souveraine/packaging/org.freedesktop.secrets.service at 783f09606a5b0cb8b49b1254b0fc51f41dccf937 - Fimeg/souveraine - Casey Tunturi · Public Forge

Fimeg/souveraine

Watch

Fimeg d824ca7f81 secrets: at-rest encryption, passphrase wrap, phone packaging

Seal items AES-256-GCM under a random store key (item id as AAD).
Machine wrap: HKDF over a deterministic machined signature (domain
secrets-store-key, socket /run/souveraine/machined.sock; legacy
seed-id fallback, same framing) — private key never enters the daemon.
Argon2id passphrase wrap slot (64MiB/3, HKDF-mixed with the machine
signature) managed via org.souveraine.Secrets.Manage: SetPassphrase /
VerifyPassphrase / HasPassphrase; rotation re-wraps only.

Client-found spec fixes: DH prime was the 2048-bit group-14 constant,
not the 1024-bit Second Oakley group libsecret uses (pinned by test);
item ids now simple UUIDs (hyphens illegal in object paths); collection
also served at /aliases/default; interfaces registered before name
claim. Added spec signals, real timestamps, content types, atomic 0600
store writes.

packaging: systemd user unit, D-Bus activation shadow, idempotent
phone deploy script (masks gnome-keyring, verifies round-trip).

2026-07-20 21:16:32 -04:00

4 lines

126 B

Desktop File

Raw Blame History

 [D-BUS Service]
 Name=org.freedesktop.secrets
 Exec=/usr/local/bin/souveraine-secrets
 SystemdService=souveraine-secrets.service