0 Fork 0

Files

T

swaitsandClaude Fable 5.1 ee4f8cd58a feat(host): Keychain and Credential Manager token stores, a macOS/Windows CI job (P11a step 0)

The agent path was Linux-only because tokens had a keyring store only
there (every other OS hit NOT_YET, so `connect` and the bridge failed).
D-56's destination is one installation for macOS, Windows and Linux.
Both new stores sit behind the same Items trait as the Secret Service,
so INVARIANT 4 (one account, one item, locked is an error) is kept once
and tested once through the file keyring. Windows credentials have a
unique target name, so a probe stands in for a search.

New dependencies (ledger-host only, target-gated): apple-native-keyring-store
(feature keychain) and windows-native-keyring-store, the stores the
keyring-core 1 API we already use is published with. No ledger-core change.

The `portable` job builds and tests the workspace on macos-latest and
windows-latest. Windows is allowed to fail: the rest of the host is
Unix-only (inventory in docs/packaging.md). Not verified locally: no
macOS or Windows target is installed; CI is the evidence.

Also pins cargo-packager, cargo-packager-updater and cargo-generate-rpm
in mise.toml for the trial, and records that the trial is not yet run.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

2026-10-29 12:41:01 -06:00

2.4 KiB

Raw Blame History

Packaging and updates: the trial (P11a step 1)

Status 2026-10-29: the trial has not been run. It needs clean Linux, macOS and Windows machines for the six formats (.deb, .rpm, AUR, AppImage, .dmg, NSIS .exe), and the one machine that built step 0 is a Linux desktop with neither a macOS nor a Windows target, no container runtime and none of the packager tools installed. The tools are pinned in mise.toml now (cargo-packager 0.11.8, cargo-packager-updater 0.2.3, cargo-generate-rpm 0.21.1), so the trial is mise install and the VMs. Nothing below is a result; it is what is known before the trial, and the table is filled by the person who runs it.

format	built by	installs as	updated by	signed by
`.deb`	`cargo packager`	(trial)	apt repository (step 3)	(trial)
`.rpm`	`cargo-generate-rpm`	(trial)	dnf repository (step 3)	(trial)
AUR `PKGBUILD`	hand-written	(trial)	the package manager	n/a
AppImage	`cargo packager`	(trial)	`cargo-packager-updater`	(trial)
`.dmg`	`cargo packager`	(trial)	`cargo-packager-updater`	Developer ID (step 5)
NSIS `.exe`	`cargo packager`	(trial)	`cargo-packager-updater`	Windows identity (step 5)

What step 0 found about the platforms (read before the macOS and Windows rows)

The agent path was Linux-only because of the keyring. Step 0 adds the macOS login Keychain and the Windows Credential Manager behind ledger-host/src/tokens.rs::Keeper; CI (portable job) is the evidence. Beyond the keyring, the Windows host is a port, not a cfg gap. Today Unix-only, found by grep (2026-10-29):

ledger-host: bridge, host, start, opener and others are #[cfg(unix)] modules; host.rs/start.rs use setsid, umask, close_range, geteuid, Unix sockets and libc unguarded; commands.rs calls isatty/tcgetpgrp.
ledger-mcp: the owner-only socket check reads peer credentials (SO_PEERCRED, getpeereid); admin/local listen on Unix sockets. Windows needs named pipes with a peer SID check (plan 3.9).
ledger-store: ops.rs takes flock locks; root.rs has no owner-only DACL (set_mode is a no-op off Unix) and the data root falls back to %USERPROFILE%, not the known-folder %LOCALAPPDATA%; refuse.rs (seccomp) and renameat2 are Linux-only (macOS needs its own equivalents or cfg fences).
The portable job runs Windows as allowed-to-fail until that port lands.

2.4 KiB Raw Blame History

Packaging and updates: the trial (P11a step 1)

What step 0 found about the platforms (read before the macOS and Windows rows)

2.4 KiB

Raw Blame History