formulahendry / formulahendry/vscode-mysql

Keytar Migration Plan

Open
#203 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
229
Forks
58
PR merge metrics
No merged PRs in 30d

Description

Hello :wave: I'm Tyler from the VS Code team. I'm opening this issue because you use the [keytar](https://github.com/atom/node-keytar) shim that VS Code provides.

Keytar is [officially archived](https://github.com/atom/node-keytar) and not being maintained... In an effort to promote good security practices by _not_ depending on an archived piece of software for storing secrets, we are working on a plan to remove this shim from VS Code. We want to communicate this to you so we minimize the disruption due to this change, hence this issue. I know this isn't the best news... we had a fair amount of work to remove our dependency on keytar as well, but we believe this is the right thing to do to ensure extensions are using secure APIs.

There are a couple of options for you to consider:
* _(recommended)_ Use the [SecretStorage API](https://code.visualstudio.com/api/references/vscode-api#SecretStorage) that VS Code provides on the [ExtensionContext](https://code.visualstudio.com/api/references/vscode-api#ExtensionContext). This API is cross-platform and will work on all platforms that VS Code supports. It is also maintained by the VS Code team and will continue to be maintained and has been a part of the VS Code API for years at this point.
* _(not recommended)_ You can bundle the [keytar](https://github.com/atom/node-keytar) module with your extension. Keep in mind that keytar is a native node module which means that you will need to [publish a platform specific extension](https://code.visualstudio.com/api/working-with-extensions/publishing-extension#platformspecific-extensions) for each platform you want to support.

### Timeline

The current plan is to remove this shim from VS Code Insiders in **early July** which means that **August 2023's** stable release will be the first release without the shim.

### Questions?

If you have any questions, please feel free to ask them here. I will do my best to answer them as quickly as possible. Your cooperation is greatly appreciated :heart:

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue contains a migration notice but names no repository files, tests, or entry points. Start by locating the extension's keytar usage and reviewing the linked VS Code SecretStorage API. Done would mean replacing the dependency with a supported storage approach and verifying the extension still handles secrets on its supported platforms.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript, vscode
Domain
security, tooling
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.