Skip to main content

Installation

Arch Linux (AUR)

# Pre-built binary release (recommended)
yay -S rosec-bin

# Optional providers (each a separate package — install only what you need)
yay -S rosec-provider-bitwarden-pm-bin
yay -S rosec-provider-bitwarden-sm-bin
yay -S rosec-provider-gnome-keyring-bin
yay -S rosec-provider-keepassxc-file-bin # experimental

Source-build alternative: rosec (bundles all providers, requires Rust toolchain) or rosec-git (latest main).

Build from source

Requires Rust 1.85+ (for edition 2024) and a wasm32-wasip1 target for the WASM provider crates.

git clone https://github.com/jmylchreest/rosec
cd rosec
rustup target add wasm32-wasip1

# Native binaries: rosec, rosecd, rosec-prompt, rosec-pam-unlock
cargo build --release --bin rosec --bin rosecd --bin rosec-prompt --bin rosec-pam-unlock

# WASM provider plugins (out-of-workspace crates)
cargo build --target wasm32-wasip1 --release --manifest-path rosec-bitwarden-pm/Cargo.toml
cargo build --target wasm32-wasip1 --release --manifest-path rosec-bitwarden-sm/Cargo.toml
cargo build --target wasm32-wasip1 --release --manifest-path rosec-gnome-keyring/Cargo.toml
cargo build --target wasm32-wasip1 --release --manifest-path rosec-keepassxc-file/Cargo.toml

Or use the bundled Justfile:

just build-release # all native binaries
just build-wasm # all WASM providers
just install # install to ~/.local/bin and ~/.local/share/rosec/providers

Enable as the Secret Service daemon

Once installed, rosec enable writes the systemd user units and D-Bus activation files that make rosec the implementation of org.freedesktop.secrets for your session. It also masks gnome-keyring-daemon so the two don't fight over the bus name.

rosec enable
systemctl --user start rosecd

# Confirm it's the active Secret Service
busctl --user list | grep secrets

If gnome-keyring-daemon keeps grabbing the bus name on login, rerun rosec enable --force and check the Troubleshooting guide.

Add your first provider

# Local encrypted vault — fully writable, offline-only
rosec provider add local

# Or an existing remote source
rosec provider add bitwarden # prompts for email + master password
rosec provider add keepassxc-file path=~/Passwords.kdbx

Then unlock it:

rosec unlock # all configured providers
rosec provider auth <id> # one specific provider

What runs where

ComponentPathRole
rosecd/usr/bin/rosecdThe daemon. Hosts D-Bus, SSH agent, FUSE mounts. Long-lived systemd user service.
rosec/usr/bin/rosecCLI for managing providers, items, locking.
rosec-prompt/usr/bin/rosec-promptThe default GUI prompter binary the daemon spawns when it needs a password.
rosec-pam-unlock/usr/lib/rosec/rosec-pam-unlockPAM helper; unlocks providers using your login password.
pam_rosec.so/usr/lib/security/pam_rosec.soThe PAM module that captures the login password and forks rosec-pam-unlock.
Provider WASM/usr/lib/rosec/providers/*.wasmSandboxed guest plugins. Each .wasm carries a .wasm.minisig signature checked by the host on load.

User-local installs put binaries under ~/.local/bin/ and provider WASM under ~/.local/share/rosec/providers/.