OSCrypt for POSIX uses libsecret to store a randomised encryption key.

components/os_crypt/key_storage_linux.h

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_OS_CRYPT_KEY_STORAGE_LINUX_H_
+#define COMPONENTS_OS_CRYPT_KEY_STORAGE_LINUX_H_
+
+#include <memory>
+#include <string>
+
+#include "base/macros.h"
+
+// An API for retrieving OSCrypt's password from the system's password storage
+// service
+class KeyStorage {

[Lei Zhang, 2016/05/18 22:38:15]

Should this be KeyStorageLinux?

[cfroussios, 2016/05/19 21:18:18]

Done.

+ public:
+  KeyStorage() = default;
+  virtual ~KeyStorage() = default;
+
+  // Gets the encryption key from the OS password-managing library. If a key is
+  // not found, a new key will be generated, stored and returned.
+  virtual std::string GetKey() = 0;
+
+  // Load the key storage. False is returned if the service is not available.

[Lei Zhang, 2016/05/18 22:38:15]

Grammar:

- Load -> Loads
- False is returned -> Returns false.

[cfroussios, 2016/05/19 21:18:18]

Done.

+  virtual bool Init() = 0;

[Lei Zhang, 2016/05/18 22:38:15]

Can we reorder the methods? I imagine users will call Init() first, so it should
come first.

[cfroussios, 2016/05/19 21:18:18]

The code will call indeed call Init() first, but the users shouldn't have to
call it at all. I think your point is best addressed by putting CreateService()
first and making Init() protected.

+
+  // Tries to load all known key storages. Returns the first that succeeds or
+  // null if none succeed.
+  static std::unique_ptr<KeyStorage> CreateService();
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(KeyStorage);
+};
+
+#endif  // COMPONENTS_OS_CRYPT_KEY_STORAGE_LINUX_H_