souveraine/packaging/org.freedesktop.secrets.service

[D-BUS Service]
Name=org.freedesktop.secrets
Exec=/usr/local/bin/souveraine-secrets
SystemdService=souveraine-secrets.service
secrets: at-rest encryption, passphrase wrap, phone packaging Seal items AES-256-GCM under a random store key (item id as AAD). Machine wrap: HKDF over a deterministic machined signature (domain secrets-store-key, socket /run/souveraine/machined.sock; legacy seed-id fallback, same framing) — private key never enters the daemon. Argon2id passphrase wrap slot (64MiB/3, HKDF-mixed with the machine signature) managed via org.souveraine.Secrets.Manage: SetPassphrase / VerifyPassphrase / HasPassphrase; rotation re-wraps only. Client-found spec fixes: DH prime was the 2048-bit group-14 constant, not the 1024-bit Second Oakley group libsecret uses (pinned by test); item ids now simple UUIDs (hyphens illegal in object paths); collection also served at /aliases/default; interfaces registered before name claim. Added spec signals, real timestamps, content types, atomic 0600 store writes. packaging: systemd user unit, D-Bus activation shadow, idempotent phone deploy script (masks gnome-keyring, verifies round-trip). 2026-07-20 21:16:32 -04:00			`[D-BUS Service]`
			`Name=org.freedesktop.secrets`
			`Exec=/usr/local/bin/souveraine-secrets`
			`SystemdService=souveraine-secrets.service`