Documentation
¶
Overview ¶
Package keychain is the optional OS-keychain backend for gitlab.com/phpboyscout/go/credentials. Importing this package (even as a blank import) registers a go-keyring-backed implementation of credentials.Backend at init time, so any credential calls that follow route through the platform keychain: macOS Keychain, Linux Secret Service (GNOME Keyring, KWallet) via godbus, Windows Credential Manager via danieljoos/wincred.
The package carries the go-keyring dependency chain, so tools that must run without session-bus / keychain IPC (regulated builds, air- gapped deployments) simply omit the blank import from their main package. Go's linker dead-code elimination keeps go-keyring, godbus, and wincred out of their binary — verifiable via any SBOM tool that inspects the linked artefact.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Backend ¶
type Backend struct{}
Backend implements credentials.Backend against the OS keychain via github.com/zalando/go-keyring. Its zero value is usable.
func (Backend) Available ¶
Available reports true — importing this subpackage is the caller's declaration that they want keychain-capable behaviour. The live "does it actually work right now" check is credentials.Probe.
func (Backend) Delete ¶
Delete removes a secret. Idempotent: returns nil when the entry does not exist. Only real failures surface as errors.
func (Backend) Retrieve ¶
Retrieve reads a secret. Returns credentials.ErrCredentialNotFound when the backend is functional but no entry exists for the pair — resolvers use this specific sentinel to decide whether to fall through. Other failures wrap the underlying error. Context is accepted for interface uniformity; see Store for the caveat.
func (Backend) Store ¶
Store writes a secret under the given service/account pair. Overwrites any existing entry. Neither argument is logged — callers may pass them to DEBUG log surfaces safely.
The context is honoured, as credentials.Backend requires. The platform APIs beneath (Keychain Services, Secret Service over D-Bus, Windows Credential Manager) expose no cancellation of their own and at least one of them can block indefinitely — a locked Secret Service collection waits on an unlock prompt that a headless host cannot answer — so cancellation returns control to the caller and abandons the call rather than stopping it. See bounded.Run for the goroutine that outlives it.
A caller with no deadline still waits forever, so callers on a startup path should set one.
Source Files