secretservice

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 3, 2026 License: Apache-2.0, MIT Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source 
const DefaultCollection dbus.ObjectPath = "/org/freedesktop/secrets/aliases/default"

DefaultCollection need not necessarily exist in the user's keyring.

View Source 
const DefaultSessionOpenTimeout = 10 * time.Second

DefaultSessionOpenTimeout

View Source 
const NilFlags = 0

NilFlags

View Source 
const NullPrompt = "/"

NullPrompt

View Source 
const ReplaceBehaviorDoNotReplace = 0

ReplaceBehaviorDoNotReplace

View Source 
const ReplaceBehaviorReplace = 1

ReplaceBehaviorReplace

View Source 
const SecretServiceInterface = "org.freedesktop.secrets"

SecretServiceInterface

View Source 
const SecretServiceObjectPath dbus.ObjectPath = "/org/freedesktop/secrets"

SecretServiceObjectPath

Variables

View Source 
var ErrNoSecretService = errors.New("no org.freedesktop.secrets owner on the session bus")

ErrNoSecretService is returned by SecretService.Available when no process owns the org.freedesktop.secrets name on the session bus, i.e. no Secret Service backend (such as gnome-keyring or kwallet) is currently running. The keychain package wraps it under its ErrKeychainUnavailable sentinel.

View Source 
var ErrNoSessionBus = errors.New("no D-Bus session bus available")

ErrNoSessionBus is returned by NewService when no D-Bus session bus can be reached: either DBUS_SESSION_BUS_ADDRESS names a unix socket that does not exist, or no session bus address can be determined without launching one. The keychain package wraps it under its ErrKeychainUnavailable sentinel.

Functions

func NewSecretProperties 

func NewSecretProperties(label string, attributes map[string]string) map[string]dbus.Variant

NewSecretProperties

Types

type Attributes 

type Attributes map[string]string

Attributes

type AuthenticationMode 

type AuthenticationMode string

AuthenticationMode 

const AuthenticationDHAES AuthenticationMode = "dh-ietf1024-sha256-aes128-cbc-pkcs7"

AuthenticationDHAES 

const AuthenticationInsecurePlain AuthenticationMode = "plain"

AuthenticationInsecurePlain

type PromptCompletedResult 

type PromptCompletedResult struct {
	Dismissed bool
	Paths     dbus.Variant
}

PromptCompletedResult

type PromptDismissedError 

type PromptDismissedError struct {
	// contains filtered or unexported fields
}

PromptDismissedError

func (PromptDismissedError) Error 

func (p PromptDismissedError) Error() string

Error

type ReplaceBehavior 

type ReplaceBehavior int

ReplaceBehavior

type Secret 

type Secret struct {
	Session     dbus.ObjectPath
	Parameters  []byte
	Value       []byte
	ContentType string
}

Secret

type SecretService 

type SecretService struct {
	// contains filtered or unexported fields
}

SecretService

func NewService 

func NewService(ctx context.Context) (*SecretService, error)

NewService dials a fresh private connection to the D-Bus session bus and returns a SecretService bound to it. Every call dials its own connection, so the caller MUST Close the returned service (see SecretService.Close).

ctx bounds the connection's Auth and Hello handshake and every subsequent D-Bus call issued on it: cancelling ctx tears the connection down (godbus closes it when ctx is done). NewService never autolaunches a session bus — it uses dbus.SessionBusPrivateNoAutoStartup rather than dbus.ConnectSessionBus, so on a host with no running bus (WSL, headless) it fails fast with ErrNoSessionBus instead of spawning dbus-launch. As a further fast path it stats the session bus unix socket before dialing and returns ErrNoSessionBus if that socket is missing.

NOTE: the raw socket dial itself is performed by godbus and is not ctx-aware; ctx bounds everything after the connection is established. In practice a unix socket dial fails immediately when the socket is missing or unaccepting, and the pre-dial stat covers the common stale-address case.

func (*SecretService) Available added in v0.2.0 

func (s *SecretService) Available(ctx context.Context) error

Available reports whether the Secret Service backend is reachable, without activating it or producing any user-facing prompt.

It issues a single org.freedesktop.DBus.NameHasOwner query against the bus daemon object (dbus.Conn.BusObject). Prompt-safety comes from the nature of that call: NameHasOwner is answered by the bus daemon from its own name registry and is never forwarded to org.freedesktop.secrets, so it cannot reach any prompt path (see [PromptAndWait]) and cannot mutate the keyring. dbus.FlagNoAutoStart is passed as defence-in-depth, but note it has no effect on this particular call: the destination is the always-running bus daemon (org.freedesktop.DBus), not an activatable service, so there is nothing for the flag to suppress here.

It returns nil when the name is owned, ErrNoSecretService when it is not, or the underlying error on a transport failure or a ctx timeout.

func (*SecretService) Close added in v0.0.27 

func (s *SecretService) Close() error

Close releases the underlying D-Bus connection and its socket file descriptor. Each NewService call dials a private session-bus connection, so every service MUST be closed when it is no longer needed; otherwise the connection — and its fd — leaks for the lifetime of the process. Closing the connection also tears down the signal goroutine that NewService starts. Close is safe to call on a service whose connection is nil.

func (*SecretService) CloseSession 

func (s *SecretService) CloseSession(session *Session)

CloseSession

func (*SecretService) Collections added in v0.0.27 

func (s *SecretService) Collections() ([]dbus.ObjectPath, error)

Collections returns the object paths of every collection known to the secret service.

func (*SecretService) CreateItem 

func (s *SecretService) CreateItem(collection dbus.ObjectPath, properties map[string]dbus.Variant, secret Secret, replaceBehavior ReplaceBehavior) (item dbus.ObjectPath, err error)

CreateItem

func (*SecretService) DeleteItem 

func (s *SecretService) DeleteItem(item dbus.ObjectPath) (err error)

DeleteItem

func (*SecretService) GetAttributes 

func (s *SecretService) GetAttributes(item dbus.ObjectPath) (attributes Attributes, err error)

GetAttributes

func (*SecretService) GetSecret 

func (s *SecretService) GetSecret(item dbus.ObjectPath, session Session) (secretPlaintext []byte, err error)

GetSecret

func (*SecretService) IsLocked added in v0.0.27 

func (s *SecretService) IsLocked(collection dbus.ObjectPath) (bool, error)

IsLocked reports whether the given collection is currently locked.

func (*SecretService) LockItems 

func (s *SecretService) LockItems(items []dbus.ObjectPath) (err error)

LockItems

func (*SecretService) Obj 

func (s *SecretService) Obj(path dbus.ObjectPath) dbus.BusObject

Obj

func (*SecretService) OpenSession 

func (s *SecretService) OpenSession(mode AuthenticationMode) (session *Session, err error)

OpenSession

func (*SecretService) PromptAndWait 

func (s *SecretService) PromptAndWait(prompt dbus.ObjectPath) (paths *dbus.Variant, err error)

PromptAndWait is NOT thread-safe.

func (*SecretService) ReadAlias added in v0.0.27 

func (s *SecretService) ReadAlias(alias string) (dbus.ObjectPath, error)

ReadAlias resolves an alias (e.g. "default") to the collection object path it points at. The secret service returns the null path "/" when the alias is not assigned to any collection.

func (*SecretService) SearchCollection 

func (s *SecretService) SearchCollection(collection dbus.ObjectPath, attributes Attributes) (items []dbus.ObjectPath, err error)

SearchCollection

func (*SecretService) ServiceObj 

func (s *SecretService) ServiceObj() dbus.BusObject

ServiceObj

func (*SecretService) SetItemAttributes added in v0.0.30 

func (s *SecretService) SetItemAttributes(item dbus.ObjectPath, attributes Attributes) error

SetItemAttributes replaces an existing item's lookup attributes in place by setting the read-write org.freedesktop.Secret.Item.Attributes property (type a{ss}) through org.freedesktop.DBus.Properties.Set. The collection must be unlocked.

func (*SecretService) SetItemLabel added in v0.0.30 

func (s *SecretService) SetItemLabel(item dbus.ObjectPath, label string) error

SetItemLabel replaces an existing item's displayable label in place by setting the read-write org.freedesktop.Secret.Item.Label property (type s) through org.freedesktop.DBus.Properties.Set. The collection must be unlocked.

func (*SecretService) SetItemSecret added in v0.0.30 

func (s *SecretService) SetItemSecret(item dbus.ObjectPath, secret Secret) error

SetItemSecret replaces an existing item's secret value in place via org.freedesktop.Secret.Item.SetSecret. The secret must already be encoded for the session it references (see Session.NewSecret). SetSecret takes a single Secret argument (D-Bus signature (oayays)) and returns no values, so there is no prompt path: the item's collection must be unlocked first (use [Unlock]), otherwise the call fails.

func (*SecretService) SetSessionOpenTimeout 

func (s *SecretService) SetSessionOpenTimeout(d time.Duration)

SetSessionOpenTimeout

func (*SecretService) Unlock 

func (s *SecretService) Unlock(items []dbus.ObjectPath) (err error)

Unlock

type Session 

type Session struct {
	Mode    AuthenticationMode
	Path    dbus.ObjectPath
	Public  *big.Int
	Private *big.Int
	AESKey  []byte
}

Session

func (*Session) NewSecret 

func (session *Session) NewSecret(secretBytes []byte) (Secret, error)

NewSecret

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.