todo

diff --git a/doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn b/doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn
new file mode 100644 (file)
index 0000000..3a69bfc
--- /dev/null
+++ b/doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn
@@ -0,0 +1,15 @@
+systemd v256 will have support for credentials that are encrypted at rest,
+locked against the system's TPM, and can be used by a per-user service
+(prior versions only supported it for system services).
+
+<https://mastodon.social/@pid_eins/112336318532407967>
+
+This is a much more secure way to store credentials than git-annex's
+current `.git/annex/creds/` which is only protected by unix permissions,
+and so it would make sense for git-annex to use it.
+It would need a way for git-annex to start a systemd user service when
+it needs access to a credential.
+
+Note that GNOME/XDG desktop secret managers have work underway to support
+this systemd feature, so git-annex might be able to alternatively use them
+to access creds rather than using a systemd unit directly. --[[Joey]]