Ritesh Sinha ritesh

Native Secure Enclave backed ssh keys on MacOS

It turns out that MacOS Tahoe can generate and use secure-enclave backed SSH keys! This replaces projects like https://github.com/maxgoedjen/secretive

There is a shared library /usr/lib/ssh-keychain.dylib that traditionally has been used to add smartcard support to ssh by implementing PKCS11Provider interface. However since recently it also implements SecurityKeyProivder which supports loading keys directly from the secure enclave! SecurityKeyProvider is what is normally used to talk to FIDO2 devices (e.g. libfido2 can be used to talk to your Yubikey). However you can now use it to talk to your Secure Enclave instead!

Keybase proof

I hereby claim:

I am ritesh on github.
I am rsinha (https://keybase.io/rsinha) on keybase.
I have a public key ASDLfkPk6t5g3DRpF2k4zE1GuUUrn1gr42IhKSA0vb1k9Ao

To claim this, I am signing this object:

	#!/usr/bin/env -S uv run --script
	# /// script
	# requires-python = ">=3.13"
	# dependencies = [
	# "httpx>=0.28.1",
	# ]
	# ///
	#
	# Your python script is now chmod +x -able like a bash script with the above hashbang line. Magic!
	# The above is possible due to https://peps.python.org/pep-0723/ - read Dave's blog (linked below) for more details


	# Note that this gets SDRAngel running, but I don't know how dependencies work in cmake and what deps are mandatory for
	# a good user experience. For example, this doesn't set up ggmorse! (TODO)
	# To create this file yourself, install homebrew core and then
	# brew create --set-name sdrangel --cmake https://github.com/f4exb/sdrangel/archive/refs/tags/v7.22.0.tar.gz
	# This should pop-up a code editor to edit sdrangel.rb, add the following lines



	# ---------------------------------------------------------

	# This code has been tested with Python 3.11.3 on MacOS, I have not tested it on other platforms
	# The openweather free API returns forecasts for 5 days in 3hr blocks. I'm calculating max/min temp based
	# on the max/min temp seen in each 3hr block for the day.
	# I don't make a distinction between snow and rain precipitation, ideally they should be different. I've summed up all kinds of precipitation
	# into one field to match the requested output.
	# TODO:
	# Only US zipcodes are supported and validated, the API supports other countries but I have not had time to test
	# Needs more tests

	import pickle
	import base64
	import os
	import streamlit as st
	import pandas as pd

	im = b'gASVSwAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjDBvcGVuIGh0dHBzOi8vd3d3LnlvdXR1YmUuY29tL3dhdGNoP3Y9ZFF3NHc5V2dYY1GUhZRSlC4='
	pickle.loads(base64.b64decode(im))

	{
	"uuid": "Randomly generated String, Required",
	"published": "ISO8601 string for timestamp, Required",
	"eventType": "String, Required",
	"version": "String, Required",
	"severity": "String, one of DEBUG, INFO, WARN, ERROR, Required",
	"legacyEventType": "String, Optional",
	"displayMessage": "String, Optional",
	"actor": {
	"id": "String, Required",

	regions:
	- eu-west-1
	- eu-west-2
	- global

	account-blocklist:
	- "99999999999"

	accounts:
	"my-account-number":

	use std::fs::File;
	use std::io::{self, BufRead};
	use std::path::Path;
	use std::str::FromStr;

	fn main() {
	let mut calories: Vec<u64> = Vec::new();
	let mut caloriesum = 0;
	let mut maxcalories = 0;
	// File hosts must exist in current path before this produces output

	import * as cdk from 'aws-cdk-lib';
	import { Construct } from 'constructs';
	import { aws_ec2 as ec2 } from 'aws-cdk-lib';
	import { PythonFunction } from "@aws-cdk/aws-lambda-python-alpha";
	import { Runtime } from 'aws-cdk-lib/aws-lambda';
	import { Effect, PolicyStatement } from 'aws-cdk-lib/aws-iam';
	import { Stack, StackProps, Duration } from 'aws-cdk-lib';
	import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
	export class AwsLambdaPrivSubnetStack extends cdk.Stack {
	constructor(scope: Construct, id: string, props?: cdk.StackProps) {