andy/nexus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: probe the keychain with a read instead of writing an item at every launch

Browse Source 
Startup wrote and deleted a probe item to see whether the keychain works,
waking D-Bus on Linux and risking a Keychain prompt on macOS. A read of a
missing entry answering 'no entry' proves the same; if a later write is
refused anyway, set_checked already falls back to the vault (F11).

Not verified against a live Secret Service or macOS Keychain in this
environment (no secret service here; the probe correctly reports it
unavailable).
This commit is contained in:
Andy Dixon
2026-10-12 09:21:44 +01:00
parent 954bf25dc0
commit 10f93271cf
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/core/src/secrets.rs
+4 -1
View File
@@ -272,9 +272,12 @@ impl Keychain {
Keychain { service: service.into(), legacy: legacy.map(Into::into) } Keychain { service: service.into(), legacy: legacy.map(Into::into) }
} }
/// Probes with a read of an entry that doesn't exist: "no entry" proves the keychain answers,
/// without writing an item at every launch (which wakes D-Bus and can prompt on macOS). If
/// writes later fail anyway, `Secrets::set_checked` falls back to the vault.
pub fn available(&self) -> bool { pub fn available(&self) -> bool {
let service = self.service.clone(); let service = self.service.clone();
off_runtime(move || entry(&service, "__nexus_keychain_probe__").and_then(|e| e.set_password("probe").and_then(|_| e.delete_credential())).is_ok()) off_runtime(move || matches!(entry(&service, "__nexus_keychain_probe__").and_then(|e| e.get_password()), Ok(_) | Err(keyring::Error::NoEntry)))
} }
/// Reads a secret; a miss under the current service falls back to the legacy one and copies /// Reads a secret; a miss under the current service falls back to the legacy one and copies