path: root/keyfile.patch

diff --git a/internal/app/migration.go b/internal/app/migration.go
index d4b99581..c8eea212 100644
--- a/internal/app/migration.go
+++ b/internal/app/migration.go
@@ -62,7 +62,7 @@ func migrateKeychainHelper(locations *locations.Locations) error {
 
 	b, err := os.ReadFile(filepath.Join(configDir, "protonmail", "bridge", "prefs.json"))
 	if errors.Is(err, fs.ErrNotExist) {
-		return nil
+		return vault.SetHelper(settings, "file-keychain")
 	} else if err != nil {
 		return fmt.Errorf("failed to read old prefs file: %w", err)
 	}
diff --git a/internal/app/vault.go b/internal/app/vault.go
index 8ec90f74..481b3103 100644
--- a/internal/app/vault.go
+++ b/internal/app/vault.go
@@ -107,7 +107,7 @@ func loadVaultKey(vaultDir string, keychains *keychain.List) ([]byte, error) {
 	key, err := vault.GetVaultKey(kc)
 	if err != nil {
 		if keychain.IsErrKeychainNoItem(err) {
-			logrus.WithError(err).Warn("no vault key found, generating new")
+			logrus.Warn("no vault key found, generating new")
 			return vault.NewVaultKey(kc)
 		}
 
diff --git a/pkg/keychain/helper_linux.go b/pkg/keychain/helper_linux.go
index 7a395bc6..cb6878b5 100644
--- a/pkg/keychain/helper_linux.go
+++ b/pkg/keychain/helper_linux.go
@@ -18,63 +18,42 @@
 package keychain
 
 import (
+	"os/user"
+	"path/filepath"
+
 	"github.com/docker/docker-credential-helpers/credentials"
-	"github.com/docker/docker-credential-helpers/pass"
-	"github.com/docker/docker-credential-helpers/secretservice"
 	"github.com/sirupsen/logrus"
-	"golang.org/x/sys/execabs"
 )
 
 const (
-	Pass              = "pass-app"
-	SecretService     = "secret-service"
-	SecretServiceDBus = "secret-service-dbus"
+	secrets = "~/.config/protonmail/bridge-v3/secrets"
 )
 
 func listHelpers(_ bool) (Helpers, string) {
 	helpers := make(Helpers)
+	var defaultHelper string
 
-	if isUsable(newDBusHelper("")) {
-		helpers[SecretServiceDBus] = newDBusHelper
-		logrus.WithField("keychain", "SecretServiceDBus").Info("Keychain is usable.")
-	} else {
-		logrus.WithField("keychain", "SecretServiceDBus").Debug("Keychain is not available.")
-	}
-
-	if _, err := execabs.LookPath("gnome-keyring"); err == nil && isUsable(newSecretServiceHelper("")) {
-		helpers[SecretService] = newSecretServiceHelper
-		logrus.WithField("keychain", "SecretService").Info("Keychain is usable.")
-	} else {
-		logrus.WithField("keychain", "SecretService").Debug("Keychain is not available.")
-	}
-
-	if _, err := execabs.LookPath("pass"); err == nil && isUsable(newPassHelper("")) {
-		helpers[Pass] = newPassHelper
-		logrus.WithField("keychain", "Pass").Info("Keychain is usable.")
+	// Use keyFile as the only secrets handler
+	if isUsable(newKeyFileHelper("")) {
+		helpers["key-file"] = newKeyFileHelper
+		defaultHelper = "key-file"
+		logrus.WithField("keychain", "KeyFile").Info("Keychain is usable.")
 	} else {
-		logrus.WithField("keychain", "Pass").Debug("Keychain is not available.")
+		logrus.WithField("keychain", "KeyFile").Debug("Keychain is not available.")
 	}
 
-	defaultHelper := SecretServiceDBus
-
-	// If Pass is available, use it by default.
-	// Otherwise, if SecretService is available, use it by default.
-	if _, ok := helpers[Pass]; ok {
-		defaultHelper = Pass
-	} else if _, ok := helpers[SecretService]; ok {
-		defaultHelper = SecretService
-	}
 	return helpers, defaultHelper
 }
 
-func newDBusHelper(string) (credentials.Helper, error) {
-	return &SecretServiceDBusHelper{}, nil
-}
-
-func newPassHelper(string) (credentials.Helper, error) {
-	return &pass.Pass{}, nil
+func expandTilde(path string) string {
+	if path[:2] == "~/" {
+		user, _ := user.Current()
+		return filepath.Join(user.HomeDir, path[2:])
+	} else {
+		return path
+	}
 }
 
-func newSecretServiceHelper(string) (credentials.Helper, error) {
-	return &secretservice.Secretservice{}, nil
+func newKeyFileHelper(string) (credentials.Helper, error) {
+	return &keyFile{expandTilde(secrets)}, nil
 }
diff --git a/pkg/keychain/keyfile.go b/pkg/keychain/keyfile.go
new file mode 100644
index 00000000..68cbe534
--- /dev/null
+++ b/pkg/keychain/keyfile.go
@@ -0,0 +1,131 @@
+package keychain
+
+import (
+	"bufio"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/docker/docker-credential-helpers/credentials"
+)
+
+
+type keyRecord struct {
+	username string
+	password string
+}
+
+type keyFile struct {
+	path string
+}
+
+
+// Verify that keychain file has correct permissions
+func (self *keyFile) checkPermissions() error {
+	info, err := os.Stat(self.path)
+	if err != nil {
+		return err
+	}
+	if info.Mode().Perm() != 0600 {
+		return errors.New("Keychain file has wrong permissions")
+	}
+	return nil
+}
+
+
+// Read full keychain from file
+func (self *keyFile) readKeychain() (map[string]keyRecord, error) {
+	keychain := make(map[string]keyRecord)
+	if err := self.checkPermissions(); err != nil {
+		return keychain, err
+	}
+	file, err := os.Open(self.path)
+	if err != nil {
+		return keychain, err
+	}
+	defer file.Close()
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		fields := strings.Split(scanner.Text(), "\x00")
+		if len(fields) != 3 {
+			return keychain, errors.New("Malformed keychain file")
+		}
+		keychain[fields[0]] = keyRecord{fields[1], fields[2]}
+	}
+	return keychain, nil
+}
+
+
+// Write full keychain to file
+func (self *keyFile) writeKeychain(keychain map[string]keyRecord) error {
+	if err := os.MkdirAll(filepath.Dir(self.path), 0700); err != nil {
+		return err
+	}
+	mode := os.O_WRONLY | os.O_CREATE | os.O_TRUNC
+	file, err := os.OpenFile(self.path, mode, 0600)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	for k, v := range keychain {
+		record := k + "\x00" + v.username + "\x00" + v.password + "\n"
+		if _, err := file.WriteString(record); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+
+// Add a record to the keychain
+func (self *keyFile) Add(cred *credentials.Credentials) error {
+	keychain, err := self.readKeychain()
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	keychain[cred.ServerURL] = keyRecord{cred.Username, cred.Secret}
+	return self.writeKeychain(keychain)
+}
+
+
+// Delete a record from the keychain
+func (self *keyFile) Delete(serverURL string) error {
+	keychain, err := self.readKeychain()
+	if err != nil {
+		return err
+	}
+	if _, ok := keychain[serverURL]; !ok {
+		return errors.New("Attempt to delete a nonexistent record")
+	}
+	delete(keychain, serverURL)
+	return self.writeKeychain(keychain)
+}
+
+
+// Read a record from the keychain
+func (self *keyFile) Get(serverURL string) (string, string, error) {
+	keychain, err := self.readKeychain()
+	if err != nil {
+		return "", "", err
+	}
+	record, ok := keychain[serverURL]
+	if !ok {
+		return "", "", ErrKeychainNoItem
+	}
+	return record.username, record.password, nil
+}
+
+
+// List keychain records
+func (self *keyFile) List() (map[string]string, error) {
+	list := make(map[string]string)
+	keychain, err := self.readKeychain()
+	if err != nil {
+		return list, err
+	}
+	for k, v := range keychain {
+		list[k] = v.username
+	}
+	return list, nil
+}