wiretap v0.2.12
wiretap v0.2.12
This patch fixes Linux keyring persistence for saved relay-admin profiles and
consolidates all Wiretap secrets under one predictable service.
One Wiretap keyring service
Relay-admin tokens and the desktop's client token now use one service named
wiretap. They remain independent because each secret has a unique account
key; deleting an admin profile cannot delete the client token or another
relay's token.
Wiretap now uses Zalando's native keyring implementation exclusively:
- Secret Service on Linux
- Keychain on macOS
- Credential Manager on Windows
There is no second keyring implementation or backend-selection setting. For
the desktop client token, failure to reach a native keyring still activates
the existing mode-0600 file fallback. Saved relay-admin profiles remain
strict and do not store an admin token in plaintext.
Linux Secret Service fix
The previous 99designs adapter treated Wiretap's service label as a collection
object path. On affected GNOME installations, saving succeeded by creating a
new collection with a generated name, but the next open could not rediscover
that collection. Each retry could therefore create another
wiretap_relay_admin collection while loading the profile returned
secret not found.
The native implementation writes account entries into the user's default
keyring and retrieves them by the stable wiretap service and account pair.
An integration round trip on Secret Service now verifies Set, Get, and Delete
across separate calls.
Wiretap also reads a token back immediately before committing saved-profile
metadata. A backend that accepts but cannot retrieve a secret now produces an
error at save time instead of leaving an unusable profile.
Connection-state fix
Disconnect now clears the active relay-admin operation explicitly. This fixes
the Connect button remaining on Connecting... after connecting without a
custom profile name and then disconnecting.
Upgrade note
Profiles saved by the affected v0.2.11 Linux build may reference secrets in
the broken collections. Connect once with the relay URL and admin token and
leave Remember this relay enabled; saving the same URL replaces its profile
with a working entry under the wiretap service. The obsolete collections are
not deleted automatically because they are credential-store data. After the
new profile reconnects successfully, they can be removed manually with the
desktop's Passwords and Keys application.
Full changelog: v0.2.11...v0.2.12