Keep Linux secrets across a reboot (R71)

.github/workflows/ci.yml

@@ -507,10 +507,12 @@ jobs:
       - name: Install stable toolchain
         run: rustup toolchain install stable --profile minimal
 
-      - name: Install keyring helper
+      # dbus-daemon backs the fake Secret portal the client suite starts, and
+      # gnome-keyring the Secret Service group below (R71).
+      - name: Install keyring helpers
         run: |
           sudo apt-get update
-          sudo apt-get install -y keyutils
+          sudo apt-get install -y keyutils dbus gnome-keyring
 
       - uses: taiki-e/install-action@nextest
 
@@ -527,6 +529,19 @@ jobs:
       - name: Run Rust suite
         run: keyctl session -- cargo +stable nextest run --release --all-features --test-threads 4 ${{ matrix.packages }}
 
+      # R71's groups that need a private session bus, root, or Docker.
+      - name: Run Secret Service custody tests
+        if: matrix.name == 'client'
+        run: scripts/linux-secret-store-tests.sh secret-service
+
+      - name: Run systemd unit custody tests
+        if: matrix.name == 'client'
+        run: scripts/linux-secret-store-tests.sh systemd
+
+      - name: Run container custody tests
+        if: matrix.name == 'client'
+        run: scripts/linux-secret-store-tests.sh container
+
       - name: Prune target cache
         if: always()
         run: |

.github/workflows/coverage.yml

@@ -72,10 +72,10 @@ jobs:
             --profile minimal \
             --component llvm-tools-preview
 
-      - name: Install keyring helper
+      - name: Install keyring helpers
         run: |
           sudo apt-get update
-          sudo apt-get install -y keyutils
+          sudo apt-get install -y keyutils dbus gnome-keyring
 
       - uses: taiki-e/install-action@cargo-llvm-cov
       - uses: taiki-e/install-action@nextest
@@ -101,6 +101,12 @@ jobs:
             --all-features \
             --test-threads 4 \
             ${{ matrix.packages }}
+          # The desktop Secret Service path, whose child processes inherit the
+          # profile environment. The systemd and container groups run with a
+          # clean environment, so ci.yml runs them uninstrumented.
+          if [ "${{ matrix.name }}" = client ]; then
+            CARGO_TEST_PROFILE=testfast scripts/linux-secret-store-tests.sh secret-service
+          fi
           cargo +stable llvm-cov report \
             --profile testfast \
             --codecov \