64 lines
2.3 KiB
TOML
64 lines
2.3 KiB
TOML
[package]
|
|
name = "qbz-secrets"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
description = "Device-bound secret wrapping for QBZ (offline cache keys, tokens)"
|
|
|
|
[dependencies]
|
|
# AES-256-GCM for the at-rest wrap/unwrap
|
|
aes-gcm = "0.10"
|
|
|
|
# KDF for the fallback path when OS keyring isn't available
|
|
hkdf = "0.12"
|
|
sha2 = "0.10"
|
|
|
|
# RNG for nonces + install UUID generation
|
|
rand = "0.10"
|
|
|
|
# UUID for the persistent install identifier (salt component for fallback)
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
|
|
# Serde for the on-disk wrapper blob envelope
|
|
serde = { workspace = true }
|
|
|
|
# Base64 for keyring-roundtripped master key (secret-service expects a UTF-8 string)
|
|
base64 = { workspace = true }
|
|
|
|
# Errors
|
|
thiserror = { workspace = true }
|
|
log = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
|
|
# OS keyring backends: Secret Service (Linux), Keychain (macOS), Credential
|
|
# Manager (Windows). These are the only targets allowed to attempt a keyring.
|
|
#
|
|
# Every backend is opt-in. keyring 3.x ships no `default` feature contents at
|
|
# all, and each platform arm reads `not(feature = "…-native")` → `pub use mock
|
|
# as default`. That mock is an in-memory store whose writes *succeed*, so
|
|
# depending on it does not fail loudly: it hands back a master key that never
|
|
# outlives the process, and every blob wrapped in one run is undecryptable in
|
|
# the next. `Backend::new` still reports `BackendKind::Keyring`, so the logs
|
|
# say nothing is wrong.
|
|
#
|
|
# Linux names its backend here rather than relying on qbz-credentials and Cargo
|
|
# feature unification. macOS and Windows opt into only their native stores.
|
|
# Mobile and every other target omit `keyring` entirely and take the persisted
|
|
# KDF path in `backend.rs`; an unsupported target must never reach the mock.
|
|
#
|
|
# `async-secret-service` and not `sync-secret-service`: keyring rejects enabling
|
|
# both. `crypto-rust` is required by the Secret Service backend.
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
keyring = { version = "3", default-features = false, features = [
|
|
"async-secret-service",
|
|
"crypto-rust",
|
|
] }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
keyring = { version = "3", default-features = false, features = ["apple-native"] }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
keyring = { version = "3", default-features = false, features = ["windows-native"] }
|