From: Joey Hess Date: Fri, 26 Apr 2024 08:03:10 +0000 (-0400) Subject: todo X-Git-Tag: archive/raspbian/10.20250416-2+rpi1~1^2~25^2~7 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=84611e7ee618efed71db1a17afaa88f70384a503;p=git-annex.git todo --- diff --git a/doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn b/doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn new file mode 100644 index 0000000000..3a69bfcff9 --- /dev/null +++ b/doc/todo/use_systemd_credential_system_for_git-annex_credentials.mdwn @@ -0,0 +1,15 @@ +systemd v256 will have support for credentials that are encrypted at rest, +locked against the system's TPM, and can be used by a per-user service +(prior versions only supported it for system services). + + + +This is a much more secure way to store credentials than git-annex's +current `.git/annex/creds/` which is only protected by unix permissions, +and so it would make sense for git-annex to use it. +It would need a way for git-annex to start a systemd user service when +it needs access to a credential. + +Note that GNOME/XDG desktop secret managers have work underway to support +this systemd feature, so git-annex might be able to alternatively use them +to access creds rather than using a systemd unit directly. --[[Joey]]