Skip to content

Preserve native credentials and atomic settings across upgrades - #1

Merged
wess merged 4 commits into
mainfrom
nativecredentials
Oct 22, 2026
Merged

wess merged 4 commits into
mainfrom
nativecredentials

Conversation

@wess

@wess wess commented Oct 22, 2026 •

Copy link
Copy Markdown
Owner

The keyring upgrade changed Linux's backend and credential naming, which would hide existing application tokens. Use current platform providers directly and preserve Linux's existing keyring-rs:<key>@<service> identity. macOS keeps login Keychain identities and Windows keeps Credential Manager identities without changing the process-wide default store.

The new Windows gate also exposed concurrent JSON replacement failures. Sync and close temporary files, then use the standard library's Windows-compatible rename path. Regression cases cover concurrent writers, retained readers, and cleanup after failed replacement.

Desktop crates advance to 0.1.4; coordinated repository libraries advance to 0.4.7. The fleet migration planner derives its Inkling tag from the validated candidate instead of a hardcoded future version.

Validation:

  • macOS workspace tests, strict clippy, and all three template builds pass in CI.
  • Linux legacy credential read/update/delete interoperability passes in CI.
  • Windows store tests, including concurrent writers and retained readers, pass.
  • Old/new macOS implementations read, updated, and deleted one disposable test credential; it was removed.
  • Web CI passes the suite, packed installs, all template fixtures, and private S3 service gate.
  • Dependency audit reports zero vulnerabilities. Thirteen unmaintained dependency warnings remain unresolved.

Wess Cope added 4 commits October 22, 2026 12:55
Use current platform providers directly so Linux retains kernel keyutils and its existing keyring-rs entry identity. Keep macOS login Keychain and Windows Credential Manager without changing process-wide store defaults or migrating credentials.

Add Linux compatibility and Windows store checks alongside the desktop workspace gate. Advance the desktop workspace to 0.1.2 and coordinate the repository libraries at 0.4.5.
Concurrent Windows writers could replace a file while its previous temporary handle was still open. Close the synced handle before persisting its path and keep the concurrency gate on Windows.
Use the candidate manifest instead of a hardcoded future tag so migration receipts point to the release that was actually checked. Record the HTTP comparison and coordinate the next Atlas library release.
The Windows tempfile persistence implementation does not use modern rename sharing semantics. Use the standard library rename after syncing and closing the temporary file, and verify concurrent writes, retained readers, and cleanup on failure.
@wess wess changed the title Preserve native credential stores across dependency upgrades Preserve native credentials and atomic settings across upgrades Oct 22, 2026
@wess
wess merged commit 1978e5e into main Oct 22, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant