Keyring-core churn

help
1

I'd been using keyring 2.3.1. Keyring came with credential stores for the major platforms, and selected the appropriate one depending on the compilation target. The provided stores were apple-native, windows-native, andlinux-native, which used the platform secure key storage for each platform. Nice and simple.

Keyring, as of 4.x has now been split up and deprecated. Keyring 4.x documentation says don't use keyring, use keyring-core. keyring-core doesn't have credential stores. That's been outsourced. Other people were expected to write credential stores for the "keyring ecosystem". Did that ever happen? Is there a "keyring ecosystem" with those credential stores and ease of use comparable to the old keyring? No such "ecosystem" is documented at keyring-core.

There seems to be a windows_native_keyring_store crate, but no linux_native_keyring_store. There's a list of keyring stores in keyring's Cargo.toml file. Some kind of auto-select logic is needed. Is that in some library, or does each user have to code their own?
Not sure how much glue code I have to build and test cross-platform to get back to where I was at Keyring 2.x.

Should I back out my keyring update and stay with 2.x or 3.x?

Is keyring dead due to this mess? Are people using something else now?

2

The readme links to a list of crates that is mostly developed by the same person maintaining keyring-rs.

the credential stores all in separate crates of their own

All major platforms seem covered.

(I can't comment on the other questions since I never used the crate)

3

From lib.rs it looks like 4.0 still has limited adoption:

image
image500×435 25.1 KB

With these kinds of download numbers, I am surprised no one familiar with the library is chiming in. If it stays crickets, you might consider cross-posting on the Rust reddit sub, which gets a lot of eyeballs.

4

So nobody is using the new split-up version.

This is a critical security function. It's a primary target for a supply chain attack.
You don't want people to have to write their own glue code to connect various back ends and the front end. You want a tightly controlled crate validated by others.