* feat: add Nix Flake release and update documentation for Nix integration
- Added flake.nix with native library patching for Linux
- Included SHA256 hashes for v0.10.0 DEB releases (x86_64 and arm64)
- Updated README.md with instructions for nix run, NixOS, Home Manager, and devShells
- Generated flake.lock for reproducibility
* refactor: improve Nix Flake patterns for better consumer control
- Extracted derivation logic into a reusable `mkPackage` function
- Exposed `overlays.default` to allow consumers to use their own nixpkgs instance
- Updated `pkgs.system` to `pkgs.stdenv.hostPlatform.system` to follow modern Nix patterns
- Ensured default `packages` definition correctly handles unfree configuration for testing with `nix build` or `nix run`
* docs: update README with advanced Nix integration patterns
- Added Option 1 (Direct Integration) and Option 2 (Overlay) documentation
- Explained how to use the overlay for full nixpkgs control
- Fixed Markdown styling and lint issues in the Nix integration section
* docs: simplify Nix documentation to favor Overlay integration
- Removed "Option 1" (direct integration) as per user feedback
- Promoted the Overlay method as the standard way to consume the package
- Updated devShell examples to rely on the overlayed package set for consistency
* fix(security): prevent master key overwriting on decryption failure and improve account loading resilience
- Modify readSafeStorageKey and generatePrimaryMasterKey to stop if decryption fails for an existing file, preventing permanent data loss when keyring is temporarily locked.
- Update CloudAccountRepo.getAccounts and getAccount to gracefully skip corrupted account records instead of throwing errors.
- Added detailed logging for security failures to aid in diagnostics.
* docs(readme): sync Nix/NixOS integration docs in README.zh-CN
---------
Co-authored-by: Youssef <[email protected]>
Summary
- Replace hard keytar dependency with a multi-strategy key storage:
1) safeStorage (Electron built-in) — preferred
2) keytar (system keychain) — fallback
3) file-based encryption — last resort
- Dynamically import keytar to avoid asar load failures
- Refactor cloudHandler to use const (clean code)
- Fix “Failed to load cloud accounts” in packaged app
Rationale
The keytar native module can fail to load from asar archives in production builds. This ensures the app works even when system keychain access is unavailable.
Additional changes
- Replace sync file ops with async (fs/promises)
- Add atomic file writes to prevent data races
- Implement concurrency lock for key generation
- Add security error codes for better diagnostics
- Add warnings for file-based fallback mode
- Align error handling after merge
- Migrate legacy encrypted account data
References
- Issue: #38
- Commit: 92dc2f6
vin