Add Linux keyring storage boundary

2026-10-25 05:43:45 +01:00
parent d7dad3021f
commit 761ff5305d
428 changed files with 1170 additions and 3 deletions
@@ -0,0 +1,12 @@
+# Native credential boundary
+
+This crate is the storage boundary used by the future Linux AppImage shell.
+`Settings` writes only `server_address` and `username` to the client
+`settings.json`. Session credentials are stored under the Linux kernel
+keyring service `trixie.server.session`, scoped by server address and
+username. `load_session` returns `None` when the keyring is unavailable;
+callers must return to credential entry and must not create a plaintext
+fallback.
+
+The crate uses `keyctl` with argument arrays, never a shell command. It does
+not log or serialize session values.