feat(credential): enable cargo:libsecret on all Unix platforms except macOS and mobile

Widen the libsecret credential provider's cfg gate from
`target_os = "linux"` to
`all(unix, not(any(target_os = "macos", "ios", "tvos", "watchos", "visionos", "android")))`,
making the provider available on the BSDs and other Unix-like systems.
libsecret is loaded dynamically at runtime via libloading (which supports
these platforms), and the library plus Secret Service implementations are
packaged on FreeBSD, OpenBSD, and NetBSD, so the previous Linux-only gate
was an artificial restriction rather than a technical one. macOS keeps its
OS-specific keyring provider (cargo:macos-keychain), and the mobile Unix
targets (iOS-family, Android) are excluded since libsecret does not exist
there.

Also document the provider's platform availability in
registry-authentication.md and the crate README.

This is pre-work for RFC 3981 (store registry tokens in the OS credential
store by default), which flips secure token storage from opt-in to the
default and notes the BSD gap in Cargo's built-in providers:
rust-lang/rfcs#3981

Tested on a FreeBSD 15.1-RELEASE amd64 VirtualBox VM with libsecret and
gnome-keyring over a D-Bus session bus: LibSecretCredential::new() loads
libsecret via dlopen, and login/get/logout round-trips through the Secret
Service correctly (token stored, retrieved matching, removed, and
reported absent after logout). cargo check -p cargo and cargo fmt pass on
x86_64-unknown-linux-gnu.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: quinnjr

credential/cargo-credential-libsecret/README.md

@@ -5,6 +5,10 @@ See the [credential-provider] documentation for how to use this.
 
 This credential provider is built-in to cargo as `cargo:libsecret`.
 
+It is available on Unix-like platforms such as Linux and the BSDs — except
+macOS, which uses its OS-specific keyring via the `cargo:macos-keychain`
+provider instead, and mobile platforms, where libsecret does not exist.
+
 > This crate is maintained by the Cargo team, primarily for use by Cargo
 > and not intended for external use (except as a transitive dependency). This
 > crate may make major changes to its APIs or be deprecated without warning.

credential/cargo-credential-libsecret/src/lib.rs

@@ -2,7 +2,17 @@
 //! > and not intended for external use (except as a transitive dependency). This
 //! > crate may make major changes to its APIs or be deprecated without warning.
 
-#[cfg(target_os = "linux")]
+#[cfg(all(
+    unix,
+    not(any(
+        target_os = "macos",
+        target_os = "ios",
+        target_os = "tvos",
+        target_os = "watchos",
+        target_os = "visionos",
+        target_os = "android"
+    ))
+))]
 mod linux {
     //! Implementation of the libsecret credential helper.
 
@@ -259,7 +269,27 @@ mod linux {
     }
 }
 
-#[cfg(not(target_os = "linux"))]
+#[cfg(not(all(
+    unix,
+    not(any(
+        target_os = "macos",
+        target_os = "ios",
+        target_os = "tvos",
+        target_os = "watchos",
+        target_os = "visionos",
+        target_os = "android"
+    ))
+)))]
 pub use cargo_credential::UnsupportedCredential as LibSecretCredential;
-#[cfg(target_os = "linux")]
+#[cfg(all(
+    unix,
+    not(any(
+        target_os = "macos",
+        target_os = "ios",
+        target_os = "tvos",
+        target_os = "watchos",
+        target_os = "visionos",
+        target_os = "android"
+    ))
+))]
 pub use linux::LibSecretCredential;

doc/book/src/reference/registry-authentication.md

@@ -55,6 +55,13 @@ The Keychain Access app can be used to view stored tokens.
 ### `cargo:libsecret`
 Uses [libsecret](https://wiki.gnome.org/Projects/Libsecret) to store tokens.
 
+This provider is available on Unix-like platforms, including Linux and the
+BSDs — except macOS, which uses its OS-specific keyring via
+[`cargo:macos-keychain`](#cargomacos-keychain), and mobile platforms (iOS,
+Android, and similar), where libsecret does not exist. The `libsecret` library
+is loaded at runtime, so it only needs to be installed when this provider is
+used.
+
 Any password manager with libsecret support can be used to view stored tokens.
 The following are a few examples (non-exhaustive):
 

src/util/auth/mod.rs

@@ -480,7 +480,17 @@ static BUILT_IN_PROVIDERS: &[&'static str] = &[
 
 /// Retrieves a cached instance of `LibSecretCredential`.
 /// Must be cached to avoid repeated load/unload cycles, which are not supported by `glib`.
-#[cfg(target_os = "linux")]
+#[cfg(all(
+    unix,
+    not(any(
+        target_os = "macos",
+        target_os = "ios",
+        target_os = "tvos",
+        target_os = "watchos",
+        target_os = "visionos",
+        target_os = "android"
+    ))
+))]
 fn get_credential_libsecret()
 -> CargoResult<&'static cargo_credential_libsecret::LibSecretCredential> {
     static CARGO_CREDENTIAL_LIBSECRET: std::sync::OnceLock<
@@ -535,7 +545,17 @@ fn credential_action(
             "cargo:wincred" => Box::new(cargo_credential_wincred::WindowsCredential {}),
             #[cfg(target_os = "macos")]
             "cargo:macos-keychain" => Box::new(cargo_credential_macos_keychain::MacKeychain {}),
-            #[cfg(target_os = "linux")]
+            #[cfg(all(
+                unix,
+                not(any(
+                    target_os = "macos",
+                    target_os = "ios",
+                    target_os = "tvos",
+                    target_os = "watchos",
+                    target_os = "visionos",
+                    target_os = "android"
+                ))
+            ))]
             "cargo:libsecret" => Box::new(get_credential_libsecret()?),
             name if BUILT_IN_PROVIDERS.contains(&name) => {
                 Box::new(cargo_credential::UnsupportedCredential {})