fix(build): make os keyring backend opt-in for cross builds

crates/dbx-core/Cargo.toml

@@ -15,6 +15,9 @@ sqlite-multiple-ciphers = ["dbx-drivers/sqlite-multiple-ciphers"]
 # (dbx-cli, dbx-mcp); do not combine with the cipher features.
 sqlite-bundled = ["rusqlite/bundled", "dbx-drivers/sqlite-bundled"]
 openapi = ["dbx-types/openapi", "dbx-sql/openapi"]
+# OS keyring storage for the secret-store key material (macOS/Windows keychain,
+# Linux dbus Secret Service with persistent fallback). Desktop only.
+os-keyring = ["dep:keyring", "keyring/linux-native-sync-persistent"]
 system-fonts = ["font-kit"]
 
 [dependencies]
@@ -64,7 +67,11 @@ aes-gcm = "0.10"
 aes = "0.8"
 cbc = "0.1"
 argon2 = "0.5"
-keyring = { version = "3.6.3", default-features = false, features = ["apple-native", "windows-native", "linux-native-sync-persistent", "crypto-rust"] }
+# The Linux dbus Secret Service backend (linux-native-sync-persistent) pulls
+# libdbus-sys, whose pkg-config build script cannot cross-compile (musl static
+# browser, docker zigbuild). It stays opt-in so server/cross builds skip it and
+# fall back to the managed .dbx/secret.key file.
+keyring = { version = "3.6.3", default-features = false, optional = true, features = ["apple-native", "windows-native", "crypto-rust"] }
 sha2 = "0.10"
 async-trait = "0.1"
 bytes = "1"

crates/dbx-core/src/persistence/secret_codec.rs

@@ -16,7 +16,9 @@ use argon2::{Algorithm, Argon2, Params, Version};
 use base64::Engine as _;
 
 const PREFIX: &str = "dbxenc1";
+#[cfg(feature = "os-keyring")]
 const KEYRING_SERVICE: &str = "com.dbx.app.secret-store.v1";
+#[cfg(feature = "os-keyring")]
 const KEYRING_USER: &str = "local-data-encryption-key";
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -246,6 +248,7 @@ impl SecretCodec {
     }
 }
 
+#[cfg(feature = "os-keyring")]
 fn platform_keyring_codec(allow_create: bool) -> Option<SecretCodec> {
     let entry = keyring::Entry::new(KEYRING_SERVICE, KEYRING_USER).ok()?;
     match entry.get_password() {
@@ -263,6 +266,13 @@ fn platform_keyring_codec(allow_create: bool) -> Option<SecretCodec> {
     Some(SecretCodec::new(key))
 }
 
+#[cfg(not(feature = "os-keyring"))]
+fn platform_keyring_codec(_allow_create: bool) -> Option<SecretCodec> {
+    // Cross/server builds compile without the OS keyring backend; the managed
+    // .dbx/secret.key file remains the key material source.
+    None
+}
+
 fn create_managed_key(path: &std::path::Path) -> Result<SecretCodec, String> {
     let parent = path.parent().ok_or_else(|| "KEY_FILE_UNAVAILABLE".to_string())?;
     std::fs::create_dir_all(parent).map_err(|_| "KEY_FILE_UNAVAILABLE".to_string())?;