Implement secure OS-backed secret storage #11

New Issue

hugo · 2026-08-09T18:57:07Z

hugo commented

2026-08-09 18:57:07 +00:00

Objective

Securely store and retrieve GPG secret-key passphrases and HTTPS Git credentials on every supported operating system.

Scope

Define storage-owned secret references keyed by purpose, server ID, application ID, account, and GPG key fingerprint.
Implement adapters for Apple Keychain with biometric/user-presence policy, Windows Credential Manager, and a Linux Secret Service or encrypted fallback that does not launch helpers.
Support create, retrieve, replace, delete, lock, unlock, cancellation, and unavailable-store errors.
Cache unlocked secrets only under an explicit bounded policy; zeroize transient copies and redact all diagnostics.
Keep platform FFI in the smallest isolated module and document its safety contract.

Acceptance criteria

TOML, Git configuration, logs, errors, crash output, and repository files never contain secret values.
Adapter contract tests cover missing, denied, cancelled, replaced and corrupted secrets.
CLI can unlock a protected GPG key and authenticate an HTTPS Git remote through opaque secret references.

Prerequisites

TOML configuration and CLI contract.

## Objective Securely store and retrieve GPG secret-key passphrases and HTTPS Git credentials on every supported operating system. ## Scope - Define storage-owned secret references keyed by purpose, server ID, application ID, account, and GPG key fingerprint. - Implement adapters for Apple Keychain with biometric/user-presence policy, Windows Credential Manager, and a Linux Secret Service or encrypted fallback that does not launch helpers. - Support create, retrieve, replace, delete, lock, unlock, cancellation, and unavailable-store errors. - Cache unlocked secrets only under an explicit bounded policy; zeroize transient copies and redact all diagnostics. - Keep platform FFI in the smallest isolated module and document its safety contract. ## Acceptance criteria - TOML, Git configuration, logs, errors, crash output, and repository files never contain secret values. - Adapter contract tests cover missing, denied, cancelled, replaced and corrupted secrets. - CLI can unlock a protected GPG key and authenticate an HTTPS Git remote through opaque secret references. ## Prerequisites TOML configuration and CLI contract.

hugo added this to the 01 - Full Rust pass CLI parity milestone 2026-08-09 18:57:07 +00:00

hugo added the enhancement label 2026-08-09 18:57:07 +00:00

hugo commented

2026-08-10 00:24:14 +00:00

Implemented in b685a48 (pushed to main). Added the storage-owned, OS-backed secret-store contract with opaque OpenPGP and HTTPS Git references; Apple Keychain/Protected Data user-presence support; Windows Credential Manager; Linux Secret Service using Rust crypto and no helper processes; explicit create/retrieve/replace/delete/lock/unlock behavior; typed denied/cancelled/unavailable/corrupted results; bounded zeroizing cache; and redacted diagnostics. Wired terminal show and embedded HTTPS Git fetch through the same unlocked Rust provider, and documented the platform/security contract. Verification: issue-specific secret-store tests (4 adapter/lifecycle/provider cases plus malformed-envelope unit coverage), protected OpenPGP compatibility fixtures, HTTPS credential delivery, config and embedded Git compatibility suites, and CLI integration all pass. Required repository gates also pass: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace.

Implemented in b685a48 (pushed to main). Added the storage-owned, OS-backed secret-store contract with opaque OpenPGP and HTTPS Git references; Apple Keychain/Protected Data user-presence support; Windows Credential Manager; Linux Secret Service using Rust crypto and no helper processes; explicit create/retrieve/replace/delete/lock/unlock behavior; typed denied/cancelled/unavailable/corrupted results; bounded zeroizing cache; and redacted diagnostics. Wired terminal show and embedded HTTPS Git fetch through the same unlocked Rust provider, and documented the platform/security contract. Verification: issue-specific secret-store tests (4 adapter/lifecycle/provider cases plus malformed-envelope unit coverage), protected OpenPGP compatibility fixtures, HTTPS credential delivery, config and embedded Git compatibility suites, and CLI integration all pass. Required repository gates also pass: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace.

hugo closed this issue

2026-08-10 00:24:21 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#11