From eb47416f4a6e75f77bda61481d2b754b1e5c7638 Mon Sep 17 00:00:00 2001 From: Michael Leupold Date: Sat, 1 Aug 2009 12:11:59 +0200 Subject: Enable building the whole spec with XInclude. --- secret-service/specification.xml | 141 +++++++++++++------------------ secret-service/tools/spec-to-docbook.xsl | 6 +- 2 files changed, 64 insertions(+), 83 deletions(-) diff --git a/secret-service/specification.xml b/secret-service/specification.xml index 57f7cb2..6301ff8 100644 --- a/secret-service/specification.xml +++ b/secret-service/specification.xml @@ -72,10 +72,10 @@ choose to use a textual format to combine these values into one. For example, the 'desktop' key file format, or XML or another form of markup. - Secrets may be encrypted when transferred + Secrets may be encrypted when transferred to the client application and vice versa. - The Secret structure encapsulates + The Secret structure encapsulates a secret value along with it's transfer encryption parameters. @@ -84,10 +84,10 @@ Each secret is stored together with lookup attributes and a label. These together - form an item. + form an item. A group of items together form a - collection. + collection. A collection is similar in concept to the terms 'keyring' or 'wallet'. Collections and items are represented as DBus objects, and each have their own @@ -105,18 +105,18 @@ The service must prevent locked collections or items from modification. On such an invalid access the - IsLocked + IsLocked error should be raised. Client applications without special requirements should store in the default collection. Use the - DefaultCollection + DefaultCollection property on the Service interface to determine the default collection. In addition the default collection is always accessible through a specific object path. Client applications with special needs can create a new collection by calling the - CreateCollection() + CreateCollection() method on the Service interface. A client application must have opened a session before a collection can be created. The @@ -124,20 +124,20 @@ items within it may only be unlocked by the application that created the collection. Service implementors may choose not to implement this feature and should ignore the private argument when - creating a collection. + creating a collection. Client applications that demand this feature, should check the the - Private property + Private property after creating a collection to see if the request for a private collection was ignored. A collection can be deleted by calling the - Delete() + Delete() method on the Service interface. A client application must have opened a session before a collection can be created. However the collection does not need to be unlocked. In addition private collections can be deleted by any application. - + Lookup Attributes Attributes can and should be stored with a secret to facilitate lookup @@ -167,16 +167,16 @@ between the client application and the service. A session is established by calling the service's - OpenSession() + OpenSession() method. Once established, a session is bound to calling application's connection to the DBus session bus. Generally only one session can be established per client application. Calling OpenSession() a second time results in an - AlreadyExists + AlreadyExists error. A session is closed when the client application disconnects from the DBus session bus. Alternatively the client application can call the - Close() + Close() method on the session interface. Once a session is closed all session specific negotiations and authentication should be dropped by the service. @@ -205,7 +205,7 @@ a common way to store secrets. It's predecessors are the desktop specific APIs used by GNOME Keyring and KWallet. - +
Negotiation of Algorithms In order to encrypt secrets in transit, the service and the client @@ -214,13 +214,13 @@ The client application opens a session with the service, and then calls the - + Negotiate() method on that session. The algorithms argument to the Negotiate() method specifies a set of algorithms to be used together for key agreement and encryption. The other arguments are algorithm specific. If a service does not support a specific set of algorithms, a - NotSupported + NotSupported error is returned, and the client is free to try another set of algorithms. The plain algorithm is almost always supported. @@ -231,19 +231,19 @@ Once an algorithm has been negotiated, it is used for all transfer of secrets between the service and the client application in both directions. Algorithm specific parameters may be transfered with each - secret. - + secret. +
- +
Algorithm: plain Algorithm string: plain - + Negotiate input: empty string - + Negotiate output: empty string - + Secret parameter: empty string @@ -251,23 +251,23 @@ It is strongly recommended that a service implementing this API support the plain algorithm. - +
- +
Algorithm: dh-ietf1024-aes128-cbc-pkcs7 Algorithm string: dh-ietf1024-aes128-cbc-pkcs7 - + Negotiate input: client dh pub key as an array of bytes - + Negotiate output: service dh pub key as an array of bytes - + Secret parameter: 16 byte AES initialization vector. TODO: Document - +
@@ -281,7 +281,7 @@ In order to unlock an item or collection a session is established by the client application, and the - BeginAuthenticate() + BeginAuthenticate() method is called with one or more DBus object paths of items or collections. The BeginAuthenticate() method is asynchronous and may return before the item is actually unlocked. @@ -291,11 +291,11 @@ After the service tries to unlock an item or collection, whether successfully or unsuccessfully, the - Authenticated + Authenticated signal on the session interface is emitted. The client application may, but is not required to, call the - CompleteAuthenticate() + CompleteAuthenticate() method. One or more DBus object paths of items or collections that BeginAuthenticate() was previously called with, can be passed in. The CompleteAuthenticate() returns the items that were successfully authenticated. In addition if the unlock process is not @@ -346,62 +346,43 @@ D-Bus API Reference - - - Object Paths - + + Object Paths The various DBus object paths used with the Secrets API are designed to be human readable but not displayed to the user. The object path of an item or collection should not change for its lifetime, under normal circumstances. - - /org/freedesktop/Secrets - The object path for the service. - + /org/freedesktop/Secrets + The object path for the service. - - /org/freedesktop/Secrets/collection/xxxx - The object path for a collection, where xxxx represents a - possibly encoded or truncated version of the initial label of the collection. - + /org/freedesktop/Secrets/collection/xxxx + The object path for a collection, where xxxx represents a + possibly encoded or truncated version of the initial label of the collection. - - /org/freedesktop/Secrets/collection/xxxx/iiii + /org/freedesktop/Secrets/collection/xxxx/iiii The object path for an item, where xxxx is the collection (above) and iiii is an auto-generated item specific identifier. - - - - /org/freedesktop/Secrets/session/ssss - The object path for a session, where ssss is an auto-generated - session specific identifier. - - - - /org/freedesktop/Secrets/default - The default collection for client applications to store secrets is available under - this object path in addition to its real object path (above). - - - - - - org.freedesktop.Secrets.Collection Interface - - - org.freedesktop.Secrets.Collection Interface - Collection of items - - - - - - - - - - + + /org/freedesktop/Secrets/session/ssss + The object path for a session, where ssss is an auto-generated + session specific identifier. + + /org/freedesktop/Secrets/default + The default collection for client applications to store secrets is available under + this object path in addition to its real object path (above). + + + + + + + + + + + + - + diff --git a/secret-service/tools/spec-to-docbook.xsl b/secret-service/tools/spec-to-docbook.xsl index af158fa..e37c1a7 100644 --- a/secret-service/tools/spec-to-docbook.xsl +++ b/secret-service/tools/spec-to-docbook.xsl @@ -192,7 +192,7 @@ - + Types @@ -1043,13 +1043,13 @@ --> - + Interfaces - + -- cgit v1.2.3-70-g09d2