Crate encryptman_keyring 

encryptman-keyring

OS keychain-backed master key storage for encryptman.

This crate eliminates the need to manage raw key files by storing the master key in the operating system’s native credential store:

• Windows — Credential Manager
• macOS — Keychain Services
• Linux — Secret Service (DBus)

Quick Start

use encryptman_keyring::Vault;

// First call: generates a new master key and stores it in the OS keychain.
// Subsequent calls: loads the existing key from the keychain.
let vault = Vault::new("my-app").unwrap();

let encrypted = vault.encrypt("my_database_password").unwrap();
let decrypted = vault.decrypt(&encrypted).unwrap();

assert_eq!(decrypted, "my_database_password");

// Delete the key from the keychain when no longer needed
Vault::delete("my-app").unwrap();

Design

Vault::new("my-app")
    │
    ├── keyring::Entry::new("my-app", "master-key")
    │       │
    │       ├── get_secret() → OK → MasterKey::from_bytes()
    │       └── get_secret() → NoEntry → generate + set_secret()
    │
    └── encryptman::encrypt / decrypt using the master key

The service name passed to Vault::new is used as both the keyring service identifier and the HKDF context for encryptman, providing domain isolation between different applications.

Migration from file-based keys

Use Vault::migrate_from_file to import an existing .key file into the OS keychain and delete the file:

use encryptman_keyring::Vault;

let vault = Vault::migrate_from_file("my-app", std::path::Path::new("/path/to/.key")).unwrap();

When NOT to use this crate

• Headless / CI environments — the OS keychain may not be available. Use file-based key storage instead.
• Multi-user servers — keyring entries are per-user; consider a shared secret store like Vault or AWS Secrets Manager.

Structs

Vault

A vault that stores its master key in the OS keychain and delegates encryption/decryption to encryptman.

Enums

Error

Errors that can occur during vault operations.