use keytar to store pickle keys

src/electron-main.js

@@ -43,6 +43,18 @@ const Store = require('electron-store');
 const fs = require('fs');
 const afs = fs.promises;
 
+const crypto = require('crypto');
+let keytar;
+try {
+    keytar = require('keytar');
+} catch (e) {
+    if (e.code === "MODULE_NOT_FOUND") {
+        console.log("Keytar isn't installed; secure key storage is disabled.");
+    } else {
+        console.warn("Keytar unexpected error:", e);
+    }
+}
+
 let seshatSupported = false;
 let Seshat;
 let SeshatRecovery;
@@ -365,6 +377,40 @@ ipcMain.on('ipcCall', async function(ev, payload) {
             recordSSOSession(args[0]);
             break;
 
+        case 'getPickleKey':
+            try {
+                ret = await keytar.getPassword("riot.im", `${args[0]}|${args[1]}`);
+            } catch (e) {
+                // if an error is thrown (e.g. keytar can't connect to the keychain),
+                // then return null, which means the default pickle key will be used
+                ret = null;
+            }
+            break;
+
+        case 'createPickleKey':
+            try {
+                const randomArray = await new Promise((resolve, reject) => {
+                    crypto.randomBytes(32, (err, buf) => {
+                        if (err)
+                            reject(err);
+                        else
+                            resolve(buf);
+                    });
+                });
+                const pickleKey = randomArray.toString("base64").replace(/=+$/g, '');
+                await keytar.setPassword("riot.im", `${args[0]}|${args[1]}`, pickleKey);
+                ret = pickleKey;
+            } catch (e) {
+                ret = null;
+            }
+            break;
+
+        case 'destroyPickleKey':
+            try {
+                await keytar.deletePassword("riot.im", `${args[0]}|${args[1]}`);
+            } catch (e) {}
+            break;
+
         default:
             mainWindow.webContents.send('ipcReply', {
                 id: payload.id,