feat(security): enable system keyring for credential storage

Enable async-secret-service + crypto-rust features on the keyring crate, activating GNOME Keyring and KDE Wallet support. The keyring integration code was already written but the crate was compiled without any platform backend, so it silently failed every time. OAuth tokens will now be stored in the system keyring when available, with encrypted file as automatic fallback. Added org.freedesktop.secrets to Flatpak finish-args for sandbox keyring access. Fixes #215 cc
2026-04-06 16:20:26 -06:00
1 parent 54139ad4d3
commit c37f3d7595
@@ -28,6 +28,9 @@ finish-args:
  - --talk-name=org.freedesktop.Notifications
  - --talk-name=org.kde.StatusNotifierWatcher

+  # System keyring (GNOME Keyring, KDE Wallet) for credential storage
+  - --talk-name=org.freedesktop.secrets
+
  # MPRIS media controls (own-name auto-granted: name contains appid)
  - --talk-name=org.mpris.MediaPlayer2.*

@@ -220,7 +220,7 @@ dependencies = [
 "serde",
 "serde_repr",
 "tokio",
- "zbus",
+ "zbus 5.14.0",
 ]

 [[package]]
@@ -300,6 +300,17 @@ dependencies = [
 "slab",
 ]

+[[package]]
+name = "async-fs"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5"
+dependencies = [
+ "async-lock",
+ "blocking",
+ "futures-lite",
+]
+
 [[package]]
 name = "async-io"
 version = "2.6.0"
@@ -1326,6 +1337,24 @@ dependencies = [
 "dbus",
 ]

+[[package]]
+name = "dbus-secret-service"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "708b509edf7889e53d7efb0ffadd994cc6c2345ccb62f55cfd6b0682165e4fa6"
+dependencies = [
+ "aes",
+ "block-padding",
+ "cbc",
+ "dbus",
+ "fastrand",
+ "hkdf",
+ "num",
+ "once_cell",
+ "sha2",
+ "zeroize",
+]
+
 [[package]]
 name = "der-parser"
 version = "10.0.0"
@@ -3055,7 +3084,10 @@ version = "3.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
 dependencies = [
+ "dbus-secret-service",
 "log",
+ "secret-service",
+ "zbus 4.4.0",
 "zeroize",
 ]

@@ -3517,6 +3549,19 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"

+[[package]]
+name = "nix"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+dependencies = [
+ "bitflags 2.11.0",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
+]
+
 [[package]]
 name = "nix"
 version = "0.30.1"
@@ -3565,7 +3610,21 @@ dependencies = [
 "mac-notification-sys",
 "serde",
 "tauri-winrt-notification",
- "zbus",
+ "zbus 5.14.0",
+]
+
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
 ]

 [[package]]
@@ -3613,6 +3672,17 @@ dependencies = [
 "num-traits",
 ]

+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-rational"
 version = "0.4.2"
@@ -4038,7 +4108,7 @@ checksum = "e4022a17595a00d6a369236fdae483f0de7f0a339960a53118b818238e132224"
 dependencies = [
 "android_system_properties",
 "log",
- "nix",
+ "nix 0.30.1",
 "objc2",
 "objc2-foundation",
 "objc2-ui-kit",
@@ -5698,6 +5768,25 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

+[[package]]
+name = "secret-service"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4d35ad99a181be0a60ffcbe85d680d98f87bdc4d7644ade319b87076b9dbfd4"
+dependencies = [
+ "aes",
+ "cbc",
+ "futures-util",
+ "generic-array",
+ "hkdf",
+ "num",
+ "once_cell",
+ "rand 0.8.5",
+ "serde",
+ "sha2",
+ "zbus 4.4.0",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -6747,7 +6836,7 @@ dependencies = [
 "thiserror 2.0.18",
 "url",
 "windows 0.61.3",
- "zbus",
+ "zbus 5.14.0",
 ]

 [[package]]
@@ -6781,7 +6870,7 @@ dependencies = [
 "thiserror 2.0.18",
 "tracing",
 "windows-sys 0.60.2",
- "zbus",
+ "zbus 5.14.0",
 ]

 [[package]]
@@ -8844,6 +8933,16 @@ dependencies = [
 "time",
 ]

+[[package]]
+name = "xdg-home"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec1cdab258fb55c0da61328dc52c8764709b249011b2cad0454c72f0bf10a1f6"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "yasna"
 version = "0.5.2"
@@ -8887,6 +8986,44 @@ dependencies = [
 "synstructure",
 ]

+[[package]]
+name = "zbus"
+version = "4.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb97012beadd29e654708a0fdb4c84bc046f537aecfde2c3ee0a9e4b4d48c725"
+dependencies = [
+ "async-broadcast",
+ "async-executor",
+ "async-fs",
+ "async-io",
+ "async-lock",
+ "async-process",
+ "async-recursion",
+ "async-task",
+ "async-trait",
+ "blocking",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "hex",
+ "nix 0.29.0",
+ "ordered-stream",
+ "rand 0.8.5",
+ "serde",
+ "serde_repr",
+ "sha1",
+ "static_assertions",
+ "tracing",
+ "uds_windows",
+ "windows-sys 0.52.0",
+ "xdg-home",
+ "zbus_macros 4.4.0",
+ "zbus_names 3.0.0",
+ "zvariant 4.2.0",
+]
+
 [[package]]
 name = "zbus"
 version = "5.14.0"
@@ -8918,9 +9055,22 @@ dependencies = [
 "uuid",
 "windows-sys 0.61.2",
 "winnow 0.7.14",
- "zbus_macros",
- "zbus_names",
- "zvariant",
+ "zbus_macros 5.14.0",
+ "zbus_names 4.3.1",
+ "zvariant 5.10.0",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "4.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "267db9407081e90bbfa46d841d3cbc60f59c0351838c4bc65199ecd79ab1983e"
+dependencies = [
+ "proc-macro-crate 3.4.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "zvariant_utils 2.1.0",
 ]

 [[package]]
@@ -8933,9 +9083,20 @@ dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.117",
- "zbus_names",
- "zvariant",
- "zvariant_utils",
+ "zbus_names 4.3.1",
+ "zvariant 5.10.0",
+ "zvariant_utils 3.3.0",
+]
+
+[[package]]
+name = "zbus_names"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b9b1fef7d021261cc16cba64c351d291b715febe0fa10dc3a443ac5a5022e6c"
+dependencies = [
+ "serde",
+ "static_assertions",
+ "zvariant 4.2.0",
 ]

 [[package]]
@@ -8946,7 +9107,7 @@ checksum = "ffd8af6d5b78619bab301ff3c560a5bd22426150253db278f164d6cf3b72c50f"
 dependencies = [
 "serde",
 "winnow 0.7.14",
- "zvariant",
+ "zvariant 5.10.0",
 ]

 [[package]]
@@ -8995,6 +9156,20 @@ name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]

 [[package]]
 name = "zerotrie"
@@ -9050,6 +9225,19 @@ dependencies = [
 "zune-core",
 ]

+[[package]]
+name = "zvariant"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2084290ab9a1c471c38fc524945837734fbf124487e105daec2bb57fd48c81fe"
+dependencies = [
+ "endi",
+ "enumflags2",
+ "serde",
+ "static_assertions",
+ "zvariant_derive 4.2.0",
+]
+
 [[package]]
 name = "zvariant"
 version = "5.10.0"
@@ -9060,8 +9248,21 @@ dependencies = [
 "enumflags2",
 "serde",
 "winnow 0.7.14",
- "zvariant_derive",
- "zvariant_utils",
+ "zvariant_derive 5.10.0",
+ "zvariant_utils 3.3.0",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73e2ba546bda683a90652bac4a279bc146adad1386f25379cf73200d2002c449"
+dependencies = [
+ "proc-macro-crate 3.4.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "zvariant_utils 2.1.0",
 ]

 [[package]]
@@ -9074,7 +9275,18 @@ dependencies = [
 "proc-macro2",
 "quote",
 "syn 2.0.117",
- "zvariant_utils",
+ "zvariant_utils 3.3.0",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c51bcff7cc3dbb5055396bcf774748c3dab426b4b8659046963523cee4808340"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
 ]

 [[package]]
@@ -130,8 +130,8 @@ urlencoding = "2"
 # Environment variables
 dotenvy = "0.15"

-# Secure credential storage (system keyring)
-keyring = "3"
+# Secure credential storage (system keyring: GNOME Keyring, KDE Wallet, macOS Keychain)
+keyring = { version = "3", features = ["async-secret-service", "crypto-rust"] }

 # Clipboard
 tauri-plugin-clipboard-manager = "2"