[SOLVED] Secret-service Issues

[shrike]

EDIT_1: Router issue. Not a Gentoo issue.

Background:

For several years I have used app-admin/keepassxc for password management. As I am now using an other app for password management I 'depcleaned' keepassxc and thereafter odd behavior with web browsers began. For example, when I open the Brave browser a pop-up asks for a password. I use LibreWolf too, no password pop-up but more like "Is this a Public or Private PC". Then I realized keepassxc is more than a password manager and down the Secret-Service rabbit hole I went. :)

Code: Select all

$ cat /var/db/repos/gentoo/virtual/secret-service/secret-service-0.ebuild
# Copyright 1999-2025 Gentoo Authors
# Distributed under the terms of the GNU General Public License v2

EAPI=7

DESCRIPTION="Virtual for a freedesktop.org Secret Service API provider"
SLOT="0"
KEYWORDS="~alpha amd64 arm arm64 ~loong ~mips ppc ppc64 ~riscv ~sparc x86 ~amd64-linux ~x86-linux ~ppc-macos"

RDEPEND="|| (
	gnome-base/gnome-keyring
	app-admin/keepassxc
)"
# TODO: add the KDE provider here once ready, there are still problems as of August 2023 though
# (see https://bugs.kde.org/show_bug.cgi?id=458085)

Maybe re-install app-admin/keepassxc and depclean gnome-base/gnome-keyring:

Code: Select all

 eix keepassx
[I] app-admin/keepassxc
     Available versions:  2.7.10-r1^t **9999*l^t {X autotype browser doc keeshare +keyring +network +ssh-agent test yubikey}
     Installed versions:  2.7.10-r1^t(03:28:04 PM 09/15/2025)(X keyring network ssh-agent yubikey -autotype -browser -doc -keeshare -test)
     Homepage:            https://keepassxc.org
     Description:         KeePassXC - KeePass Cross-platform Community Edition

Code: Select all

 # emerge --ask --verbose --depclean gnome-base/gnome-keyring

Calculating dependencies... done!
  gnome-base/gnome-keyring-48.0 pulled in by:
    app-crypt/pinentry-1.3.2-r1 requires gnome-base/gnome-keyring
    virtual/secret-service-0 requires gnome-base/gnome-keyring

>>> No packages selected for removal by depclean

Any advice would be appreciated.

Thanks.

[alamahant]

Do you need all these secret service bs?
If not the way to go is add

Code: Select all

gnome-base/gnome-keyring-46.2
or
gnome-base/gnome-keyring-48 #for ~arch system

in

Code: Select all

/etc/portage/profile/package.provided

Then unmerge or depclean gnome-base/gnome-keyring
and you are done!
Plus you can install keepassxc for normal use.
This is how I have it and I dont get these annoying passwd prompts anymore.

[shrike]

alamahant,

Thanks for your suggestion. I have been pondering 'package.provided'.. some have expressed qualms: https://forums.gentoo.org/viewtopic-t-1069622.html

Do you need all these secret service bs?

I don't know. 'virtual/secret-service-0' is a dependency of both app-admin/keepassxc-2.7.10-r1 and gnome-base/gnome-keyring-48.0 yet I cannot 'depclean' gnome-base/gnome-keyring-48.0.

I have learned that the gnome-keyring authentication password can get out of sync with the current user, I used an older user password successfully yet Brave still seems ridiculously slow opening streaming sites.

Other ideas I have to check.

Thank you.

[Hu]

package.provided is frequently abused when users think they know the dependency requirements better than the packager. While they may be right sometimes, usually it is the wrong solution.

You read the output backward. virtual/secret-service requires one-of keepassxc or gnome-keyring. What is the output of emerge --pretend --verbose --depclean virtual/secret-service gnome-base/gnome-keyring app-admin/keepassxc? Are you sure that removing gnome-keyring is the solution to your browser problem?

[shrike]

Hu,

Code: Select all

 $ emerge --pretend --verbose --depclean virtual/secret-service gnome-base/gnome-keyring app-admin/keepassxc

Calculating dependencies... done!
  gnome-base/gnome-keyring-48.0 pulled in by:
    app-crypt/pinentry-1.3.2-r1 requires gnome-base/gnome-keyring
    virtual/secret-service-0 requires gnome-base/gnome-keyring

  virtual/secret-service-0 pulled in by:
    app-crypt/libsecret-0.21.7 requires =virtual/secret-service-0, virtual/secret-service

>>> Calculating removal order...

>>> These are the packages that would be unmerged:

 app-admin/keepassxc
    selected: 2.7.10-r1 
   protected: none 
     omitted: none 

All selected packages: =app-admin/keepassxc-2.7.10-r1

>>> 'Selected' packages are slated for removal.
>>> 'Protected' and 'omitted' packages will not be removed.

Packages installed:   945
Packages in world:    99
Packages in system:   50
Required packages:    944
Number to remove:     1

Are you sure that removing gnome-keyring is the solution to your browser problem?

No.

Another thought is to restore a backup I have from July (2025) and have a looksee.

Thank you.

[tholin]

I had a similar problem because gnome-keyring was pulled in by app-crypt/pinentry. I worked around the problem by rebuilding pinentry without the gtk use flag and I could then depclean away gnome-keyring.

[dmpogo]

The sequence of dependecies is

1) virtual/secret-service depends on either gnome-keyring or keepassxc, having one of the two installed should satisfy this depends

Something depends on secret-service, on my machine this app-crypt/libsecret, so

2) app-crypt/libsecret depends on virtual/secret-service

Now what depends on libsecret ? On my machine, this is

3)

Code: Select all

equery depends libsecret
 * These packages depend on libsecret:
app-crypt/gcr-3.41.2-r1 (>=app-crypt/libsecret-0.20)
                        (>=app-crypt/libsecret-0.20)
app-crypt/pinentry-1.3.2-r1 (keyring ? app-crypt/libsecret)
                            (keyring ? app-crypt/libsecret)
app-editors/vscode-1.104.0 (app-crypt/libsecret[crypt])
dev-vcs/git-2.49.1 (keyring ? app-crypt/libsecret)
                   (keyring ? app-crypt/libsecret)
dev-vcs/subversion-1.14.5-r2 (keyring ? app-crypt/libsecret)
                             (keyring ? app-crypt/libsecret)
kde-frameworks/kwallet-runtime-6.16.0 (legacy-kwallet ? app-crypt/libsecret)
                                      (legacy-kwallet ? app-crypt/libsecret)
media-video/vlc-3.0.21_p20250217-r3 (keyring ? app-crypt/libsecret)
                                    (keyring ? app-crypt/libsecret)

so unconditionally this is vscode and gcr, though for kwallet-runtime the USE flag legacy-kwallet is not yet exposed to users.
So I am stuck here for now.

4) If I would not use kde or vscode, only gcr would be left, what depends on gcr ? It is

Code: Select all

equery depends gcr
 * These packages depend on gcr:
app-crypt/pinentry-1.3.2-r1 (gtk ? app-crypt/gcr:4[gtk])
gnome-base/gnome-keyring-46.2 (>=app-crypt/gcr-3.27.90:0[gtk])
                              (>=app-crypt/gcr-3.27.90:0[gtk])

So if I can install pinentry with USE='-gtk', I should be able to clear out the whole secret-service stack. Which provides for password encryption

[shrike]

@tholin, @dmpogo,

I will review your suggestions later today hopefully. USE="-gtk" looks promising to the goal of depcleaning gnome-keyring thereby allowing keepassxc instead.

This is a shot in the dark in any event. It may simply be coincidental that my 'web browser' issues started after keepassxc removal.

Within the rabbit hole I did come across mention of KDE (wallet) work towards secret-service use IIRC. Just an aside.

Thank you.

[shrike]

Hello Gentoo,

Just a status report to close out this thread:

So my problem was solved by setting my older Netgate router to default configuration. Around the time of my OP I had increased ISP bandwidth from 100Mb/s to 300. I hadn't noticed issues till I depcleaned keepassxc. Or so it seemed. Long/Short, Pfsense reported Packet loss with VPN, but no Packet loss w/o VPN.

This is not a linux issue, it is a user error issue. :oops:

Thanks.