docs: retire fix-macos.md; fold findings into THREAT_MODEL#67
Merged
jgowdy-godaddy merged 1 commit intomainfrom Apr 17, 2026
Merged
docs: retire fix-macos.md; fold findings into THREAT_MODEL#67jgowdy-godaddy merged 1 commit intomainfrom
jgowdy-godaddy merged 1 commit intomainfrom
Conversation
fix-macos.md's implementation plan is complete: - Steps 1-6 (Path 2: AES-GCM-wrapped .handle + keychain-held wrapping key) are shipped in PR #65. - Steps 7-8 (Path 1: entitled SecKeyCreateRandomKey with kSecAttrTokenIDSecureEnclave) are blocked on a provisioning profile, not deferred work. The required keychain-access-groups entitlement is AMFI-restricted and unavailable to Homebrew / cargo-install distribution, so these steps will not land under the current distribution model. The still-useful content from the plan doc has been migrated into THREAT_MODEL's macOS platform-specific notes: - Full prompt-behavior matrix (ad-hoc vs self-signed vs trusted-cert, first run / rebuild / different path) - Deny / Always Allow / upgrade-transition behavior - -34018 finding explaining why the legacy keychain is used - Explicit note that the entitled SE path is blocked on provisioning fix-macos.md is deleted.
jgowdy-godaddy
pushed a commit
that referenced
this pull request
Apr 17, 2026
Resolves conflicts where origin/main's #66/#67 docs PRs touched the same DESIGN.md/THREAT_MODEL.md regions I rewrote for the hardening pass. Our side supersedes — the new sections already include all of main's refinements plus the envelope, HMAC sidecar, Windows mitigations, SecretRead, env-scrub, bridge mutex, and Authenticode notes. fix-macos.md: accept main's deletion (#67 folded the findings into THREAT_MODEL.md).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fix-macos.mdhas served its purpose:.handle+ Keychain-held wrapping key) shipped in apple: AES-GCM-wrap the SE dataRepresentation under a Keychain key #65.SecKeyCreateRandomKeywithkSecAttrTokenIDSecureEnclave) are blocked, not deferred work.keychain-access-groupsis an AMFI-restricted entitlement requiring a provisioning profile — unavailable to Homebrew /cargo installdistribution (AMFI kills the binary with error-413even with a valid Apple Development cert and no matching profile).This PR:
fix-macos.md.THREAT_MODEL.mdwith the still-useful content from the plan doc:-34018finding explaining why the legacy keychain is used.Test plan
fix-macos.md