Incompatible encoding on darwin

[Makpoc]

Hello.

It looks like this change 5205e6f#diff-14c4aa5420de20b1ef5b174be7c1d389e4bdbbf71719ca66bf308caf38c60d1d is backwards incompatible on Darwin. The default prefix when Setting values is now go-keyring-base64: and clients that use older version of the go-keyring library would not have that prefix stripped and end up with a bad value.

Steps to reproduce:

main.go:

package main

import (
	"errors"
	"fmt"

	"github.com/zalando/go-keyring"
)

func main() {
	secret, err := keyring.Get("myservice", "myuser")
	if err != nil {
		if !errors.Is(err, keyring.ErrNotFound) {
			panic(err)
		}
		err = keyring.Set("myservice", "myuser", "very-secret")
		if err != nil {
			panic(err)
		}
	}
	fmt.Println(secret)
}

Build it once with [email protected] -> keyring_old.bin

• go get github.com/zolando/[email protected]
• go mod tidy && go mod vendor
• GOOS=darwin GOARCH=arm64 go build -o keyring_old.bin ./...

Build it with [email protected] -> keyring_new.bin

• go get github.com/zolando/[email protected]
• go mod tidy && go mod vendor
• GOOS=darwin GOARCH=arm64 go build -o keyring_new.bin ./...

1. Run keyring_new.bin first, then run keyring_old.bin.

Result:

># ./keyring_new.bin
very-secret
># ./keyring_old.bin
go-keyring-base64:dmVyeS1zZWNyZXQ=

2. Clean the "myservice" credentials

3. Run keyring_old.bin first, then run keyring_new.bin

># ./keyring_old.bin
very-secret
># ./keyring_new.bin
very-secret

[mikkeloscar]

I'm not sure how we could solve this. It's forwards compatible but not backwards. If people use an older version for the same secrets I think it's reasonable to expect there can be problems.

[Makpoc]

I have not had much time to think about the possible solution, but off the top of my head it may be possible to provide a function where we set the preferred encoding algorithm so that we can control the prefix (e.g. newer versions would be able to keep writing new secrets as hex instead of base64).

[mikkeloscar]

What is the use case for using and old AND a new version for go-keyring for the same secrets? There need to be a good use case before it makes sense to implement and maintain such a thing like a switch between hex and base64.

[Makpoc]

The use case is related to multiple independent applications that rely on the shared secret to communicate. We cannot ensure they are all up-to date if they are shipped to clients.