Secretive is a macOS application that stores SSH private keys in the Apple Secure Enclave (or on smart cards such as YubiKeys) and exposes them through an SSH agent, making private key material non-exportable by hardware design. The architecture is a main SwiftUI management app (Secretive) plus a background login-item agent (SecretAgent) that owns a Unix socket at ~/Library/Containers/.../socket.ssh. SSH clients connect to this socket; the agent parses the SSH agent wire protocol, matches the requested key, enforces the key's access-control policy (Touch ID, Apple Watch, or password), has the Secure Enclave produce the signature, and returns an OpenSSH-formatted response. All untrusted input parsing (agent messages, certificate files) is delegated to sandboxed XPC services with hard-coded code-signing requirements, and network access for update checks is isolated to a dedicated XPC service with a declared Internet Access Policy. The code is Swift 6 with strict concurrency, strict memory safety, and warnings-as-errors, and has zero third-party dependencies by explicit project policy. The codebase is organized into small Swift packages: SecretKit (protocols and type erasers for secrets/stores), SecureEnclaveSecretKit and SmartCardSecretKit (concrete key stores), SSHProtocolKit (binary encoding/decoding of OpenSSH keys, certificates, signatures, and the agent protocol), SecretAgentKit (the agent, socket controller, authentication batcher, request-provenance tracer), XPCWrappers (a typed Codable RPC layer over NSXPCConnection), SettingsKit (keychain-backed settings), and Brief (semver update checking). Several of these are cleanly isolated: OpenSSHReader, SemVer, the FormatStyle data formatters, the keychain-backed SettingsStore, and the typed XPC session wrapper could be lifted into new projects largely untouched. The signature writer's mpint encoding correctly handles OpenSSH's signed-bignum rules (stripping leading zero bytes, prefixing 0x00 when the sign bit is set), which is subtle and covered by dedicated tests. Tests use real captured binary fixtures for protocol compatibility and cover agent identity listing, signing, witness objection behavior, authentication batching, and update selection logic. CI runs tests, CodeQL, nightly notarized builds, and attestation-backed auditable releases. Minor soft spots include duplicated certificate-migration code, two different SecretAgent entry points (SwiftUI App and AppDelegate), and a parsed-but-disabled session-bind extension, indicating ongoing refactoring rather than architectural debt.
QtKeychain is a cross-platform Qt library for securely storing passwords and secrets using platform-native keychain services. It provides a unified QKeychain::Job API (ReadPasswordJob, WritePasswordJob, DeletePasswordJob) that delegates to the appropriate backend: macOS/iOS Keychain, Windows Credential Store (or CryptProtectData), Linux via KWallet, libsecret, or GNOME Keyring, Android Keystore, Haiku's KeyStore, and a WebAssembly bridge using the Credential Management API. The library is primarily a thin abstraction layer with clean separation of platform concerns, an internal job queue for serialization, and a fallback mechanism to store data in plaintext via QSettings when no secure backend is available. It supports Qt 5 and Qt 6, requires C++11/17, and bundles translation files for several languages.
This repository provides Rust bindings to Apple's Security.framework, enabling safe access to Keychain services and TLS/SSL functionality. It consists of a safe wrapper crate (`security-framework`) built upon raw FFI bindings (`security-framework-sys`), with platform-specific implementations for macOS. The library employs idiomatic Rust patterns such as the builder pattern for configuration, Core Foundation type wrappers for automatic memory management, and zero-cost abstractions using `PhantomData`. Examples demonstrate TLS client connections and Keychain password operations. The architecture separates unsafe FFI bindings (generated via `ctest2` from Apple headers) from safe abstractions. Key components include Keychain item management (search/add/update/delete), SSL/TLS client/server contexts, certificate handling, and cryptographic transforms. The project is actively maintained with recent commits, includes test harnesses for iOS and system validation, and shows awareness of API evolution through deprecation markers.