Re: [PATCH 0/3] agent: add passphrase storage options

Hi Mattias,

On 4/24/26 1:31 AM, Matthias Kurz wrote:
> Add an agent API variant for PSK passphrase requests that allows the
> agent to tell IWD whether the passphrase should be persisted in the
> network profile.
>
> This is needed by NetworkManager's IWD backend for profiles where the
> Wi-Fi PSK is stored as an agent-owned or not-saved secret. In those
> cases NetworkManager can provide the passphrase for the current
> connection attempt, but IWD should not save it into /var/lib/iwd/*.psk.
>
> The new RequestPassphraseWithOptions method returns the passphrase plus
> an options dictionary. Currently the only option is Store. If Store is
> false, IWD uses the passphrase for the current connection attempt but
> does not write PSK secrets back to the profile.

Do you anticipate additional options needing to be passed? I'm not 
really liking the idea of adding another agent API. Another option 
instead of a new DBus API could be that we have a main.conf option, 
something like:

[General].DisableStorage=true

If NM is always providing the passphrase via the agent API I don't see 
why we'd need to keep an option within the network profiles right?

Thanks,

James

>
> The method falls back to RequestPassphrase for older agents.
>
> NetworkManager-side draft MR:
> https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2402
>
> Matthias Kurz (3):
>    agent: Add passphrase storage options
>    doc: Document passphrase storage options
>    auto-t: Test transient PSK agent secrets
>
>   .../testEncryptedProfiles/connection_test.py  |  27 +++++
>   autotests/util/iwd.py                         |  14 ++-
>   doc/agent-api.txt                             |  12 ++
>   src/agent.c                                   | 108 +++++++++++++++---
>   src/agent.h                                   |   1 +
>   src/network.c                                 |  12 ++
>   6 files changed, 159 insertions(+), 15 deletions(-)
>