Installation

keymitt is one self-contained binary for macOS, Windows and Linux.

One-line install

macOS and Linux:

curl -fsSL https://keymitt.walisayu.com/install.sh | sh

Windows (PowerShell):

irm https://keymitt.walisayu.com/install.ps1 | iex

The installer picks the build for your OS and CPU, downloads it from the GitHub release, verifies its SHA-256 checksum, and installs the single keymitt binary — to ~/.local/bin (or /usr/local/bin as root) on macOS and Linux, and to %LOCALAPPDATA%\Programs\keymitt on Windows, which it adds to your user PATH. It refuses plain HTTP, archives with unexpected paths and checksum mismatches. Pin a version with sh -s -- --version v0.1.0 (or $env:KEYMITT_VERSION = 'v0.1.0'), or choose the directory with --bin-dir (KEYMITT_INSTALL_DIR).

Every release also carries signed build-provenance attestations. To check an archive yourself:

gh attestation verify keymitt-v0.1.0-aarch64-apple-darwin.tar.gz --repo walisayu/keymitt

Build from source

You need Rust 1.85 or newer (rustup.rs).

git clone https://github.com/walisayu/keymitt.git
cd keymitt
cargo install --path .

http_request uses the system curl, which ships with macOS, Windows 10 and later, and most Linux distributions.

Check the installation

keymitt doctor

doctor checks the keymitt home directory, the policy file, the keychain (by writing, reading and deleting a probe entry), which approval methods will be used, and whether curl is available. Add --approval to trigger a test prompt.

macOS

• Secrets go to your login Keychain, under the service name keymitt.
• Approvals use LocalAuthentication: Touch ID where available, otherwise your login password. On a Mac without Touch ID — a Mac mini, for example — the prompt asks for the password.
• If you rebuild or reinstall the binary, macOS may ask whether keymitt may access its Keychain items again. Choose Always Allow.

Windows

• Secrets go to Credential Manager. Each secret can be at most 2560 bytes.
• Approvals use Windows Hello (PIN, fingerprint or face). Set up a Windows Hello PIN under Settings → Accounts → Sign-in options if you have not.
• Without Windows Hello, keymitt falls back to a Yes/No message box — a weak method that confirms intent but does not authenticate you. Set allow_weak = false in the policy to forbid it.

Linux

• Secrets go to the Secret Service over D-Bus — GNOME Keyring or KWallet. A desktop session usually provides one. On a server without a desktop, start GNOME Keyring yourself inside a D-Bus session, and give it a non-empty password — with an empty one, storing secrets fails:

  printf 'your-keyring-password' | gnome-keyring-daemon --unlock --components=secrets

• Strong approvals use polkit and require a one-time installation of keymitt's polkit action:

  keymitt setup polkit     # prints the action file and the install command
  sudo install -m 644 dev.keymitt.approve.policy /usr/share/polkit-1/actions/

  Each use then asks for your own password through the desktop's polkit agent (auth_self, nothing cached).

• Without polkit, keymitt can fall back to a zenity or kdialog question, then to approving from a terminal. Both are weak methods.

Where keymitt keeps its files

Platform	Default home
macOS, Linux	~/.config/keymitt (or $XDG_CONFIG_HOME/keymitt)
Windows	%APPDATA%\keymitt

Set KEYMITT_HOME to use another directory. The home holds policy.toml, audit.jsonl and pending CLI approvals — never secret values.