HOWTO: Use the keyring to store the passphrase - on Linux

[goebbe]

This HOWTO should help you to use your keyring (on Linux) to provide your repo passphrase, when required.
The following has been tested on Linux Mint 22.3.

Background: The keyring is a feature of the Desktop environment (Gnome/ KDE) to store secrets or passphrases securely and deliver them when required.
Think about the keyring as a kind of integrated password manager.
Some distributions configure the keyring such that the keyring is unlocked automatically, the moment a user is logging in.

1. Install "libsecret-tools":

sudo apt install libsecret-tools

Depending on your Linux distribution, you might require a different command to install secret-tools.

2. Store a new passphrase in the keyring, using secret-tool:

secret-tool store --label='Vykar backup repo' application vykar repo_name 'your_repo_name'

This command will interactively ask you to type a Password (i.e. your vykar passphrase).

Explanation:
-- label='Vykar backup repo' defines the name of the entry in your keyring (for your information, only)
In our example we freely define two key-value pairs:
application vykar
repo_name 'your_repo_name'
In the first line, application is the key and vykar is its value.
In the second line, repo_name is the key and your_repo_name is its value.
Important: You have to be able to uniquely identify your keyring-entry by the used key-pairs.

3. Test the lookup for the passphrase:

secret-tool lookup application vykar repo_name 'your_repo_name'

This command should print your passphrase.

Important: keyring entries are identified by their key-value pairs.
By default, the first entry with identical key-value pairs will be matched.
Therefore, it is important to use unique key-value pairs.

4. Finally, we can add a passcomand: to the config.yml of Vykar:

encryption:
  passcommand: "secret-tool lookup application vykar repo_name 'your_repo_name'"

Whenever Vykar needs the passphrase for the repository, it will use the secret-tool lookup to get your passphrase from your keyring.

Hope this is useful.

[m3nu]

Awesome! This could be a recipe.