Expand description
Keyring support for ASIMOV.
Public keys are read from $HOME/.asimov/keyring/<user> without accessing
the secret-key backend. The backend is opened only to initialize a missing
identity or perform an explicit secret-key operation.
On Linux, the default backend uses private files when access to the kernel keyrings is unavailable, including under Docker’s default seccomp policy. No environment configuration is needed. Once the file store exists, it is reused even if kernel keyrings later become available, preserving identity. Other platforms default to their native backend.
File secrets are stored in $HOME/.asimov/.keyring/<user>/secret as
unencrypted key bytes, protected by directory mode 0700 and file mode 0600.
Mount the user’s .asimov directory on persistent storage to retain the
identity across container recreation. Like the native keyring’s public-key
cache, this path uses the home directory, not ASIMOV_ROOT.
ASIMOV_KEYRING_BACKEND=native forces the platform backend without fallback;
ASIMOV_KEYRING_BACKEND=file forces file storage on Unix. Native and file
secrets are separate; initializing an empty backend creates a new identity.
Automatic fallback only handles unavailable kernel-keyring access on opening;
subsequent secret-read, corruption, and write errors are returned as errors.
Structs§
- Keyring
std - Stores user secret keys in a selected backend and public keys in local files.
Enums§
- Keyring
Error - An error locating a user, accessing key storage, or decoding a key.
Constants§
- KEYRING_
SERVICE std - Service name used to identify ASIMOV secret-key entries in the keyring store.