Enable persistent keychain storage on Linux¶

By default, Linux keychain entries are stored in the kernel keyring and disappear when the session ends. The linux-persistent feature switches in the freedesktop Secret Service backend, which survives a reboot.

This affects Linux only. macOS and Windows already persist.

Install the build dependencies first¶

The feature pulls in libdbus-sys, which links against system D-Bus. Without these packages the build fails at link time with an error from libdbus-sys rather than from this crate.

# Debian / Ubuntu
sudo apt-get install -y pkg-config libdbus-1-dev

# Fedora / RHEL
sudo dnf install -y pkgconf-pkg-config dbus-devel

Enable the feature¶

[dependencies]
rtb-credentials = { version = "0.6", features = ["linux-persistent"] }

Nothing in your code changes. The backend is selected at compile time.

Check the runtime prerequisites are present¶

Compiling the feature in is not enough. The Secret Service backend needs a D-Bus session bus and a running provider such as gnome-keyring or kwallet.

# is there a session bus?
echo "$DBUS_SESSION_BUS_ADDRESS"

# is something providing the Secret Service?
busctl --user list | grep -i secrets

If the first is empty, there is no session bus and keychain calls will fail regardless of the feature.

Expect it not to work on servers, containers and CI¶

Headless servers, containers and CI runners typically have no session bus and no keyring daemon. The feature makes persistence possible, not available, and in those environments keychain calls fail exactly as they did without it.

Use an environment variable there instead:

anthropic:
  env: MYTOOL_ANTHROPIC_KEY

Understand what you are imposing on the rest of the build¶

Cargo features are additive across a dependency graph. Once any crate in a build enables linux-persistent, it is enabled for every consumer of rtb-credentials in that build, and the pkg-config and libdbus-1-dev build requirement applies to all of them.

A workspace cannot have one member opt in privately. If a shared build image needs to stay hermetic, do not enable this feature — reach for an environment variable instead.

Migrate secrets already stored under the default backend¶

There is no migration path. Kernel keyutils and the Secret Service are separate stores, and switching the feature on does not copy anything between them.

A secret written before the change is not visible after it. Write it again with the new build:

store.set("mytool", "anthropic", secret).await?;