Skip to content

Enable cargo:libsecret on all Unix platforms except macOS and mobile #17197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
quinnjr wants to merge 3 commits into
base: master
Choose a base branch
from
+64 −5
Open

Enable cargo:libsecret on all Unix platforms except macOS and mobile #17197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9235380
feat(credential): enable cargo:libsecret on all Unix platforms except…
quinnjr Jul 10, 2026
7407788
Update credential/cargo-credential-libsecret/README.md
quinnjr Jul 11, 2026
bd36129
docs: align registry-authentication.md platform wording with crate RE…
quinnjr Jul 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions credential/cargo-credential-libsecret/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,10 @@ See the [credential-provider] documentation for how to use this.

This credential provider is built-in to cargo as `cargo:libsecret`.

It is available on Unix-like platforms such as Linux and the BSDs.
Apple and mobile platforms either use their OS-specific keyring,
or libsecret doesn't exist there.

> This crate is maintained by the Cargo team, primarily for use by Cargo
> and not intended for external use (except as a transitive dependency). This
> crate may make major changes to its APIs or be deprecated without warning.
Expand Down
36 changes: 33 additions & 3 deletions credential/cargo-credential-libsecret/src/lib.rs
View file
Open in desktop

@weihanglo weihanglo Jul 11, 2026 •
edited by rustbot
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know how to test this on BSD, and I have no machine running on BDS. Do you have any guide and step to follow so I can at least make sure it work?

BTW, this seems reasonable separately from the RFC.

View changes since the review

@quinnjr quinnjr Jul 11, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://gist.github.com/quinnjr/f9d0bea41b21c61dbed373911b93ba71

@weihanglo weihanglo Jul 20, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. I ends up adapting your scripts with qemu (which I used to be familiar with). And it worked!

Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,17 @@
//! > and not intended for external use (except as a transitive dependency). This
//! > crate may make major changes to its APIs or be deprecated without warning.

#[cfg(target_os = "linux")]
#[cfg(all(
unix,
not(any(
target_os = "macos",
target_os = "ios",
target_os = "tvos",
target_os = "watchos",
target_os = "visionos",
target_os = "android"
))
))]
mod linux {
//! Implementation of the libsecret credential helper.

Expand Down Expand Up @@ -259,7 +269,27 @@ mod linux {
}
}

#[cfg(not(target_os = "linux"))]
#[cfg(not(all(
unix,
not(any(
target_os = "macos",
target_os = "ios",
target_os = "tvos",
target_os = "watchos",
target_os = "visionos",
target_os = "android"
))
)))]
pub use cargo_credential::UnsupportedCredential as LibSecretCredential;
#[cfg(target_os = "linux")]
#[cfg(all(
unix,
not(any(
target_os = "macos",
target_os = "ios",
target_os = "tvos",
target_os = "watchos",
target_os = "visionos",
target_os = "android"
))
))]
pub use linux::LibSecretCredential;
5 changes: 5 additions & 0 deletions doc/book/src/reference/registry-authentication.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,11 @@ The Keychain Access app can be used to view stored tokens.
### `cargo:libsecret`
Uses [libsecret](https://wiki.gnome.org/Projects/Libsecret) to store tokens.

It is available on Unix-like platforms such as Linux and the BSDs.
Apple and mobile platforms either use their OS-specific keyring,
or libsecret doesn't exist there. The `libsecret` library is loaded at
runtime, so it only needs to be installed when this provider is used.

Any password manager with libsecret support can be used to view stored tokens.
The following are a few examples (non-exhaustive):

Expand Down
24 changes: 22 additions & 2 deletions src/util/auth/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -480,7 +480,17 @@ static BUILT_IN_PROVIDERS: &[&'static str] = &[

/// Retrieves a cached instance of `LibSecretCredential`.
/// Must be cached to avoid repeated load/unload cycles, which are not supported by `glib`.
#[cfg(target_os = "linux")]
#[cfg(all(
unix,
not(any(
target_os = "macos",
target_os = "ios",
target_os = "tvos",
target_os = "watchos",
target_os = "visionos",
target_os = "android"
))
))]
fn get_credential_libsecret()
-> CargoResult<&'static cargo_credential_libsecret::LibSecretCredential> {
static CARGO_CREDENTIAL_LIBSECRET: std::sync::OnceLock<
Expand Down Expand Up @@ -535,7 +545,17 @@ fn credential_action(
"cargo:wincred" => Box::new(cargo_credential_wincred::WindowsCredential {}),
#[cfg(target_os = "macos")]
"cargo:macos-keychain" => Box::new(cargo_credential_macos_keychain::MacKeychain {}),
#[cfg(target_os = "linux")]
#[cfg(all(
unix,
not(any(
target_os = "macos",
target_os = "ios",
target_os = "tvos",
target_os = "watchos",
target_os = "visionos",
target_os = "android"
))
))]
"cargo:libsecret" => Box::new(get_credential_libsecret()?),
name if BUILT_IN_PROVIDERS.contains(&name) => {
Box::new(cargo_credential::UnsupportedCredential {})
Expand Down