formulahendry / formulahendry/vscode-mysql
Keytar Migration Plan
- Dominant language
- TypeScript
- Stars
- 229
- Forks
- 58
- PR merge metrics
- No merged PRs in 30d
Description
Hello :wave: I'm Tyler from the VS Code team. I'm opening this issue because you use the [keytar](https://github.com/atom/node-keytar) shim that VS Code provides.
Keytar is [officially archived](https://github.com/atom/node-keytar) and not being maintained... In an effort to promote good security practices by _not_ depending on an archived piece of software for storing secrets, we are working on a plan to remove this shim from VS Code. We want to communicate this to you so we minimize the disruption due to this change, hence this issue. I know this isn't the best news... we had a fair amount of work to remove our dependency on keytar as well, but we believe this is the right thing to do to ensure extensions are using secure APIs.
There are a couple of options for you to consider:
* _(recommended)_ Use the [SecretStorage API](https://code.visualstudio.com/api/references/vscode-api#SecretStorage) that VS Code provides on the [ExtensionContext](https://code.visualstudio.com/api/references/vscode-api#ExtensionContext). This API is cross-platform and will work on all platforms that VS Code supports. It is also maintained by the VS Code team and will continue to be maintained and has been a part of the VS Code API for years at this point.
* _(not recommended)_ You can bundle the [keytar](https://github.com/atom/node-keytar) module with your extension. Keep in mind that keytar is a native node module which means that you will need to [publish a platform specific extension](https://code.visualstudio.com/api/working-with-extensions/publishing-extension#platformspecific-extensions) for each platform you want to support.
### Timeline
The current plan is to remove this shim from VS Code Insiders in **early July** which means that **August 2023's** stable release will be the first release without the shim.
### Questions?
If you have any questions, please feel free to ask them here. I will do my best to answer them as quickly as possible. Your cooperation is greatly appreciated :heart:
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue contains a migration notice but names no repository files, tests, or entry points. Start by locating the extension's keytar usage and reviewing the linked VS Code SecretStorage API. Done would mean replacing the dependency with a supported storage approach and verifying the extension still handles secrets on its supported platforms.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript, vscode
- Domain
- security, tooling
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100