vicrodh
b94e0e6cdb
qbz-credentials still asked for the Linux features on every target with default_features on. keyring 3 has no default backend: without the per-platform feature it exports the in-memory mock, whose writes succeed and whose contents die with the process, so the offline-cache master key was regenerated every launch and every wrapped blob failed AES-GCM on the next start, with the logs reporting a working keyring. It survived only because Cargo unified features with qbz-secrets, which is the fragility the per-target block exists to remove. Also refuse a non-disk-backed backend at runtime and take the KDF path. Measured in keyring-3.6.3, not assumed: windows.rs, macos.rs and secret_service.rs all inherit the trait default UntilDelete (credential.rs:171); mock.rs:228 overrides it to EntryOnly. Testing for ProcessOnly, as first drafted, would never have fired. cc
47 lines
1.8 KiB
TOML
47 lines
1.8 KiB
TOML
[package]
|
|
name = "qbz-credentials"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
description = "Encrypted credential and OAuth token storage for QBZ (keyring + AES-256-GCM file)"
|
|
|
|
[dependencies]
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
log = { workspace = true }
|
|
base64 = { workspace = true }
|
|
tokio = { workspace = true }
|
|
aes-gcm = "0.10"
|
|
sha2 = "0.11"
|
|
rand = "0.10"
|
|
dirs = "6"
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
# async-io, NOT tokio: zbus features unify across the whole dependency graph
|
|
# and its "tokio" feature wins over "async-io" — enabling it here flipped the
|
|
# zbus 5 executor to tokio for accesskit_unix/atspi/ksni too, whose D-Bus
|
|
# connections live on plain threads => startup panic "there is no reactor
|
|
# running" and dead AT-SPI accessibility. async-io futures are runtime-
|
|
# agnostic, so our portal call still awaits fine inside tokio.
|
|
ashpd = { version = "0.13", default-features = false, features = ["async-io", "secret"] }
|
|
# OS keyring backends, per target. keyring 3 has NO default backend feature:
|
|
# without the per-platform one it silently exports the in-memory `mock`
|
|
# (keyring-3.6.3/src/lib.rs:274-298), whose writes succeed and whose contents
|
|
# die with the process. An unconditional feature list also meant this crate
|
|
# only resolved correctly because Cargo unified features with qbz-secrets.
|
|
# Same shape as crates/qbz-secrets/Cargo.toml.
|
|
keyring = { version = "3", default-features = false, features = [
|
|
"async-secret-service",
|
|
"crypto-rust",
|
|
] }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
keyring = { version = "3", default-features = false, features = ["apple-native"] }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
keyring = { version = "3", default-features = false, features = ["windows-native"] }
|