QOMPASS AI

SECRET SERVICE — RUST

Qompass-Hold

Qompass-Hold

Version 1.00Source on GitHub

OVERVIEW

Qompass-Hold is a "Rust based secret service for pass" (README subtitle; GitHub repo description: "Qompass Secret-Service"): it implements the freedesktop Secret Service API on D-Bus (`org.freedesktop.secrets`) with the `pass` password store — GPG-encrypted files under `~/.password-store` — as its backing store.

HOW IT WORKS

  1. 1At startup the service builds a `PasswordStore` from the environment (`PasswordStore::from_env`) and opens a session D-Bus connection.
  2. 2It registers the `org.freedesktop.Secret.Service` object at `/org/freedesktop/secrets` and requests the well-known name `org.freedesktop.secrets`, so desktop clients and `libsecret` apps find it as the system's secret service.
  3. 3A client opens a session (`org.freedesktop.Secret.Session`); session objects encrypt/decrypt the secret values exchanged over D-Bus.
  4. 4Collections (`org.freedesktop.Secret.Collection`) map to a `secret-service` subdirectory of the password store; collection labels and aliases, and item attribute indexes, are kept in a `redb` database (`attributes.redb`) inside the store.
  5. 5Items (`org.freedesktop.Secret.Item`) are the actual secrets: their values are written as GPG-encrypted `.gpg` files in the store (the `pass` layout), and reads run `gpg --decrypt` — with `--pinentry-mode=error` instead of prompting when the caller cannot prompt.
  6. 6Searching a collection looks items up by their attributes in the `redb` attribute tables rather than decrypting every file; unlocking/locking and item/collection deletion are handled through the same D-Bus interfaces.
How it works, step by step — each step as the project's own documentation states it.

CONCEPTS

SECRET SERVICE CALLS, BACKED BY passAPPLICATIONlibsecret / desktop clientQOMPASS-HOLDRust secret serviceWELL-KNOWN NAMEorg.freedesktop.secretsSECRET SERVICE API — /org/freedesktop/secretsService · Session · Collection · Itemsession objects encrypt/decrypt values in transit~/.password-store — THE pass STOREcollections map to the secret-service subdirectory of the storeitems are .gpg files in the pass layout — reads run gpg --decryptsearch resolves attributes in attributes.redb (redb, in the store)unlocking, locking and deletion run through the same D-Bus interfacesPASSWORD_STORE_DIR overrides the store location (default ~/.password-store)
How Qompass-Hold maps the freedesktop Secret Service API onto pass, from the service's own source: D-Bus collections map to a secret-service subdirectory of ~/.password-store, items are GPG-encrypted .gpg files in the pass layout, and attribute searches resolve through the attributes.redb index instead of decrypting the store. The diagram shows the mapping mechanism only — no secret names or values.

CONFIGURATION

OptionDefaultWhat it does
PASSWORD_STORE_DIR`~/.password-store` if unsetDirectory of the `pass` password store
PASSWORD_STORE_GPG_OPTSunsetExtra options split on whitespace and passed to every `gpg` invocation
PASSWORD_STORE_UMASK`077` (octal; parsed with radix 8)Umask from which file/dir modes are derived (dir mode `!umask & 0o777`; file mode strips execute bits)
HOMErequired (`$HOME must be set` if `PASSWORD_STORE_DIR` is unset)Used to locate `~/.password-store`
Environment=PASSWORD_STORE_DIR=%h/.password-storeas written in the unitStore location when run under the systemd user unit
`ExecStart` (systemd user unit)%h/.local/bin/qpass-holdBinary the user unit starts; unit is `Type=dbus`, `BusName=org.freedesktop.secrets`, `PartOf=graphical-session.target`

CONTROLS

ActionControl
Run the serviceExecute the binary (no arguments); it serves on the session bus until stopped
Run under systemd (user)`qpass-secret.service` user unit (`Type=dbus`, bus name `org.freedesktop.secrets`)
Open a secret sessionD-Bus interface `org.freedesktop.Secret.Service` / `org.freedesktop.Secret.Session` at `/org/freedesktop/secrets`
Create / search / delete collections and itemsD-Bus interfaces `org.freedesktop.Secret.Collection` and `org.freedesktop.Secret.Item`
Read or write the underlying secrets directlyThe standard `pass` / `gpg` tooling on the same `~/.password-store` files (the store is the pass layout: one `.gpg` file per secret)

NOT COVERED

- The README contains no functional documentation beyond the one-line subtitle — everything above is sourced from the Rust source, `Cargo.toml`, and the systemd units. - Exact D-Bus method names/signatures were taken from the interface module structure (`Service`, `Collection`, `Item`, `Session`) rather than an enumerated method-by-method read of every handler. - The binary name in the systemd unit is `qpass-hold`, while the Cargo package is `qompass-hold`; which name the built binary actually ships under was not verified from a build artifact. - Primo clones are known-stale estate-wide; the primo `src/` files used here match the GitHub tree listing (same paths), but were not diffed byte-for-byte against GitHub HEAD.

REFERENCES

  1. freedesktop Secret Service specificationThe D-Bus API (org.freedesktop.secrets — Service, Session, Collection and Item) that Qompass-Hold implements.
  2. pass — the standard Unix password managerThe password store whose layout backs Hold: one GPG-encrypted file per secret under ~/.password-store.
  3. GnuPG — the GNU Privacy GuardThe encryption tool whose encrypted files form the store; Hold's reads run gpg --decrypt against them.