Support secure password storage via OS keychain

[mquandalle]

Currently the password can be stored in plaintext in ~/.bourso/settings.json. It would be nice to support secure storage using the OS native credential manager.

The https://crates.io/crates/keyring crate provides cross-platform support for:

• macOS Keychain
• Linux Secret Service (GNOME Keyring, KWallet)
• Windows Credential Manager

  use keyring::Entry;

  let entry = Entry::new("bourso-cli", &username)?;
  entry.set_password(&password)?;
  // ...
  let password = entry.get_password()?;

[azerpas]

Thanks for the idea @mquandalle. We've discussed it with @Mathious6 a few months ago and we were also leaning towards keyring or something similar.

Though there's one use-case with which I'm not sure it would be compatible:

• some people are using CRON to run the job periodically in the background, without user interaction. Retrieving the password with keyring would require a user interaction right? At least that's how I imagine it with keychain

[mquandalle]

Hum no I don't think so. I've only used Bun.secrets on MacOS, and it doesn't require a user interaction, might be different on other platforms.

[mquandalle]

From Bun documentation

Platform Behavior
macOS (Keychain)

• Credentials are stored in the name’s login keychain
• The keychain may prompt for access permission on first use
• Credentials persist across system restarts
• Accessible by the name who stored them

Linux (libsecret)

• Requires a secret service daemon (GNOME Keyring, KWallet, etc.)
• Credentials are stored in the default collection
• May prompt for unlock if the keyring is locked
• The secret service must be running

Windows (Credential Manager)

• Credentials are stored in Windows Credential Manager
• Visible in Control Panel → Credential Manager → Windows Credentials
• Persist with CRED_PERSIST_ENTERPRISE flag so it’s scoped per user
• Encrypted using Windows Data Protection API

So yes, this might cause issues with a cron job. Anyway if you run a cron job I think you can't avoid storing the password in cleartext somewhere (an ENV variable or as a cli argument or in a config file).

[azerpas]

From Bun documentation

Platform Behavior macOS (Keychain)

• Credentials are stored in the name’s login keychain
• The keychain may prompt for access permission on first use
• Credentials persist across system restarts
• Accessible by the name who stored them

Linux (libsecret)

• Requires a secret service daemon (GNOME Keyring, KWallet, etc.)
• Credentials are stored in the default collection
• May prompt for unlock if the keyring is locked
• The secret service must be running

Windows (Credential Manager)

• Credentials are stored in Windows Credential Manager
• Visible in Control Panel → Credential Manager → Windows Credentials
• Persist with CRED_PERSIST_ENTERPRISE flag so it’s scoped per user
• Encrypted using Windows Data Protection API

So yes, this might cause issues with a cron job. Anyway if you run a cron job I think you can't avoid storing the password in cleartext somewhere (an ENV variable or as a cli argument or in a config file).

Thanks for the details! I'll try a simple PoC whenever I have some time :)