Repository navigation
fix(keyring): require the Secret Service on Linux instead of the kernel keyring - #273
Merged
Merged
Conversation
…el keyring
@napi-rs/keyring 2.1.0 tries the Secret Service first and silently falls back
to the kernel keyutils store when it fails. On 2026-10-21 a locked
gnome-keyring answered "DBus error: Did not receive a reply": reads of stored
secrets returned null with no hint, and a write went to kernel memory that a
reboot clears. Nothing threw, so Credentials never used its file.
systemKeyring now passes { linux: { store: "secret-service" } }, so the
binding throws and Credentials' auto mode warns once and falls back to its
0600 file. The warning now says the keyring could not be reached (locked, or
no keyring service) rather than "storing in", which was wrong on a read.
Release 0.47.5.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This was referenced Oct 20, 2026
leemour
added a commit
to WireCatLabs/tg-cli
that referenced
this pull request
Oct 20, 2026
Raises the exact cli-base pin to 0.47.5 (WireCatLabs/cli-base#273): the Linux keyring uses only the Secret Service; a locked or unreachable keyring warns and uses the credentials file instead of silently falling back to kernel memory. Checked: pnpm why shows one cli-base copy (0.47.5), shared with cli-core. lint, typecheck, test green. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
leemour
added a commit
to WireCatLabs/max-cli
that referenced
this pull request
Oct 20, 2026
Raises the exact cli-base pin to 0.47.5 (WireCatLabs/cli-base#273): the Linux keyring uses only the Secret Service; a locked or unreachable keyring warns and uses the credentials file instead of silently falling back to kernel memory. Checked: pnpm why shows one cli-base copy (0.47.5), shared with cli-core. lint, typecheck, test green. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Measured 2026-10-21 on the owner's Linux desktop: the Secret Service answered
DBus error: Did not receive a reply(gnome-keyring probably locked).@napi-rs/keyring2.1.0 then silently fell back to the kernel keyutils store (its README, "Linux backend selection"):null, so tg said "app credentials missing" for every profile with no reason given;secret-tool), which a reboot clears;Credentials'autofallback (warn once, use the 0600 file) never ran.What
systemKeyringbuilds everyEntrywith{ linux: { store: "secret-service" } }(the binding'sLinuxEntryOptions; ignored off Linux). A Secret Service failure now throws, andCredentialswarns and uses its file. An absent entry still returnsnull.could not reach the OS keyring — it may be locked, or no keyring service is running (<binding error>); using <file> instead, readable only by youCredentialswarn and use the file. No real keychain touched.Watch for
A Linux machine with no Secret Service but a working kernel keyring now uses the credentials file. A secret written to the kernel keyring by an earlier version is no longer read.
pnpm lint,pnpm typecheck,pnpm test(775 passed) green locally.🤖 Generated with Claude Code