rtb-credentials

Part of the phpboyscout Rust toolkit: small, framework-free crates extracted from rust-tool-base.

OS keychain credential storage: the CredentialStore async trait with keyring / env / literal / in-memory implementations, plus a Resolver that walks the canonical env > keychain > literal > fallback_env precedence chain. Every secret crosses the boundary as secrecy::SecretString, so Debug renders SecretBox<str>([REDACTED]) and the memory is zeroed on drop.

use rtb_credentials::{CredentialRef, CredentialStore, KeyringStore, Resolver};
use std::sync::Arc;

let store: Arc<dyn CredentialStore> = Arc::new(KeyringStore::new());
let resolver = Resolver::new(store);

let cref: CredentialRef = /* deserialised from the tool's config */;
let api_key = resolver.resolve(&cref).await?;

On Linux the keychain is the freedesktop Secret Service (GNOME Keyring, KWallet), which persists across reboots and needs a D-Bus session bus at run time. libdbus is compiled in from source, so the build host needs a C compiler for the target but no D-Bus packages. The linux-persistent feature is kept for compatibility and has no effect.

• Docs: https://credentials.rust.phpboyscout.uk
• API reference: https://docs.rs/rtb-credentials
• Crate: https://crates.io/crates/rtb-credentials

Development

just ci runs the full local gate (fmt, clippy, nextest, doc, deny). Tests include a cucumber BDD suite (tests/bdd.rs). Releases are cut by colophon from Conventional Commits, so do not tag manually.

License

MIT