jaraco / jaraco/keyring

Backend inference between KWallet and Gnome leads to unexpected results

Open
#496 16 comments 3 reactions 0 assignees View on GitHub
enhancement help wanted Linux
Dominant language
Python
Stars
1.5k
Forks
196
PR merge metrics
No merged PRs in 30d

Description

> The SecretService keyring will be queried first, but if it's a miss (no password defined), the kwallet backend(s) will be queried, triggering the wallet creation UI. I believe the SecretService store is being queried first, but just not satisfying the operation. [...]
> In some ways, the behavior you describe is by design. But you've stumbled on a flaw in the design. [...]
> [...] Where a backend triggers blocking UI elements and [raises KeyringLocked exceptions](https://github.com/jaraco/keyring/blob/a65aa2ea949e78f67dc03abc4bfd4a691bdf0802/keyring/backends/kwallet.py#L101), however, that's not desirable.

My scenario is the same described by the OP, including _exactly_ the same set of backends and priorities: Gnome user, kwallet installed but never used (possibly pulled as a dependency of some other software), on first run (i.e, when trying to read data that was not yet set) it triggers a KDE Wallet Creating UI.

I realize that after some data is set (possibly to Gnome Keyring, given my backend priorities) the KDE UI will not show anymore. But still, this first-time UI is _very_ annoying and surprising.

What's the current status on this? I mean, what should I do, as a third-party developer, to prevent this from happening with my end-users? Is there any "official" (or "blessed") workaround?

A possible approach I'm thinking for my specific software is to try to detect a first-time usage by other means (a missing config file, for example) and the set the data to a dummy/blank value before attempting to read it. That, I _think_, would avoid triggering the "backend found but no data set, let's try another backend" behavior.

Is this a good approach? Any recommendations?

_Originally posted by @MestreLion in https://github.com/jaraco/keyring/issues/391#issuecomment-773878621_

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with keyring/backends/kwallet.py around line 101 and read the discussion linked from issue 391 to understand how locked or empty backends are queried. Reproduce the first-use case with Gnome Keyring and KWallet, then define the expected backend-selection behavior or documented workaround and capture it in an appropriate test or documentation change.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.