/Agent.swift | 2 +- .../SecretAgentKit/SigningWitness.swift | 2 +- .../OpenSSH/OpenSSHCertificateHandler.swift | 20 +++-- .../SecretKit/OpenSSH/OpenSSHKeyWriter.swift | 2 +- .../PublicKeyStandinFileController.swift | 2 +- .../Sources/SecretKit/SecretStoreList.swift | 34 +++++-- Sources/SecretAgent/AppDelegate.swift | 32 ++++--- Sources/SecretAgent/Notifier.swift | 90 ++++++++++++------- Sources/Secretive/App.swift | 21 +++-- .../Controllers/AgentStatusChecker.swift | 7 +- Sources/Secretive/Views/ContentView.swift | 8 +- Sources/Secretive/Views/StoreListView.swift | 2 +- Sources/Secretive/Views/UpdateView.swift | 2 +- 14 files changed, 148 insertions(+), 78 deletions(-) diff --git a/Sources/Packages/Sources/Brief/UpdaterProtocol.swift b/Sources/Packages/Sources/Brief/UpdaterProtocol.swift index c4da349d..acbf5b9c 100644 --- a/Sources/Packages/Sources/Brief/UpdaterProtocol.swift +++ b/Sources/Packages/Sources/Brief/UpdaterProtocol.swift @@ -2,7 +2,7 @@ import Foundation import Synchronization /// A protocol for retreiving the latest available version of an app. -public protocol UpdaterProtocol: ObservableObject { +public protocol UpdaterProtocol: Observable { /// The latest update var update: Release? { get } diff --git a/Sources/Packages/Sources/SecretAgentKit/Agent.swift b/Sources/Packages/Sources/SecretAgentKit/Agent.swift index c2b0044f..cf3fa4f1 100644 --- a/Sources/Packages/Sources/SecretAgentKit/Agent.swift +++ b/Sources/Packages/Sources/SecretAgentKit/Agent.swift @@ -5,7 +5,7 @@ import SecretKit import AppKit /// The `Agent` is an implementation of an SSH agent. It manages coordination and access between a socket, traces requests, notifies witnesses and passes requests to stores. -public final class Agent { +public final class Agent: Sendable { private let storeList: SecretStoreList private let witness: SigningWitness? diff --git a/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift b/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift index 2527fef8..2e6ab497 100644 --- a/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift +++ b/Sources/Packages/Sources/SecretAgentKit/SigningWitness.swift @@ -2,7 +2,7 @@ import Foundation import SecretKit /// A protocol that allows conformers to be notified of access to secrets, and optionally prevent access. -public protocol SigningWitness { +public protocol SigningWitness: Sendable { /// A ridiculously named method that notifies the callee that a signing operation is about to be performed using a secret. The callee may `throw` an `Error` to prevent access from occurring. /// - Parameters: diff --git a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift index 50665455..d8345ba9 100644 --- a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift +++ b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift @@ -1,13 +1,14 @@ import Foundation import OSLog +import Synchronization /// Manages storage and lookup for OpenSSH certificates. -public final class OpenSSHCertificateHandler { +public final class OpenSSHCertificateHandler: Sendable { private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory()) private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler") private let writer = OpenSSHKeyWriter() - private var keyBlobsAndNames: [AnySecret: (Data, Data)] = [:] + private let keyBlobsAndNames: Mutex<[AnySecret: (Data, Data)]> = .init([:]) /// Initializes an OpenSSHCertificateHandler. public init() { @@ -20,8 +21,10 @@ public final class OpenSSHCertificateHandler { logger.log("No certificates, short circuiting") return } - keyBlobsAndNames = secrets.reduce(into: [:]) { partialResult, next in - partialResult[next] = try? loadKeyblobAndName(for: next) + keyBlobsAndNames.withLock { + $0 = secrets.reduce(into: [:]) { partialResult, next in + partialResult[next] = try? loadKeyblobAndName(for: next) + } } } @@ -29,7 +32,10 @@ public final class OpenSSHCertificateHandler { /// - Parameter secret: The secret to check for a certificate. /// - Returns: A boolean describing whether or not the certificate handler has a certifiicate associated with a given secret public func hasCertificate(for secret: SecretType) -> Bool { - keyBlobsAndNames[AnySecret(secret)] != nil + keyBlobsAndNames.withLock { + $0[AnySecret(secret)] != nil + } + } @@ -61,7 +67,9 @@ public final class OpenSSHCertificateHandler { /// - Parameter secret: The secret to search for a certificate with /// - Returns: A (``Data``, ``Data``) tuple containing the certificate and certificate name, respectively. public func keyBlobAndName(for secret: SecretType) throws -> (Data, Data)? { - keyBlobsAndNames[AnySecret(secret)] + keyBlobsAndNames.withLock { + $0[AnySecret(secret)] + } } /// Attempts to find an OpenSSH Certificate that corresponds to a ``Secret`` diff --git a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift index da8c4b19..cca64df2 100644 --- a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift +++ b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHKeyWriter.swift @@ -2,7 +2,7 @@ import Foundation import CryptoKit /// Generates OpenSSH representations of Secrets. -public struct OpenSSHKeyWriter { +public struct OpenSSHKeyWriter: Sendable { /// Initializes the writer. public init() { diff --git a/Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift b/Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift index 7c3f8daa..736c0f8e 100644 --- a/Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift +++ b/Sources/Packages/Sources/SecretKit/PublicKeyStandinFileController.swift @@ -2,7 +2,7 @@ import Foundation import OSLog /// Controller responsible for writing public keys to disk, so that they're easily accessible by scripts. -public final class PublicKeyFileStoreController { +public final class PublicKeyFileStoreController: Sendable { private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "PublicKeyFileStoreController") private let directory: String diff --git a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift index af0dc9e6..b2ef3b2f 100644 --- a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift +++ b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift @@ -1,13 +1,21 @@ import Foundation import Observation +import Synchronization /// A "Store Store," which holds a list of type-erased stores. -@Observable public final class SecretStoreList: ObservableObject { +@Observable public final class SecretStoreList: Sendable { /// The Stores managed by the SecretStoreList. - public var stores: [AnySecretStore] = [] + public var stores: [AnySecretStore] { + __stores.withLock { $0 } + } + private let __stores: Mutex<[AnySecretStore]> = .init([]) + /// A modifiable store, if one is available. - public var modifiableStore: AnySecretStoreModifiable? + public var modifiableStore: AnySecretStoreModifiable? { + __modifiableStore.withLock { $0 } + } + private let __modifiableStore: Mutex = .init(nil) /// Initializes a SecretStoreList. public init() { @@ -15,23 +23,33 @@ import Observation /// Adds a non-type-erased SecretStore to the list. public func add(store: SecretStoreType) { - stores.append(AnySecretStore(store)) + __stores.withLock { + $0.append(AnySecretStore(store)) + } } /// Adds a non-type-erased modifiable SecretStore. public func add(store: SecretStoreType) { let modifiable = AnySecretStoreModifiable(modifiable: store) - modifiableStore = modifiable - stores.append(modifiable) + __modifiableStore.withLock { + $0 = modifiable + } + __stores.withLock { + $0.append(modifiable) + } } /// A boolean describing whether there are any Stores available. public var anyAvailable: Bool { - stores.reduce(false, { $0 || $1.isAvailable }) + __stores.withLock { + $0.reduce(false, { $0 || $1.isAvailable }) + } } public var allSecrets: [AnySecret] { - stores.flatMap(\.secrets) + __stores.withLock { + $0.flatMap(\.secrets) + } } } diff --git a/Sources/SecretAgent/AppDelegate.swift b/Sources/SecretAgent/AppDelegate.swift index 13b0a9b3..abc0543d 100644 --- a/Sources/SecretAgent/AppDelegate.swift +++ b/Sources/SecretAgent/AppDelegate.swift @@ -6,6 +6,7 @@ import SecureEnclaveSecretKit import SmartCardSecretKit import SecretAgentKit import Brief +import Observation @main class AppDelegate: NSObject, NSApplicationDelegate { @@ -31,19 +32,28 @@ class AppDelegate: NSObject, NSApplicationDelegate { func applicationDidFinishLaunching(_ aNotification: Notification) { logger.debug("SecretAgent finished launching") -// DispatchQueue.main.async { -// self.socketController.handler = self.agent.handle(reader:writer:) -// } -// NotificationCenter.default.addObserver(forName: .secretStoreReloaded, object: nil, queue: .main) { [self] _ in -// try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) -// } + Task { @MainActor in + socketController.handler = { [agent] reader, writer in + await agent.handle(reader: reader, writer: writer) + } + } + Task { + for await _ in NotificationCenter.default.notifications(named: .secretStoreReloaded) { + try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) + } + } try? publicKeyFileStoreController.generatePublicKeys(for: storeList.allSecrets, clear: true) notifier.prompt() -// updateSink = updater.$update.sink { update in -// guard let update = update else { return } -// self.notifier.notify(update: update, ignore: self.updater.ignore(release:)) -// } + _ = withObservationTracking { + updater.update + } onChange: { [updater, notifier] in + notifier.notify(update: updater.update!) { release in + Task { + await updater.ignore(release: release) + } + } + } } - + } diff --git a/Sources/SecretAgent/Notifier.swift b/Sources/SecretAgent/Notifier.swift index 5b1fe440..2f0e15a6 100644 --- a/Sources/SecretAgent/Notifier.swift +++ b/Sources/SecretAgent/Notifier.swift @@ -4,8 +4,9 @@ import AppKit import SecretKit import SecretAgentKit import Brief +import Synchronization -class Notifier { +final class Notifier: Sendable { private let notificationDelegate = NotificationDelegate() @@ -34,7 +35,9 @@ class Notifier { guard let string = formatter.string(from: seconds)?.capitalized else { continue } let identifier = Constants.persistAuthenticationCategoryIdentitifier.appending("\(seconds)") let action = UNNotificationAction(identifier: identifier, title: string, options: []) - notificationDelegate.persistOptions[identifier] = seconds + notificationDelegate.state.withLock { state in + state.persistOptions[identifier] = seconds + } allPersistenceActions.append(action) } @@ -45,9 +48,11 @@ class Notifier { UNUserNotificationCenter.current().setNotificationCategories([updateCategory, criticalUpdateCategory, persistAuthenticationCategory]) UNUserNotificationCenter.current().delegate = notificationDelegate - notificationDelegate.persistAuthentication = { secret, store, duration in - guard let duration = duration else { return } - try? await store.persistAuthentication(secret: secret, forDuration: duration) + notificationDelegate.state.withLock { state in + state.persistAuthentication = { secret, store, duration in + guard let duration = duration else { return } + try? await store.persistAuthentication(secret: secret, forDuration: duration) + } } } @@ -58,8 +63,10 @@ class Notifier { } func notify(accessTo secret: AnySecret, from store: AnySecretStore, by provenance: SigningRequestProvenance) async { - notificationDelegate.pendingPersistableSecrets[secret.id.description] = secret - notificationDelegate.pendingPersistableStores[store.id.description] = store + notificationDelegate.state.withLock { state in + state.pendingPersistableSecrets[secret.id.description] = secret + state.pendingPersistableStores[store.id.description] = store + } let notificationCenter = UNUserNotificationCenter.current() let notificationContent = UNMutableNotificationContent() notificationContent.title = String(localized: "signed_notification_title_\(provenance.origin.displayName)") @@ -74,12 +81,14 @@ class Notifier { notificationContent.attachments = [attachment] } let request = UNNotificationRequest(identifier: UUID().uuidString, content: notificationContent, trigger: nil) - notificationCenter.add(request, withCompletionHandler: nil) + try? await notificationCenter.add(request) } func notify(update: Release, ignore: ((Release) -> Void)?) { - notificationDelegate.release = update - notificationDelegate.ignore = ignore + notificationDelegate.state.withLock { [update] state in + state.release = update +// state.ignore = ignore + } let notificationCenter = UNUserNotificationCenter.current() let notificationContent = UNMutableNotificationContent() if update.critical { @@ -129,15 +138,21 @@ extension Notifier { } -class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate { - - fileprivate var release: Release? - fileprivate var ignore: ((Release) -> Void)? - fileprivate var persistAuthentication: ((AnySecret, AnySecretStore, TimeInterval?) async -> Void)? - fileprivate var persistOptions: [String: TimeInterval] = [:] - fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:] - fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:] - +final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Sendable { + + struct State { + typealias PersistAuthentication = ((AnySecret, AnySecretStore, TimeInterval?) async -> Void) + typealias Ignore = ((Release) -> Void) + fileprivate var release: Release? + fileprivate var ignore: Ignore? + fileprivate var persistAuthentication: PersistAuthentication? + fileprivate var persistOptions: [String: TimeInterval] = [:] + fileprivate var pendingPersistableStores: [String: AnySecretStore] = [:] + fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:] + } + + fileprivate let state: Mutex = .init(.init()) + func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) { } @@ -155,27 +170,34 @@ class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate { } func handleUpdateResponse(response: UNNotificationResponse) { - guard let update = release else { return } - switch response.actionIdentifier { - case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier: - NSWorkspace.shared.open(update.html_url) - case Notifier.Constants.ignoreActionIdentitifier: - ignore?(update) - default: - fatalError() + state.withLock { state in + guard let update = state.release else { return } + switch response.actionIdentifier { + case Notifier.Constants.updateActionIdentitifier, UNNotificationDefaultActionIdentifier: + NSWorkspace.shared.open(update.html_url) + case Notifier.Constants.ignoreActionIdentitifier: + state.ignore?(update) + default: + fatalError() + } } } func handlePersistAuthenticationResponse(response: UNNotificationResponse) async { - guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String, let secret = pendingPersistableSecrets[secretID], - let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String, let store = pendingPersistableStores[storeID] - else { return } - pendingPersistableSecrets[secretID] = nil - await persistAuthentication?(secret, store, persistOptions[response.actionIdentifier]) +// let (secret, store, persistOptions, callback): (AnySecret?, AnySecretStore?, TimeInterval?, State.PersistAuthentication?) = state.withLock { state in +// guard let secretID = response.notification.request.content.userInfo[Notifier.Constants.persistSecretIDKey] as? String, let secret = state.pendingPersistableSecrets[secretID], +// let storeID = response.notification.request.content.userInfo[Notifier.Constants.persistStoreIDKey] as? String, let store = state.pendingPersistableStores[storeID] +// else { return (nil, nil, nil, nil) } +// state.pendingPersistableSecrets[secretID] = nil +// return (secret, store, state.persistOptions[response.actionIdentifier], state.persistAuthentication) +// } +// guard let secret, let store, let persistOptions else { return } +// await callback?(secret, store, persistOptions) } - func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) { - completionHandler([.list, .banner]) + + func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification) async -> UNNotificationPresentationOptions { + [.list, .banner] } } diff --git a/Sources/Secretive/App.swift b/Sources/Secretive/App.swift index 8d6ed8b2..18dad102 100644 --- a/Sources/Secretive/App.swift +++ b/Sources/Secretive/App.swift @@ -5,9 +5,20 @@ import SecureEnclaveSecretKit import SmartCardSecretKit import Brief +extension EnvironmentValues { + @Entry var secretStoreList: SecretStoreList = { + let list = SecretStoreList() + list.add(store: SecureEnclave.Store()) + list.add(store: SmartCard.Store()) + return list + }() + @Entry var agentStatusChecker: any AgentStatusCheckerProtocol = AgentStatusChecker() + @Entry var updater: any UpdaterProtocol = Updater(checkOnLaunch: false) +} + @main struct Secretive: App { - + private let storeList: SecretStoreList = { let list = SecretStoreList() list.add(store: SecureEnclave.Store()) @@ -23,10 +34,10 @@ struct Secretive: App { @SceneBuilder var body: some Scene { WindowGroup { - ContentView(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup) - .environmentObject(storeList) - .environmentObject(Updater(checkOnLaunch: hasRunSetup)) - .environmentObject(agentStatusChecker) + ContentView(showingCreation: $showingCreation, runningSetup: $showingSetup, hasRunSetup: $hasRunSetup) + .environment(storeList) + .environment(Updater(checkOnLaunch: hasRunSetup)) + .environment(agentStatusChecker) .onAppear { if !hasRunSetup { showingSetup = true diff --git a/Sources/Secretive/Controllers/AgentStatusChecker.swift b/Sources/Secretive/Controllers/AgentStatusChecker.swift index 8f0602e8..daad4781 100644 --- a/Sources/Secretive/Controllers/AgentStatusChecker.swift +++ b/Sources/Secretive/Controllers/AgentStatusChecker.swift @@ -2,15 +2,16 @@ import Foundation import Combine import AppKit import SecretKit +import Observation -protocol AgentStatusCheckerProtocol: ObservableObject { +protocol AgentStatusCheckerProtocol: Observable { var running: Bool { get } var developmentBuild: Bool { get } } -class AgentStatusChecker: ObservableObject, AgentStatusCheckerProtocol { +@Observable class AgentStatusChecker: AgentStatusCheckerProtocol { - @Published var running: Bool = false + var running: Bool = false init() { check() diff --git a/Sources/Secretive/Views/ContentView.swift b/Sources/Secretive/Views/ContentView.swift index c556e644..77ee96ed 100644 --- a/Sources/Secretive/Views/ContentView.swift +++ b/Sources/Secretive/Views/ContentView.swift @@ -4,7 +4,7 @@ import SecureEnclaveSecretKit import SmartCardSecretKit import Brief -struct ContentView: View { +struct ContentView: View { @Binding var showingCreation: Bool @Binding var runningSetup: Bool @@ -13,9 +13,9 @@ struct ContentView: View { - @EnvironmentObject var updater: UpdaterType + @Environment(UpdaterType.self) var updater: UpdaterType let update: Release From 9b02afb20c027cf89b6cd93c1dcc06655728a97a Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Sun, 5 Jan 2025 16:25:16 -0800 Subject: [PATCH 11/12] Backport mutex --- Sources/Packages/Package.swift | 18 +++++++---- .../Packages/Sources/Backports/_Mutex.swift | 30 +++++++++++++++++++ Sources/Packages/Sources/Brief/Updater.swift | 3 +- .../OpenSSH/OpenSSHCertificateHandler.swift | 3 +- .../Sources/SecretKit/SecretStoreList.swift | 5 ++-- .../SecureEnclaveStore.swift | 7 +++-- .../SmartCardSecretKit/SmartCardStore.swift | 3 +- Sources/SecretAgent/Notifier.swift | 3 +- .../Preview Content/PreviewUpdater.swift | 3 +- 9 files changed, 60 insertions(+), 15 deletions(-) create mode 100644 Sources/Packages/Sources/Backports/_Mutex.swift diff --git a/Sources/Packages/Package.swift b/Sources/Packages/Package.swift index 15945806..a666ec08 100644 --- a/Sources/Packages/Package.swift +++ b/Sources/Packages/Package.swift @@ -27,18 +27,26 @@ let package = Package( .library( name: "Brief", targets: ["Brief"]), + .library( + name: "Backports", + targets: ["Backports"]), ], dependencies: [ ], targets: [ .target( - name: "SecretKit", + name: "Backports", dependencies: [], swiftSettings: swiftSettings ), + .target( + name: "SecretKit", + dependencies: ["Backports"], + swiftSettings: swiftSettings + ), .testTarget( name: "SecretKitTests", - dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"], + dependencies: ["Backports", "SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"], swiftSettings: swiftSettings ), .target( @@ -48,12 +56,12 @@ let package = Package( ), .target( name: "SmartCardSecretKit", - dependencies: ["SecretKit"], + dependencies: ["Backports", "SecretKit"], swiftSettings: swiftSettings ), .target( name: "SecretAgentKit", - dependencies: ["SecretKit", "SecretAgentKitHeaders"], + dependencies: ["Backports", "SecretKit", "SecretAgentKitHeaders"], swiftSettings: swiftSettings ), .systemLibrary( @@ -65,7 +73,7 @@ let package = Package( , .target( name: "Brief", - dependencies: [] + dependencies: ["Backports"] ), .testTarget( name: "BriefTests", diff --git a/Sources/Packages/Sources/Backports/_Mutex.swift b/Sources/Packages/Sources/Backports/_Mutex.swift new file mode 100644 index 00000000..b389a58c --- /dev/null +++ b/Sources/Packages/Sources/Backports/_Mutex.swift @@ -0,0 +1,30 @@ +import Foundation + +#if canImport(Synchronization) +import Synchronization +public typealias _Mutex = Mutex +#else + +import os + +public final class _Mutex: @unchecked Sendable { + + private var value: Value + private var lock = OSAllocatedUnfairLock() + + public init(_ value: consuming sending Value) { + self.value = value + } + + public borrowing func withLock(_ body: (inout sending Value) throws(E) -> sending Result) throws(E) -> sending Result where E : Error, Result : ~Copyable { + lock.lock() + defer { + lock.unlock() + } + return try body(&value) + } + + +} + +#endif diff --git a/Sources/Packages/Sources/Brief/Updater.swift b/Sources/Packages/Sources/Brief/Updater.swift index 334689d5..315e7794 100644 --- a/Sources/Packages/Sources/Brief/Updater.swift +++ b/Sources/Packages/Sources/Brief/Updater.swift @@ -1,6 +1,7 @@ import Foundation import Observation import Synchronization +import Backports /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version. @Observable public final class Updater: UpdaterProtocol, ObservableObject, Sendable { @@ -8,7 +9,7 @@ import Synchronization public var update: Release? { _update.withLock { $0 } } - private let _update: Mutex = .init(nil) + private let _update: _Mutex = .init(nil) public let testBuild: Bool /// The current OS version. diff --git a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift index d8345ba9..fe0243c8 100644 --- a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift +++ b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift @@ -1,6 +1,7 @@ import Foundation import OSLog import Synchronization +import Backports /// Manages storage and lookup for OpenSSH certificates. public final class OpenSSHCertificateHandler: Sendable { @@ -8,7 +9,7 @@ public final class OpenSSHCertificateHandler: Sendable { private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory()) private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler") private let writer = OpenSSHKeyWriter() - private let keyBlobsAndNames: Mutex<[AnySecret: (Data, Data)]> = .init([:]) + private let keyBlobsAndNames: _Mutex<[AnySecret: (Data, Data)]> = .init([:]) /// Initializes an OpenSSHCertificateHandler. public init() { diff --git a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift index b2ef3b2f..be01ed58 100644 --- a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift +++ b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift @@ -1,6 +1,7 @@ import Foundation import Observation import Synchronization +import Backports /// A "Store Store," which holds a list of type-erased stores. @Observable public final class SecretStoreList: Sendable { @@ -9,13 +10,13 @@ import Synchronization public var stores: [AnySecretStore] { __stores.withLock { $0 } } - private let __stores: Mutex<[AnySecretStore]> = .init([]) + private let __stores: _Mutex<[AnySecretStore]> = .init([]) /// A modifiable store, if one is available. public var modifiableStore: AnySecretStoreModifiable? { __modifiableStore.withLock { $0 } } - private let __modifiableStore: Mutex = .init(nil) + private let __modifiableStore: _Mutex = .init(nil) /// Initializes a SecretStoreList. public init() { diff --git a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift index 371cdd59..c37b596c 100644 --- a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift +++ b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift @@ -5,6 +5,7 @@ import CryptoKit import LocalAuthentication import SecretKit import Synchronization +import Backports extension SecureEnclave { @@ -19,9 +20,9 @@ extension SecureEnclave { public var secrets: [Secret] { _secrets.withLock { $0 } } - private let _secrets: Mutex<[Secret]> = .init([]) + private let _secrets: _Mutex<[Secret]> = .init([]) - private let persistedAuthenticationContexts: Mutex<[Secret: PersistentAuthenticationContext]> = .init([:]) + private let persistedAuthenticationContexts: _Mutex<[Secret: PersistentAuthenticationContext]> = .init([:]) /// Initializes a Store. public init() { @@ -105,7 +106,7 @@ extension SecureEnclave { } public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data { - let context: Mutex + let context: _Mutex // if let existing = persistedAuthenticationContexts.withLock({ $0 })[secret], existing.valid { // context = existing.context // } else { diff --git a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift index 199e4cde..d5616050 100644 --- a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift +++ b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift @@ -5,6 +5,7 @@ import Security import CryptoTokenKit import LocalAuthentication import SecretKit +import Backports extension SmartCard { @@ -19,7 +20,7 @@ extension SmartCard { /// An implementation of Store backed by a Smart Card. @Observable public final class Store: SecretStore { - private let state: Mutex = .init(.init()) + private let state: _Mutex = .init(.init()) public var isAvailable: Bool { state.withLock { $0.isAvailable } } diff --git a/Sources/SecretAgent/Notifier.swift b/Sources/SecretAgent/Notifier.swift index 2f0e15a6..ff1d1474 100644 --- a/Sources/SecretAgent/Notifier.swift +++ b/Sources/SecretAgent/Notifier.swift @@ -5,6 +5,7 @@ import SecretKit import SecretAgentKit import Brief import Synchronization +import Backports final class Notifier: Sendable { @@ -151,7 +152,7 @@ final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Se fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:] } - fileprivate let state: Mutex = .init(.init()) + fileprivate let state: _Mutex = .init(.init()) func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) { diff --git a/Sources/Secretive/Preview Content/PreviewUpdater.swift b/Sources/Secretive/Preview Content/PreviewUpdater.swift index 6979615d..04c6658a 100644 --- a/Sources/Secretive/Preview Content/PreviewUpdater.swift +++ b/Sources/Secretive/Preview Content/PreviewUpdater.swift @@ -2,13 +2,14 @@ import Foundation import Synchronization import Observation import Brief +import Backports @Observable class PreviewUpdater: UpdaterProtocol { var update: Release? { _update.withLock { $0 } } - let _update: Mutex = .init(nil) + let _update: _Mutex = .init(nil) let testBuild = false From bab76da2abce3d390bc24c80e167ebafd8b2b8c3 Mon Sep 17 00:00:00 2001 From: Max Goedjen Date: Sun, 5 Jan 2025 16:27:41 -0800 Subject: [PATCH 12/12] Revert "Backport mutex" This reverts commit 9b02afb20c027cf89b6cd93c1dcc06655728a97a. --- Sources/Packages/Package.swift | 18 ++++------- .../Packages/Sources/Backports/_Mutex.swift | 30 ------------------- Sources/Packages/Sources/Brief/Updater.swift | 3 +- .../OpenSSH/OpenSSHCertificateHandler.swift | 3 +- .../Sources/SecretKit/SecretStoreList.swift | 5 ++-- .../SecureEnclaveStore.swift | 7 ++--- .../SmartCardSecretKit/SmartCardStore.swift | 3 +- Sources/SecretAgent/Notifier.swift | 3 +- .../Preview Content/PreviewUpdater.swift | 3 +- 9 files changed, 15 insertions(+), 60 deletions(-) delete mode 100644 Sources/Packages/Sources/Backports/_Mutex.swift diff --git a/Sources/Packages/Package.swift b/Sources/Packages/Package.swift index a666ec08..15945806 100644 --- a/Sources/Packages/Package.swift +++ b/Sources/Packages/Package.swift @@ -27,26 +27,18 @@ let package = Package( .library( name: "Brief", targets: ["Brief"]), - .library( - name: "Backports", - targets: ["Backports"]), ], dependencies: [ ], targets: [ - .target( - name: "Backports", - dependencies: [], - swiftSettings: swiftSettings - ), .target( name: "SecretKit", - dependencies: ["Backports"], + dependencies: [], swiftSettings: swiftSettings ), .testTarget( name: "SecretKitTests", - dependencies: ["Backports", "SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"], + dependencies: ["SecretKit", "SecureEnclaveSecretKit", "SmartCardSecretKit"], swiftSettings: swiftSettings ), .target( @@ -56,12 +48,12 @@ let package = Package( ), .target( name: "SmartCardSecretKit", - dependencies: ["Backports", "SecretKit"], + dependencies: ["SecretKit"], swiftSettings: swiftSettings ), .target( name: "SecretAgentKit", - dependencies: ["Backports", "SecretKit", "SecretAgentKitHeaders"], + dependencies: ["SecretKit", "SecretAgentKitHeaders"], swiftSettings: swiftSettings ), .systemLibrary( @@ -73,7 +65,7 @@ let package = Package( , .target( name: "Brief", - dependencies: ["Backports"] + dependencies: [] ), .testTarget( name: "BriefTests", diff --git a/Sources/Packages/Sources/Backports/_Mutex.swift b/Sources/Packages/Sources/Backports/_Mutex.swift deleted file mode 100644 index b389a58c..00000000 --- a/Sources/Packages/Sources/Backports/_Mutex.swift +++ /dev/null @@ -1,30 +0,0 @@ -import Foundation - -#if canImport(Synchronization) -import Synchronization -public typealias _Mutex = Mutex -#else - -import os - -public final class _Mutex: @unchecked Sendable { - - private var value: Value - private var lock = OSAllocatedUnfairLock() - - public init(_ value: consuming sending Value) { - self.value = value - } - - public borrowing func withLock(_ body: (inout sending Value) throws(E) -> sending Result) throws(E) -> sending Result where E : Error, Result : ~Copyable { - lock.lock() - defer { - lock.unlock() - } - return try body(&value) - } - - -} - -#endif diff --git a/Sources/Packages/Sources/Brief/Updater.swift b/Sources/Packages/Sources/Brief/Updater.swift index 315e7794..334689d5 100644 --- a/Sources/Packages/Sources/Brief/Updater.swift +++ b/Sources/Packages/Sources/Brief/Updater.swift @@ -1,7 +1,6 @@ import Foundation import Observation import Synchronization -import Backports /// A concrete implementation of ``UpdaterProtocol`` which considers the current release and OS version. @Observable public final class Updater: UpdaterProtocol, ObservableObject, Sendable { @@ -9,7 +8,7 @@ import Backports public var update: Release? { _update.withLock { $0 } } - private let _update: _Mutex = .init(nil) + private let _update: Mutex = .init(nil) public let testBuild: Bool /// The current OS version. diff --git a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift index fe0243c8..d8345ba9 100644 --- a/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift +++ b/Sources/Packages/Sources/SecretKit/OpenSSH/OpenSSHCertificateHandler.swift @@ -1,7 +1,6 @@ import Foundation import OSLog import Synchronization -import Backports /// Manages storage and lookup for OpenSSH certificates. public final class OpenSSHCertificateHandler: Sendable { @@ -9,7 +8,7 @@ public final class OpenSSHCertificateHandler: Sendable { private let publicKeyFileStoreController = PublicKeyFileStoreController(homeDirectory: NSHomeDirectory()) private let logger = Logger(subsystem: "com.maxgoedjen.secretive.secretagent", category: "OpenSSHCertificateHandler") private let writer = OpenSSHKeyWriter() - private let keyBlobsAndNames: _Mutex<[AnySecret: (Data, Data)]> = .init([:]) + private let keyBlobsAndNames: Mutex<[AnySecret: (Data, Data)]> = .init([:]) /// Initializes an OpenSSHCertificateHandler. public init() { diff --git a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift index be01ed58..b2ef3b2f 100644 --- a/Sources/Packages/Sources/SecretKit/SecretStoreList.swift +++ b/Sources/Packages/Sources/SecretKit/SecretStoreList.swift @@ -1,7 +1,6 @@ import Foundation import Observation import Synchronization -import Backports /// A "Store Store," which holds a list of type-erased stores. @Observable public final class SecretStoreList: Sendable { @@ -10,13 +9,13 @@ import Backports public var stores: [AnySecretStore] { __stores.withLock { $0 } } - private let __stores: _Mutex<[AnySecretStore]> = .init([]) + private let __stores: Mutex<[AnySecretStore]> = .init([]) /// A modifiable store, if one is available. public var modifiableStore: AnySecretStoreModifiable? { __modifiableStore.withLock { $0 } } - private let __modifiableStore: _Mutex = .init(nil) + private let __modifiableStore: Mutex = .init(nil) /// Initializes a SecretStoreList. public init() { diff --git a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift index c37b596c..371cdd59 100644 --- a/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift +++ b/Sources/Packages/Sources/SecureEnclaveSecretKit/SecureEnclaveStore.swift @@ -5,7 +5,6 @@ import CryptoKit import LocalAuthentication import SecretKit import Synchronization -import Backports extension SecureEnclave { @@ -20,9 +19,9 @@ extension SecureEnclave { public var secrets: [Secret] { _secrets.withLock { $0 } } - private let _secrets: _Mutex<[Secret]> = .init([]) + private let _secrets: Mutex<[Secret]> = .init([]) - private let persistedAuthenticationContexts: _Mutex<[Secret: PersistentAuthenticationContext]> = .init([:]) + private let persistedAuthenticationContexts: Mutex<[Secret: PersistentAuthenticationContext]> = .init([:]) /// Initializes a Store. public init() { @@ -106,7 +105,7 @@ extension SecureEnclave { } public func sign(data: Data, with secret: Secret, for provenance: SigningRequestProvenance) throws -> Data { - let context: _Mutex + let context: Mutex // if let existing = persistedAuthenticationContexts.withLock({ $0 })[secret], existing.valid { // context = existing.context // } else { diff --git a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift index d5616050..199e4cde 100644 --- a/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift +++ b/Sources/Packages/Sources/SmartCardSecretKit/SmartCardStore.swift @@ -5,7 +5,6 @@ import Security import CryptoTokenKit import LocalAuthentication import SecretKit -import Backports extension SmartCard { @@ -20,7 +19,7 @@ extension SmartCard { /// An implementation of Store backed by a Smart Card. @Observable public final class Store: SecretStore { - private let state: _Mutex = .init(.init()) + private let state: Mutex = .init(.init()) public var isAvailable: Bool { state.withLock { $0.isAvailable } } diff --git a/Sources/SecretAgent/Notifier.swift b/Sources/SecretAgent/Notifier.swift index ff1d1474..2f0e15a6 100644 --- a/Sources/SecretAgent/Notifier.swift +++ b/Sources/SecretAgent/Notifier.swift @@ -5,7 +5,6 @@ import SecretKit import SecretAgentKit import Brief import Synchronization -import Backports final class Notifier: Sendable { @@ -152,7 +151,7 @@ final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate, Se fileprivate var pendingPersistableSecrets: [String: AnySecret] = [:] } - fileprivate let state: _Mutex = .init(.init()) + fileprivate let state: Mutex = .init(.init()) func userNotificationCenter(_ center: UNUserNotificationCenter, openSettingsFor notification: UNNotification?) { diff --git a/Sources/Secretive/Preview Content/PreviewUpdater.swift b/Sources/Secretive/Preview Content/PreviewUpdater.swift index 04c6658a..6979615d 100644 --- a/Sources/Secretive/Preview Content/PreviewUpdater.swift +++ b/Sources/Secretive/Preview Content/PreviewUpdater.swift @@ -2,14 +2,13 @@ import Foundation import Synchronization import Observation import Brief -import Backports @Observable class PreviewUpdater: UpdaterProtocol { var update: Release? { _update.withLock { $0 } } - let _update: _Mutex = .init(nil) + let _update: Mutex = .init(nil) let testBuild = false