45 lines
1.5 KiB
TOML
45 lines
1.5 KiB
TOML
[package]
|
|
name = "qbz-secrets"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
description = "Device-bound secret wrapping for QBZ (offline cache keys, tokens)"
|
|
|
|
[dependencies]
|
|
# AES-256-GCM for the at-rest wrap/unwrap
|
|
aes-gcm = "0.10"
|
|
|
|
# KDF for the fallback path when OS keyring isn't available
|
|
hkdf = "0.12"
|
|
sha2 = "0.10"
|
|
|
|
# RNG for nonces + install UUID generation
|
|
rand = "0.9"
|
|
|
|
# UUID for the persistent install identifier (salt component for fallback)
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
|
|
# Serde for the on-disk wrapper blob envelope
|
|
serde = { workspace = true }
|
|
|
|
# Base64 for keyring-roundtripped master key (secret-service expects a UTF-8 string)
|
|
base64 = { workspace = true }
|
|
|
|
# Errors
|
|
thiserror = { workspace = true }
|
|
log = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
|
|
# OS keyring backends: libsecret/secret-service (Linux), Keychain (macOS),
|
|
# DPAPI (Windows). **Desktop only, deliberately.** keyring 3.x compiles no real
|
|
# backend for Android, and none for iOS without its `apple-native` feature — it
|
|
# routes both to an in-memory `mock` whose writes *succeed*. Depending on it
|
|
# there would not fail loudly; it would hand back a master key that never
|
|
# leaves the process, so every blob wrapped in one run is undecryptable in the
|
|
# next. Mobile takes the KDF path, which is derived from a persisted install id
|
|
# and is stable across launches. See `backend.rs`.
|
|
[target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
|
|
keyring = "3"
|