chore: linting

src-tauri/src/profile_import/keyring.rs

@@ -30,6 +30,10 @@ use std::path::Path;
 /// for the item that is actually there. That is what lets a single `chromium`
 /// family key cover both Google Chrome and vanilla Chromium, which share a
 /// detection entry but not a Keychain item.
+// Consulted by the Keychain and secret-service lookups. Windows resolves the
+// key through DPAPI against the profile's own Local State, so it never needs
+// to guess a brand.
+#[allow(dead_code)]
 fn brand_candidates(family: &str, source_path: &Path) -> Vec<&'static str> {
   let path = source_path.to_string_lossy();
   let mut brands: Vec<&'static str> = match family {
@@ -262,7 +266,9 @@ fn dpapi_unprotect(ciphertext: &[u8]) -> Result<Vec<u8>, String> {
   use windows::Win32::Foundation::LocalFree;
   use windows::Win32::Security::Cryptography::{CryptUnprotectData, CRYPT_INTEGER_BLOB};
 
-  let mut input = CRYPT_INTEGER_BLOB {
+  // `pdatain` is `*const CRYPT_INTEGER_BLOB`: DPAPI only reads the input blob,
+  // so a shared reference is what the signature wants.
+  let input = CRYPT_INTEGER_BLOB {
     cbData: ciphertext.len() as u32,
     pbData: ciphertext.as_ptr() as *mut u8,
   };
@@ -271,7 +277,7 @@ fn dpapi_unprotect(ciphertext: &[u8]) -> Result<Vec<u8>, String> {
   // SAFETY: `input` points at a live slice for the duration of the call, and
   // `output` is freed via LocalFree exactly once below, as the API requires.
   unsafe {
-    CryptUnprotectData(&mut input, None, None, None, None, 0, &mut output)
+    CryptUnprotectData(&input, None, None, None, None, 0, &mut output)
       .map_err(|e| format!("CryptUnprotectData failed: {e}"))?;
 
     let plaintext = std::slice::from_raw_parts(output.pbData, output.cbData as usize).to_vec();

src-tauri/src/profile_import/os_crypt.rs

@@ -27,6 +27,9 @@
 use aes::cipher::{block_padding::Pkcs7, BlockModeDecrypt, BlockModeEncrypt, KeyIvInit};
 use aes_gcm::aead::{Aead, KeyInit, Payload};
 use aes_gcm::{Aes256Gcm, Key, Nonce};
+// Windows stores the raw 32-byte key, so it neither encodes nor decodes
+// base64; only the mac/Linux password paths below need the trait in scope.
+#[cfg(not(target_os = "windows"))]
 use base64::Engine;
 use rand::RngExt;
 use ring::pbkdf2;
@@ -37,6 +40,8 @@ type Aes128CbcDec = cbc::Decryptor<aes::Aes128>;
 type Aes128CbcEnc = cbc::Encryptor<aes::Aes128>;
 
 /// Chromium's fixed PBKDF2 salt for every CBC-based os_crypt provider.
+// Only the CBC hosts derive a key; Windows uses the file's bytes directly.
+#[allow(dead_code)]
 pub const SALT: &[u8] = b"saltysalt";
 /// Chromium's fixed CBC IV: sixteen spaces.
 pub const CBC_IV: [u8; 16] = [b' '; 16];
@@ -74,6 +79,9 @@ pub const POSIX_ITERATIONS: u32 = 1;
 /// `password` is the raw bytes, never trimmed: Chromium passes the exact
 /// `ReadFileToString` result to the KDF, so normalising here would silently
 /// produce a different key and every decrypt would fail.
+// Called from the mac and Linux branches only: `DPAPIKeyProvider` takes the
+// 32 bytes on disk as the AES-256 key with no derivation step at all.
+#[allow(dead_code)]
 pub fn derive_key(password: &[u8], iterations: u32) -> [u8; 16] {
   let mut key = [0u8; 16];
   // ring rather than the `pbkdf2` crate: sha1 0.11 (digest 0.11) and