Skip to content

Ask Key 0.5.0

Latest
Latest

Choose a tag to compare

View all tags
@sudoHG sudoHG released this 03 Nov 06:23
· 9 commits to main since this release
v0.5.0
253daf6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Timed allowances for a whole group, and an option to end them when you lock your Mac. · 整组凭证一次限时允许，锁屏时可自动结束。 English · 中文

English

Added

  • Allow a whole group for a while. When an agent asks to read a credential that belongs to a group, the approval card can grant one timed allowance for every eligible credential in that group. Details lists each covered credential; credentials added to the group later are not included, and the allowance ends early if a listed credential expires first.
  • Active timed allowances at the top of the library, with remaining time and a revoke action. They stay visible while you search or filter by group. A group allowance appears once, listing all its credentials.
  • End Timed Allow on Lock in Settings, off by default. When on, locking the screen, putting the Mac to sleep or switching users ends all timed allowances, and new ones can't be granted until you're back. Turning it on or off asks for Touch ID.

Changed

  • Clicking a pending-request reminder while management is locked now opens the approval card directly, without unlocking management. With nothing pending, the click only brings Ask Key forward.
  • A credential covered by a group allowance shows Revoke Group Allowance, which ends the allowance for the whole group.

Fixed

  • Clicking an agent write-failure notification brings Ask Key forward without jumping to Pending requests.

Security

  • With End Timed Allow on Lock on, lock, sleep and user switch also cancel timed approvals that haven't been used yet and stop prepared runs that include a timed credential. Turning the setting off doesn't bring revoked access back.
  • A group allowance covers only the credentials listed when you approved it, for your whole macOS user, never writes. Changing one of them removes just that credential; revoking from any of them ends the whole allowance.

Upgrading from 0.4.0

  1. Quit Ask Key, download and verify the new DMG as below, replace /Applications/Ask Key.app, and open Ask Key from Applications.
  2. There is no library migration this time. Credentials, permissions and Agent access settings are kept without a Resume step, and End Timed Allow on Lock starts off.
  3. Turn End Timed Allow on Lock off before downgrading to 0.4.0. If it is on, 0.4.0 pauses Agent access, and its Resume resets all Agent access settings to defaults. Upgrading again before pressing Resume loses nothing.

Upgrading from 0.3.2 or earlier? Read the 0.4.0 notes first: 0.4.0 migrates the library once and needs a backup beforehand.

Install

  1. Download AskKey.dmg and AskKey.dmg.sha256 below; run shasum -a 256 -c AskKey.dmg.sha256 to verify the image.
  2. Open the DMG and drag Ask Key into Applications. Keep its name and location, or agents cannot connect.
  3. Open Ask Key and follow the welcome page.

Good to know

  • Keep the originals of your credentials elsewhere; there is no built-in backup or recovery.
  • There is no automatic update. Ask Key requires macOS 14 or later.
  • An approved program can print, copy or forward what it receives.

Thanks

Both headline features in this release started as suggestions from @lagiosv: group timed allowances (#240) and ending them on lock (#241). Thank you!

If something in Ask Key gets in your way, or you have an idea for it, please open an issue. Bug reports, feature ideas and questions are all welcome.

Full details: Changelog · README · Security

中文

新增

  • 整组凭证一次限时允许。 Agent 请求读取某个分组里的凭证时，批准窗口可以一次给这个分组里所有符合条件的凭证限时允许。“详细信息”会列出涵盖的每份凭证；之后加入分组的凭证不在其中，其中某份凭证提前到期时，整个限时允许也随之结束。
  • 凭证库顶部列出生效中的限时允许，显示剩余时间，可以直接收回。搜索或按分组筛选时也会显示。分组限时允许只占一行，列出涵盖的所有凭证。
  • “设置”新增“锁屏时结束限时允许”，默认关闭。开启后，锁屏、Mac 睡眠或切换用户都会结束所有限时允许，回来之前也不能授予新的限时允许。开启和关闭都需要 Touch ID。

变更

  • 凭证管理处于锁定状态时，点击“有待处理请求”的提醒会直接弹出批准窗口，不需要先解锁管理。没有待处理请求时，点击只会把请旨带到前台。
  • 被分组限时允许涵盖的凭证会显示“撤销分组限时允许”，点击后整个分组的限时允许一起结束。

修复

  • 点击 Agent 写入失败的通知，会把请旨带到前台，不再跳到“待处理请求”。

安全

  • 开启“锁屏时结束限时允许”后，锁屏、睡眠和切换用户还会取消尚未使用的限时批准，并终止包含限时凭证、已准备好的命令。关闭这项设置不会恢复已收回的授权。
  • 分组限时允许只涵盖你批准时列出的凭证，作用于整个 macOS 用户，不包括写入。修改其中一份凭证，只会把这份移出；从任意一份撤销，都会结束整个限时允许。

从 0.4.0 升级

  1. 退出请旨，按下面的安装步骤下载并校验新版 DMG，替换 /Applications/Ask Key.app，再从“应用程序”打开请旨。
  2. 这次没有凭证库迁移。凭证、权限和 Agent 访问设置都会保留，无需“恢复 Agent 访问”；“锁屏时结束限时允许”初始为关闭。
  3. 降级到 0.4.0 之前，请先关闭“锁屏时结束限时允许”。 如果开着降级，0.4.0 会暂停 Agent 访问，在其中“恢复 Agent 访问”会把所有 Agent 访问设置恢复为默认值。在恢复之前重新升级，不会丢失任何设置。

从 0.3.2 或更早版本升级？请先阅读 0.4.0 发布说明：0.4.0 会迁移一次凭证库，升级前需要备份。

安装

  1. 下载下面的 AskKey.dmg 和 AskKey.dmg.sha256，运行 shasum -a 256 -c AskKey.dmg.sha256 校验镜像。
  2. 打开 DMG，把“Ask Key”拖进“应用程序”。不要改名或更换位置，否则 Agent 连不上。
  3. 打开请旨，按欢迎页操作。

请注意

  • 请在其他地方保留凭证原件；没有内置的备份和恢复功能。
  • 没有自动更新，需要 macOS 14 或更高版本。
  • 获准的程序可以打印、复制或转发收到的内容。

致谢

这个版本的两个主要功能都来自 @lagiosv 的建议：分组限时允许（#240）和锁屏时结束限时允许（#241）。谢谢你！

用请旨时遇到不顺手的地方，或者有任何想法，欢迎提交 issue。问题反馈、功能建议和使用疑问都可以。

详细信息：更新日志 · README · 安全说明

Assets 6
Loading