ci: libdbus-1-dev for keyring build, drop appimage target (#79) #84

Merged

maximus merged 1 commit from issue-79-ci-libdbus into main

2026-04-14 00:35:37 +00:00

maximus commented

2026-04-14 00:27:52 +00:00

Owner

Fixes #79
Refs #66

Summary

libdbus-1-dev added to check.yml rust job + release.yml Linux deps (required by the dbus-secret-service crate pulled in by keyring via sync-secret-service).
Non-blocking cargo audit step added to check.yml to watch the transitive dep graph (zbus, dbus-secret-service, etc.) without failing unrelated PRs.
appimage removed from bundle.targets — release.yml only builds --bundles deb,rpm, so AppImage was dormant; removing it eliminates the risk of a silent plaintext-fallback trap for local tauri build runs without libdbus bundled in the AppImage.

Note vs original spec

The spec mentioned libsecret-1-dev, but the final backend choice is sync-secret-service + crypto-rust, which talks to the Secret Service D-Bus API through dbus-secret-service → dbus crate. That needs libdbus-1-dev (not libsecret-1-dev) at build time. Net: one apt package, runtime libdbus-1-3 is universal.

Test plan

CI rust job installs libdbus-1-dev and compiles keyring + token_store
cargo audit step runs (non-blocking) and reports any advisories
release.yml, once triggered, builds deb + rpm without linking errors

Fixes #79 Refs #66 ## Summary - `libdbus-1-dev` added to `check.yml` rust job + `release.yml` Linux deps (required by the `dbus-secret-service` crate pulled in by `keyring` via `sync-secret-service`). - Non-blocking `cargo audit` step added to check.yml to watch the transitive dep graph (zbus, dbus-secret-service, etc.) without failing unrelated PRs. - `appimage` removed from `bundle.targets` — release.yml only builds `--bundles deb,rpm`, so AppImage was dormant; removing it eliminates the risk of a silent plaintext-fallback trap for local `tauri build` runs without libdbus bundled in the AppImage. ## Note vs original spec The spec mentioned `libsecret-1-dev`, but the final backend choice is `sync-secret-service` + `crypto-rust`, which talks to the Secret Service D-Bus API through `dbus-secret-service` → `dbus` crate. That needs `libdbus-1-dev` (not libsecret-1-dev) at build time. Net: one apt package, runtime `libdbus-1-3` is universal. ## Test plan - [ ] CI rust job installs libdbus-1-dev and compiles keyring + token_store - [ ] cargo audit step runs (non-blocking) and reports any advisories - [ ] release.yml, once triggered, builds deb + rpm without linking errors

maximus added 1 commit 2026-04-14 00:27:53 +00:00

ci: install libdbus-1-dev for keyring build, drop appimage target (#79 )

PR Check / rust (push) Successful in 23m16s

Details

PR Check / frontend (push) Successful in 2m17s

Details

PR Check / rust (pull_request) Successful in 21m37s

Details

PR Check / frontend (pull_request) Successful in 2m10s

Details

481018e1e3

The new token_store module (#78) depends on `sync-secret-service` via
`dbus-secret-service`, which in turn links to libdbus-1 at build time
through the `dbus` crate. Add `libdbus-1-dev` to:

- `check.yml` rust job (alongside the existing webkit/appindicator
  system deps), so every PR run compiles the keyring backend.
- `release.yml` Linux deps step, so tagged builds link correctly.

Runtime requires `libdbus-1-3`, which is present on every desktop
Linux distro by default, so `.deb` / `.rpm` depends stay unchanged.

Also add a non-blocking `cargo audit` step to check.yml to surface
advisories across the transitive dep graph (zbus, dbus-secret-service,
etc.) without failing unrelated PRs.

Drop `appimage` from `bundle.targets` in tauri.conf.json: the release
workflow explicitly builds `--bundles deb,rpm` so AppImage was never
shipped, and its presence in the config risks a silent fallback to
plaintext token storage for anyone running `tauri build` locally
without libsecret/libdbus bundled into the AppImage. No behaviour
change for CI; follow-up to re-enable AppImage properly would need a
linuxdeploy workflow that bundles the backend.

Refs #66

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

maximus commented

2026-04-14 00:29:44 +00:00

Author

Owner

Review — APPROVE ✓

Security

✓ libdbus-1-dev est un package apt standard (freedesktop.org)
✓ cargo audit non-bloquant surface les advisories sans casser des PRs non-liées
✓ Drop d'AppImage ferme le trap identifié par la revue spec (silent fallback plaintext si libsecret/libdbus pas bundlé)

Correctness

✓ Touche seulement le job rust dans check.yml (pas frontend)
✓ release.yml modifié au bon step Install Linux dependencies
✓ cargo audit --file src-tauri/Cargo.lock est le chemin valide (audit lit Cargo.lock, pas Cargo.toml)

Quality

✓ Diff minimal : 14 lignes net
✓ Commentaire YAML explique le rationale continue-on-error

Note vs spec originale

La revue spec parlait de libsecret-1-dev. Le backend final (sync-secret-service) passe par dbus-secret-service → dbus crate → libdbus-1-dev. Même classe de dep, même ajout d'une ligne apt, aucun impact runtime (libdbus-1-3 est universel sur Linux desktop).

Verdict : APPROVE

## Review — APPROVE ✓ ### Security - ✓ `libdbus-1-dev` est un package apt standard (freedesktop.org) - ✓ `cargo audit` non-bloquant surface les advisories sans casser des PRs non-liées - ✓ Drop d'AppImage ferme le trap identifié par la revue spec (silent fallback plaintext si libsecret/libdbus pas bundlé) ### Correctness - ✓ Touche seulement le job `rust` dans check.yml (pas frontend) - ✓ release.yml modifié au bon step `Install Linux dependencies` - ✓ `cargo audit --file src-tauri/Cargo.lock` est le chemin valide (audit lit Cargo.lock, pas Cargo.toml) ### Quality - ✓ Diff minimal : 14 lignes net - ✓ Commentaire YAML explique le rationale `continue-on-error` ### Note vs spec originale La revue spec parlait de `libsecret-1-dev`. Le backend final (`sync-secret-service`) passe par `dbus-secret-service` → `dbus` crate → `libdbus-1-dev`. Même classe de dep, même ajout d'une ligne apt, aucun impact runtime (`libdbus-1-3` est universel sur Linux desktop). **Verdict : APPROVE**