rtb-credentials

Part of the phpboyscout Rust toolkit — small, framework-free crates extracted from rust-tool-base.

OS keychain credential storage: the CredentialStore async trait with keyring / env / literal / in-memory implementations, plus a Resolver that walks the canonical env > keychain > literal > fallback_env precedence chain. Every secret crosses the boundary as secrecy::SecretString — Debug renders [REDACTED], memory is zeroed on drop.

use rtb_credentials::{CredentialRef, CredentialStore, KeyringStore, Resolver};
use std::sync::Arc;

let store: Arc<dyn CredentialStore> = Arc::new(KeyringStore::new());
let resolver = Resolver::new(store);

let cref: CredentialRef = /* deserialised from the tool's config */;
let api_key = resolver.resolve(&cref).await?;

On Linux the default backend is pure-Rust kernel keyutils (session-scoped, no system deps); enable the linux-persistent feature for reboot-persistent storage via the freedesktop Secret Service (requires pkg-config + libdbus-1-dev at build time).

• Docs: https://credentials.rust.phpboyscout.uk
• API reference: https://docs.rs/rtb-credentials
• Crate: https://crates.io/crates/rtb-credentials

Development

just ci runs the full local gate (fmt, clippy, nextest, doc, deny). Tests include a cucumber BDD suite (tests/bdd.rs). Releases are cut by release-plz from Conventional Commits — do not tag manually.

License

MIT