Module secret 

Passwords live in the system keyring, never in a file Sioul writes: the Secret Service on Linux (KWallet, GNOME Keyring), the Keychain on macOS, the Credential Manager on Windows (Cargo.toml chooses the backend per system). Each is filed under the service sioul and <login> on <server>, so it is easy to find, check or remove there.

Constants

ENTRY_BYTES

The most a keyring entry holds on every system: Windows’ Credential Manager keeps 2560 bytes (CRED_MAX_CREDENTIAL_BLOB_SIZE), and a text kept as a password there takes two bytes a character (UTF-16). A secret kept as bytes (save_named_bytes) takes its UTF-8 length; this leaves a margin.

SERVICE 🔒

Functions

entry 🔒

forget

Forgets the account’s password; nothing to do if there was none.

forget_named

Forgets a secret kept under a name of Sioul’s; nothing to do if there was none.

named

A secret kept under a name of Sioul’s (“Bitwarden device token for …”).

named_bytes

A secret kept as bytes under a name of Sioul’s (save_named_bytes): None when there is none, Err when the keyring did not answer.

no_keyring 🔒

passphrase_entry 🔒

password

The password kept for the account. A mail account signed in with Google has none: what stands for it is its grant’s mark (sasl::OAuth::mark), unused by the servers, which are given an access token instead; no grant kept here, Google’s sign-in is asked again.

pgp_passphrase

The passphrase of your OpenPGP key, when the keyring keeps it.

save

Keeps the password for the account, replacing any older one.

save_named

Keeps a secret under a name of Sioul’s.

save_named_bytes

Keeps a secret as bytes (UTF-8 as it is, not Windows’ UTF-16), replacing any older one: at most ENTRY_BYTES, which a longer secret is split into by its owner (microsoft.rs does for its long tokens).

save_pgp_passphrase

Keeps the passphrase of your OpenPGP key in the keyring.

test_passphrase

In a test build with SIOUL_TEST_PASSWORD, the passphrase every key gets (the keyring is left alone); None in Sioul’s builds.

testing 🔒

Whether the keyring is left alone: tests against a local server (SIOUL_TEST_PASSWORD), and the tests of the crates built on this one (the no-keyring feature); never in Sioul’s builds, whose binaries the final pass reads for this mark. On Windows, the one test of this crate that checks the Credential Manager on purpose reaches it whatever the feature says, on its own thread (with_real_keyring).