danielrobbins/keychain 3.0.9

Keychain 3.0.9

on GitHub

Keychain 3.0.9 makes everyday shell startup faster and more dependable across operating systems, with more reliable agent discovery and tighter checks on saved state and command arguments.

• Reduced startup overhead, particularly for commands that do not load keys. On Linux, Keychain now reads process information directly from /proc, avoiding the cost of launching ps and working without it on minimal systems such as BusyBox-based installations.
• Some Linux and Android configurations hide running SSH agents from process listings, causing Keychain to reject an otherwise usable agent. Keychain can now reuse a responding, user-owned socket when the recorded PID is alive but its details are inaccessible. keychain inspect explains this restriction; stopping an agent still requires verifying its process identity (#270).
• Differences in ps output could make existing agents go undetected. Corrected discovery on Cygwin and MSYS2 (PR #276), and addressed truncated process names on macOS, BSD and Solaris/illumos. Linux discovery also skips zombie processes and tolerates processes disappearing during a scan.
• A failed or unusable process listing could previously look like no agents were running. Keychain now reports a clear error instead of starting replacement agents or discarding saved references on that basis.
• The legacy --stop mine and --stop all selections were reversed. Restored their Keychain 2.x behavior: mine stops the agent recorded in Keychain's pidfile, while all stops all visible SSH agents owned by the calling user. Updated help text and diagnostics to make agent selection clearer.
• An SSH configuration containing only Host * could leave --confallhosts with no identities to load. Keychain now asks OpenSSH for those catch-all settings when there are no concrete host names, and resolves home-directory paths in the returned identities.
• A missing username entry could cause ownership and permission checks to be skipped. Keychain now checks numeric user IDs directly, so a missing account name neither bypasses checks nor rejects a directory that belongs to you.
• Invalid hostname overrides are now rejected before they can affect Keychain's file paths. Names beginning with - are passed to SSH and GPG tools as operands, preventing them from being interpreted as command options.

Expanded regression coverage includes real-agent reuse on MSYS2, restricted Linux process visibility, minimal Linux environments, and native FreeBSD, OpenBSD and OmniOS tests. Platform-specific behavior is now isolated to make future fixes less likely to affect other systems. Thanks to Fumiyuki Shimizu (@fmrns) for the Cygwin/MSYS2 fix, and @tarilka0gg for startup improvements, security fixes, review and follow-up fixes.