d824ca7f81
Seal items AES-256-GCM under a random store key (item id as AAD). Machine wrap: HKDF over a deterministic machined signature (domain secrets-store-key, socket /run/souveraine/machined.sock; legacy seed-id fallback, same framing) — private key never enters the daemon. Argon2id passphrase wrap slot (64MiB/3, HKDF-mixed with the machine signature) managed via org.souveraine.Secrets.Manage: SetPassphrase / VerifyPassphrase / HasPassphrase; rotation re-wraps only. Client-found spec fixes: DH prime was the 2048-bit group-14 constant, not the 1024-bit Second Oakley group libsecret uses (pinned by test); item ids now simple UUIDs (hyphens illegal in object paths); collection also served at /aliases/default; interfaces registered before name claim. Added spec signals, real timestamps, content types, atomic 0600 store writes. packaging: systemd user unit, D-Bus activation shadow, idempotent phone deploy script (masks gnome-keyring, verifies round-trip).
22 lines
828 B
Desktop File
22 lines
828 B
Desktop File
# Souveraine Secret Service — the machine's org.freedesktop.secrets provider.
|
|
# Claims the well-known name at session start (WantedBy=default.target) so no
|
|
# client ever D-Bus-activates a different provider; the paired activation file
|
|
# (org.freedesktop.secrets.service → SystemdService=) routes on-demand starts
|
|
# here too. Requires souveraine-machined (system tier) or a legacy user seed;
|
|
# refuses to start without a machine identity, by design.
|
|
[Unit]
|
|
Description=Souveraine Secret Service (org.freedesktop.secrets)
|
|
Documentation=file:///usr/local/share/doc/souveraine/STORAGE-ENCRYPTION.md
|
|
After=dbus.socket
|
|
Requires=dbus.socket
|
|
|
|
[Service]
|
|
Type=dbus
|
|
BusName=org.freedesktop.secrets
|
|
ExecStart=/usr/local/bin/souveraine-secrets
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
Environment=RUST_LOG=info
|
|
|
|
[Install]
|
|
WantedBy=default.target
|