From f8721b9fa8a933bd598ae34677a046c850768e70 Mon Sep 17 00:00:00 2001
From: hkdb <hkdb@3df.io>
Date: Sat, 5 Sep 2026 03:42:05 -0700
Subject: [PATCH] Cross-platform keychain fix

---
 CHANGELOG.md                                        |  5 +++++
 keystore/keychain_index.go                          |  3 ++-
 keystore/{keychain_linux.go => keychain_keyring.go} | 11 +++++++++--
 3 files changed, 16 insertions(+), 3 deletions(-)
 rename keystore/{keychain_linux.go => keychain_keyring.go} (86%)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cd813f4..44de70f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,10 @@
 # CHANGELOG
 
+**v0.1.1 - 09-05-2026**
+
+- Cross-platform keychain fix
+
+
 **v0.1.0 - 09-01-2026**
 
 - Initial release
diff --git a/keystore/keychain_index.go b/keystore/keychain_index.go
index 64dd41b..3dc1bfa 100644
--- a/keystore/keychain_index.go
+++ b/keystore/keychain_index.go
@@ -6,5 +6,6 @@ import "sync"
 // index. The keychain stores the identity-name list as a single JSON blob (no
 // atomic list primitive), so concurrent identity creation/removal would
 // otherwise race on ListNames→mutate→Set and lose an entry, making a stored key
-// invisible to ListNames. Shared by the linux and darwin keychain backends.
+// invisible to ListNames. Shared by the darwin (native) and go-keyring
+// (all other platforms) keychain backends.
 var keychainIndexMu sync.Mutex
diff --git a/keystore/keychain_linux.go b/keystore/keychain_keyring.go
similarity index 86%
rename from keystore/keychain_linux.go
rename to keystore/keychain_keyring.go
index 2b2a04a..c54f648 100644
--- a/keystore/keychain_linux.go
+++ b/keystore/keychain_keyring.go
@@ -1,4 +1,4 @@
-//go:build linux
+//go:build !darwin
 
 package keystore
 
@@ -11,7 +11,14 @@ import (
 	"github.com/zalando/go-keyring"
 )
 
-// KeychainStore stores keys in the OS keychain via go-keyring (D-Bus Secret Service).
+// KeychainStore stores keys in the OS keychain via go-keyring, which is pure Go
+// (no cgo) and self-dispatches per platform: D-Bus Secret Service on Linux and
+// the BSDs (OpenBSD/NetBSD unconditionally; FreeBSD/DragonFly when cgo is on),
+// the Credential Manager (wincred) on Windows, and a graceful
+// ErrUnsupportedPlatform fallback everywhere else. On platforms with no live
+// backend, KeychainAvailable() returns false and callers fall back to the
+// encrypted file store — so this one file safely covers every non-macOS target.
+// macOS uses the native Security.framework via keychain_darwin.go instead.
 type KeychainStore struct{}
 
 // NewKeychainStore creates a new KeychainStore.