From 84611e7ee618efed71db1a17afaa88f70384a503 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Fri, 26 Apr 2024 04:03:10 -0400 Subject: [PATCH] todo --- ...edential_system_for_git-annex_credentials.mdwn | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn diff --git a/doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn b/doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn new file mode 100644 index 0000000000..3a69bfcff9 --- /dev/null +++ b/doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn @@ -0,0 +1,15 @@ +systemd v256 will have support for credentials that are encrypted at rest, +locked against the system's TPM, and can be used by a per-user service +(prior versions only supported it for system services). + + + +This is a much more secure way to store credentials than git-annex's +current `.git/annex/creds/` which is only protected by unix permissions, +and so it would make sense for git-annex to use it. +It would need a way for git-annex to start a systemd user service when +it needs access to a credential. + +Note that GNOME/XDG desktop secret managers have work underway to support +this systemd feature, so git-annex might be able to alternatively use them +to access creds rather than using a systemd unit directly. --[[Joey]]