README
¶
keyring
Secure credential storage for Go, backed by the OS keyring (Windows Credential Manager, macOS Keychain, Linux Secret Service).
Two APIs on the same backend:
Keyring— generic, service-scoped key/value store. Ideal as theSecretStoreofgithub.com/tinywasm/gitand for CLI auth flows.KeyManager— the classic manager for theupdater-cicdservice secrets (HMAC secret + GitHub PAT) with Setup/Rotate/Reset semantics.
import "github.com/tinywasm/keyring"
// Service-scoped store: same key names never collide across services.
kr, err := keyring.NewKeyring("my-app")
if err != nil { /* OS keyring missing; it auto-installs on Linux */ }
kr.SetLog(log.Printf)
kr.Set("github_token", pat)
tok, err := kr.Get("github_token")
kr.Delete("github_token")
// Classic manager (updater-cicd service).
km := keyring.New()
km.Setup(hmacSecret, pat)
No keyring on the machine?
NewKeyring verifies the backend on startup and, on Linux, tries to install
gnome-keyring + libsecret with the distro package manager, then starts
gnome-keyring-daemon. Tests never touch the OS keyring: they swap the backend
with keyring.SetProvider and restore it with keyring.GetProvider.
Documentation
Documentation
¶
Index ¶
- Constants
- func SetProvider(p Provider)
- type KeyManager
- func (m *KeyManager) DeleteAll() error
- func (m *KeyManager) GetGitHubPAT() (string, error)
- func (m *KeyManager) GetHMACSecret() (string, error)
- func (m *KeyManager) IsConfigured() bool
- func (m *KeyManager) RotateGitHubPAT(newPAT string) error
- func (m *KeyManager) RotateHMACSecret(newSecret string) error
- func (m *KeyManager) SetLog(fn func(...any))
- func (m *KeyManager) Setup(hmacSecret, githubPAT string) error
- type Keyring
- type Provider
Constants ¶
const ( ServiceName = "updater-cicd" HMACSecretKey = "hmac-secret" GitHubPATKey = "github-pat" )
Variables ¶
This section is empty.
Functions ¶
func SetProvider ¶ added in v0.0.2
func SetProvider(p Provider)
SetProvider replaces the OS keyring backend. Tests use it to inject an in-memory provider; production code never calls it.
Types ¶
type KeyManager ¶ added in v0.0.2
type KeyManager struct {
// contains filtered or unexported fields
}
KeyManager manages the service-exposed secrets (HMAC secret, GitHub PAT) of ServiceName on top of a generic Keyring. Same API as before; now backed by the shared Keyring type.
func (*KeyManager) DeleteAll ¶ added in v0.0.2
func (m *KeyManager) DeleteAll() error
DeleteAll elimina todos los secretos (reset)
func (*KeyManager) GetGitHubPAT ¶ added in v0.0.2
func (m *KeyManager) GetGitHubPAT() (string, error)
GetGitHubPAT obtiene el GitHub PAT
func (*KeyManager) GetHMACSecret ¶ added in v0.0.2
func (m *KeyManager) GetHMACSecret() (string, error)
GetHMACSecret obtiene el HMAC secret
func (*KeyManager) IsConfigured ¶ added in v0.0.2
func (m *KeyManager) IsConfigured() bool
IsConfigured verifica si están configurados
func (*KeyManager) RotateGitHubPAT ¶ added in v0.0.2
func (m *KeyManager) RotateGitHubPAT(newPAT string) error
RotateGitHubPAT rota el GitHub PAT
func (*KeyManager) RotateHMACSecret ¶ added in v0.0.2
func (m *KeyManager) RotateHMACSecret(newSecret string) error
RotateHMACSecret rota el HMAC secret
func (*KeyManager) SetLog ¶ added in v0.0.2
func (m *KeyManager) SetLog(fn func(...any))
SetLog sets the logging function.
func (*KeyManager) Setup ¶ added in v0.0.2
func (m *KeyManager) Setup(hmacSecret, githubPAT string) error
Setup realiza el setup inicial - solo primera ejecución
type Keyring ¶
type Keyring struct {
// contains filtered or unexported fields
}
Keyring provides scoped credential storage through the system keyring. The service name is a namespace: the same key under different services never collides, so one process can hold secrets for several apps.
func NewKeyring ¶ added in v0.0.2
NewKeyring creates a Keyring scoped to service and verifies the system keyring actually works, installing its dependencies on Linux when missing.
func OpenKeyring ¶ added in v0.0.3
OpenKeyring creates a Keyring scoped to service without probing the system keyring: nothing touches the OS until the first Get/Set/Delete. Use it when the store is only needed conditionally (e.g. session recovery) or in flows that may legitimately run without a keyring (CI with GH_TOKEN).
func (*Keyring) Get ¶ added in v0.0.2
Get returns the value stored under key in this service's namespace.
type Provider ¶ added in v0.0.2
type Provider interface {
// Set stores password for user under service.
Set(service, user, password string) error
// Get returns the password stored for user under service.
Get(service, user string) (string, error)
// Delete removes the password stored for user under service.
Delete(service, user string) error
// DeleteAll removes every entry under service.
DeleteAll(service string) error
}
Provider abstracts the OS keyring backend (Secret Service, Keychain, Credential Manager). The default provider talks to the system; tests swap it with SetProvider to avoid touching real credentials.
func GetProvider ¶ added in v0.0.2
func GetProvider() Provider
GetProvider returns the active keyring backend. Used to restore the real provider after swapping it in tests.
Source Files