- Embed the minimal credstore subset used by tea (SecureStore,
EncryptedFileStore, KeyringStore, FileStore) as modules/credstore so
external SDK renames can no longer break the build
- Keep the on-disk format fully compatible: AES-256-GCM values with the
v1: prefix, credentials.json / credentials.json.enc paths, and the
Token JSON field names are unchanged, verified by a ciphertext fixture
generated with sdk-go v1.1.0
- Store the keyring master key under a tea-owned account name
- Reuse the existing kernel-level filelock module instead of the
upstream lockfile protocol, removing a stale-lock race
- Cover roundtrip, keyring-unavailable fallback, and fixture decryption
with tests using a mocked keyring
- Remove github.com/go-signet/sdk-go and promote
github.com/zalando/go-keyring to a direct dependency
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bo-Yi Wu