Repository navigation
fix: action secrets readable across updates (2.9.1) - #10
Merged
Merged
Conversation
Without a Team ID, an item the app creates with SecItemAdd is partitioned to that build's cdhash, so every new build asked for the login password to read "MaccyPlus action secrets". SecretStore now creates, reads and deletes the items through /usr/bin/security (ACL + partition apple-tool:), which every build - sandboxed included - runs silently. The secret goes in as hex on stdin, never argv; reads parse `-g` output so hex-looking and non-ASCII values round-trip. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Stops the Keychain password prompt for Send to ntfy passwords after every update.
Root cause: the app is self-signed with no Team ID, so an item it creates with
SecItemAddis partitioned to that build's cdhash. Each new build can't read the previous build's item without asking.How
SecretStorenow creates, reads and deletes "MaccyPlus action secrets" items through/usr/bin/security. The item then trusts the CLI (ACL + partitionapple-tool:), which every build can run silently. This also works from the sandbox: verified with a sandboxed test binary.security -i+add-generic-password -U … -X <hex>), never on argv.find-generic-password -g, so hex-looking and non-ASCII values round-trip.Existing items need one Always Allow click each.
Tests
testSecretStoreParsesSecurityOutput.MaccyTests/BuiltinProvidersTestspass locally (61), including the real-keychaintestNtfyKeychainReferenceResolvesThroughSecretStore.🤖 Generated with Claude Code