Keytar Migration Plan

[TylerLeonhardt]

Hello 👋 I wanted to give you all a heads up around our plan for dealing with our dependency on Keytar, the abstraction layer we have been using to store secrets in the OS keyring... along with the old Keytar shim that extensions depended on before the introduction of the SecretStorage API.

Keytar itself is officially archived and not being maintained... In an effort to promote good security practices by not depending on an archived piece of software for storing secrets, we are working on a plan to remove this shim from VS Code.

We have already directly reached out to extension authors of popular extensions that still use this Keytar shim... and they are working on moving off of it. We want to communicate this here as well for those we didn't contact directly so we minimize the disruption due to this change. I know this isn't the best news... we had a fair amount of work to remove our dependency on Keytar as well, but we believe this is the right thing to do to ensure extensions are using secure APIs.

If you are using Keytar directly in your extension, there are a couple of options for you to consider:

• (recommended) Use the SecretStorage API that VS Code provides on the ExtensionContext. This API is cross-platform and will work on all platforms that VS Code supports. It is also maintained by the VS Code team and will continue to be maintained and has been a part of the VS Code API for years at this point.
• (not recommended) You can bundle the keytar module with your extension. Keep in mind that keytar is a native node module which means that you will need to publish a platform specific extension for each platform you want to support.

Timeline

The current plan is to remove this shim from VS Code Insiders in early September which means that September 2023's stable release will be the first release without the shim.

Work for this is being tracked here: microsoft/vscode#185677

Questions?

If you have any questions, please feel free to ask them here. I will do my best to answer them as quickly as possible. Your cooperation is greatly appreciated ❤️

[wilhelmklopp]

👋 Hi @TylerLeonhardt – We're running into an issue when testing our VSCode extension, which I suspect is related to this change. More details here: microsoft/vscode#188059

[adam-wolfe]

Just to confirm, by "September 2023's stable release", do you mean the release that is scheduled for release in early October?

[TylerLeonhardt]

@adam-wolfe the timeline was pushed back a month... but yes that is a correct interpretation of what I said. So now, we will consider removing it in early September which means that September 2023's stable release (often released in the first week of Oct) will be the first release without the shim.

[adam-wolfe]

Excellent, thanks.

[TylerLeonhardt]

@adam-wolfe I misspoke in this and edited my message. Since we removed it in early September, it will be in September's stable release (on track to be released next week). Apologies for that confusion.

[adam-wolfe]

Not a problem, we are ready.

[Kreijstal]

Can't build vscode on arm32 because of the keytar dependency

[TylerLeonhardt]

Keytar is no longer a dependency in VS Code. It hasn't been in 3+ months. Can you provide more information?