Securely store and retrieve GPG secret-key passphrases and HTTPS Git credentials on every supported operating system.
Scope
Define storage-owned secret references keyed by purpose, server ID, application ID, account, and GPG key fingerprint.
Implement adapters for Apple Keychain with biometric/user-presence policy, Windows Credential Manager, and a Linux Secret Service or encrypted fallback that does not launch helpers.
Support create, retrieve, replace, delete, lock, unlock, cancellation, and unavailable-store errors.
Cache unlocked secrets only under an explicit bounded policy; zeroize transient copies and redact all diagnostics.
Keep platform FFI in the smallest isolated module and document its safety contract.
Acceptance criteria
TOML, Git configuration, logs, errors, crash output, and repository files never contain secret values.
CLI can unlock a protected GPG key and authenticate an HTTPS Git remote through opaque secret references.
Prerequisites
TOML configuration and CLI contract.
## Objective
Securely store and retrieve GPG secret-key passphrases and HTTPS Git credentials on every supported operating system.
## Scope
- Define storage-owned secret references keyed by purpose, server ID, application ID, account, and GPG key fingerprint.
- Implement adapters for Apple Keychain with biometric/user-presence policy, Windows Credential Manager, and a Linux Secret Service or encrypted fallback that does not launch helpers.
- Support create, retrieve, replace, delete, lock, unlock, cancellation, and unavailable-store errors.
- Cache unlocked secrets only under an explicit bounded policy; zeroize transient copies and redact all diagnostics.
- Keep platform FFI in the smallest isolated module and document its safety contract.
## Acceptance criteria
- TOML, Git configuration, logs, errors, crash output, and repository files never contain secret values.
- Adapter contract tests cover missing, denied, cancelled, replaced and corrupted secrets.
- CLI can unlock a protected GPG key and authenticate an HTTPS Git remote through opaque secret references.
## Prerequisites
TOML configuration and CLI contract.
hugo
added this to the 01 - Full Rust pass CLI parity milestone 2026-08-09 18:57:07 +00:00
Implemented in b685a48 (pushed to main). Added the storage-owned, OS-backed secret-store contract with opaque OpenPGP and HTTPS Git references; Apple Keychain/Protected Data user-presence support; Windows Credential Manager; Linux Secret Service using Rust crypto and no helper processes; explicit create/retrieve/replace/delete/lock/unlock behavior; typed denied/cancelled/unavailable/corrupted results; bounded zeroizing cache; and redacted diagnostics. Wired terminal show and embedded HTTPS Git fetch through the same unlocked Rust provider, and documented the platform/security contract. Verification: issue-specific secret-store tests (4 adapter/lifecycle/provider cases plus malformed-envelope unit coverage), protected OpenPGP compatibility fixtures, HTTPS credential delivery, config and embedded Git compatibility suites, and CLI integration all pass. Required repository gates also pass: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace.
Implemented in b685a48 (pushed to main). Added the storage-owned, OS-backed secret-store contract with opaque OpenPGP and HTTPS Git references; Apple Keychain/Protected Data user-presence support; Windows Credential Manager; Linux Secret Service using Rust crypto and no helper processes; explicit create/retrieve/replace/delete/lock/unlock behavior; typed denied/cancelled/unavailable/corrupted results; bounded zeroizing cache; and redacted diagnostics. Wired terminal show and embedded HTTPS Git fetch through the same unlocked Rust provider, and documented the platform/security contract. Verification: issue-specific secret-store tests (4 adapter/lifecycle/provider cases plus malformed-envelope unit coverage), protected OpenPGP compatibility fixtures, HTTPS credential delivery, config and embedded Git compatibility suites, and CLI integration all pass. Required repository gates also pass: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Objective
Securely store and retrieve GPG secret-key passphrases and HTTPS Git credentials on every supported operating system.
Scope
Acceptance criteria
Prerequisites
TOML configuration and CLI contract.
Implemented in
b685a48(pushed to main). Added the storage-owned, OS-backed secret-store contract with opaque OpenPGP and HTTPS Git references; Apple Keychain/Protected Data user-presence support; Windows Credential Manager; Linux Secret Service using Rust crypto and no helper processes; explicit create/retrieve/replace/delete/lock/unlock behavior; typed denied/cancelled/unavailable/corrupted results; bounded zeroizing cache; and redacted diagnostics. Wired terminal show and embedded HTTPS Git fetch through the same unlocked Rust provider, and documented the platform/security contract. Verification: issue-specific secret-store tests (4 adapter/lifecycle/provider cases plus malformed-envelope unit coverage), protected OpenPGP compatibility fixtures, HTTPS credential delivery, config and embedded Git compatibility suites, and CLI integration all pass. Required repository gates also pass: cargo fmt --all -- --check; RUSTFLAGS='-D warnings' cargo check --workspace --all-targets; cargo clippy --workspace --all-targets -- -D warnings; cargo test --workspace.