Skip to content

wiretap v0.2.12

Choose a tag to compare

@plutack plutack released this 11 Sep 16:23
· 6 commits to main since this release
a44b76f

wiretap v0.2.12

This patch fixes Linux keyring persistence for saved relay-admin profiles and
consolidates all Wiretap secrets under one predictable service.

One Wiretap keyring service

Relay-admin tokens and the desktop's client token now use one service named
wiretap. They remain independent because each secret has a unique account
key; deleting an admin profile cannot delete the client token or another
relay's token.

Wiretap now uses Zalando's native keyring implementation exclusively:

  • Secret Service on Linux
  • Keychain on macOS
  • Credential Manager on Windows

There is no second keyring implementation or backend-selection setting. For
the desktop client token, failure to reach a native keyring still activates
the existing mode-0600 file fallback. Saved relay-admin profiles remain
strict and do not store an admin token in plaintext.

Linux Secret Service fix

The previous 99designs adapter treated Wiretap's service label as a collection
object path. On affected GNOME installations, saving succeeded by creating a
new collection with a generated name, but the next open could not rediscover
that collection. Each retry could therefore create another
wiretap_relay_admin collection while loading the profile returned
secret not found.

The native implementation writes account entries into the user's default
keyring and retrieves them by the stable wiretap service and account pair.
An integration round trip on Secret Service now verifies Set, Get, and Delete
across separate calls.

Wiretap also reads a token back immediately before committing saved-profile
metadata. A backend that accepts but cannot retrieve a secret now produces an
error at save time instead of leaving an unusable profile.

Connection-state fix

Disconnect now clears the active relay-admin operation explicitly. This fixes
the Connect button remaining on Connecting... after connecting without a
custom profile name and then disconnecting.

Upgrade note

Profiles saved by the affected v0.2.11 Linux build may reference secrets in
the broken collections. Connect once with the relay URL and admin token and
leave Remember this relay enabled; saving the same URL replaces its profile
with a working entry under the wiretap service. The obsolete collections are
not deleted automatically because they are credential-store data. After the
new profile reconnects successfully, they can be removed manually with the
desktop's Passwords and Keys application.

Full changelog: v0.2.11...v0.2.12