Implement secure OS-backed secret storage

crates/storage/src/git.rs

@@ -17,6 +17,7 @@ use gix::{
     objs::tree::EntryKind,
 };
 use sha1::{Digest as _, Sha1};
+use zeroize::Zeroize as _;
 
 use crate::{
     config::{ApplicationId, GitRemote, ServerId},
@@ -184,6 +185,8 @@ pub enum GitError {
         name: String,
     },
     CredentialsUnavailable,
+    CredentialAccessDenied,
+    CredentialCancelled,
     AuthenticationFailed,
     NonFastForward,
     MergeConflicts {
@@ -223,6 +226,12 @@ impl fmt::Display for GitError {
             Self::CredentialsUnavailable => {
                 formatter.write_str("HTTPS Git credentials are unavailable")
             }
+            Self::CredentialAccessDenied => {
+                formatter.write_str("access to HTTPS Git credentials was denied")
+            }
+            Self::CredentialCancelled => {
+                formatter.write_str("HTTPS Git credential authentication was cancelled")
+            }
             Self::AuthenticationFailed => formatter.write_str("HTTPS Git authentication failed"),
             Self::NonFastForward => formatter.write_str("the remote update is not a fast-forward"),
             Self::MergeConflicts { paths } => write!(
@@ -254,7 +263,7 @@ pub struct GitCredential {
 }
 
 impl GitCredential {
-    pub fn new(username: impl Into<String>, password: Vec<u8>) -> Result<Self, GitError> {
+    pub fn new(username: impl Into<String>, mut password: Vec<u8>) -> Result<Self, GitError> {
         let username = username.into();
         if username.is_empty()
             || username.contains(['\n', '\r', '\0'])
@@ -262,6 +271,7 @@ impl GitCredential {
             || password.contains(&b'\r')
             || password.contains(&0)
         {
+            password.zeroize();
             return Err(GitError::CredentialsUnavailable);
         }
         Ok(Self {