fix(cli): use keyring-core + native platform stores (drop keyring meta-crate)

cli/Cargo.toml

@@ -24,7 +24,6 @@ serde_json = "1"
 anyhow = "1"
 thiserror = "2"
 url = "2"
-keyring = "4"
 keyring-core = "1"
 zeroize = { version = "1", features = ["derive"] }
 sha2 = "0.11"
@@ -35,6 +34,15 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 hostname = "0.4"
 rpassword = "7"
 
+[target.'cfg(target_os = "linux")'.dependencies]
+zbus-secret-service-keyring-store = { version = "1", features = ["crypto-rust"] }
+
+[target.'cfg(target_os = "macos")'.dependencies]
+apple-native-keyring-store = { version = "1", features = ["keychain"] }
+
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-native-keyring-store = "1"
+
 [dev-dependencies]
 tempfile = "3"
 

cli/src/storage.rs

@@ -11,12 +11,43 @@ const URL_KEY: &str = "api_url";
 fn open_entry(key: &str, slot: &str) -> Result<Entry> {
     static STORE: OnceLock<Result<(), String>> = OnceLock::new();
     STORE
-        .get_or_init(|| keyring::use_native_store(true).map_err(|e| e.to_string()))
+        .get_or_init(set_native_default_store)
         .as_ref()
         .map_err(|e| anyhow!("initialising OS keyring — is one installed? ({e})"))?;
     Entry::new(SERVICE, key).with_context(|| format!("opening OS keyring ({slot} slot)"))
 }
 
+fn set_native_default_store() -> Result<(), String> {
+    use std::collections::HashMap;
+    let config: HashMap<&str, &str> = HashMap::new();
+    #[cfg(target_os = "linux")]
+    {
+        let store = zbus_secret_service_keyring_store::Store::new_with_configuration(&config)
+            .map_err(|e| e.to_string())?;
+        keyring_core::set_default_store(store);
+        Ok(())
+    }
+    #[cfg(target_os = "macos")]
+    {
+        let store = apple_native_keyring_store::keychain::Store::new_with_configuration(&config)
+            .map_err(|e| e.to_string())?;
+        keyring_core::set_default_store(store);
+        Ok(())
+    }
+    #[cfg(target_os = "windows")]
+    {
+        let store = windows_native_keyring_store::Store::new_with_configuration(&config)
+            .map_err(|e| e.to_string())?;
+        keyring_core::set_default_store(store);
+        Ok(())
+    }
+    #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
+    {
+        let _ = config;
+        Err("no OS keyring backend is available on this platform".to_string())
+    }
+}
+
 pub struct CredentialStore;
 
 impl CredentialStore {