Persistent keychain storage on Linux¶
Linux keychain entries are stored in the freedesktop Secret Service and
survive a reboot. There is nothing to enable. The linux-persistent
feature still exists so that manifests naming it keep building, but it
has no effect, and it can be removed.
Check the build prerequisites¶
libdbus is compiled from source and linked statically, so the build
host needs only a C compiler for the target. No libdbus-1-dev or
pkg-config is needed.
# Debian / Ubuntu, building for the host
sudo apt-get install -y build-essential
# building for a musl target as well
sudo apt-get install -y musl-tools
rustup target add x86_64-unknown-linux-musl
Check the runtime prerequisites¶
The Secret Service needs a D-Bus session bus and a running provider such as GNOME Keyring or KWallet.
# is there a session bus?
echo "$DBUS_SESSION_BUS_ADDRESS"
# is something providing the Secret Service?
busctl --user list | grep -i secrets
If the first is empty, there is no session bus, and every keychain call
fails with CredentialError::Keychain.
Expect it not to work on servers, containers and CI¶
Headless servers, containers and CI runners typically have no session bus and no keyring daemon. Use an environment variable there instead:
Secrets stored by earlier releases¶
Every 0.6 release stored Linux secrets in the Secret Service, and this one finds them unchanged: the item attributes, label and collection are the same. Nothing needs migrating.
Releases before 0.6 stored them in kernel keyutils, which is session-scoped. Anything stored that way was gone at the end of the session it was written in, so there is nothing to carry over from those either. Write the secret again: