Can't save credentials with flatpak and KDE6

[Erfboom]

I've read on here that the flatpak version of Pithos is supposed to save credentials to ~/.var/app/io.github.Pithos/data/keyrings/, however, regardless if I open Pithos using flatpak --system or flatpak --user, I type in the password and it won't save to that directory.

Using Flatseal I then try to give it talk permissions to org.freedesktop.secrets, but that seems to be depreciated(?) as the flatpak is not supposed to talk to anything outside of its immediate directory as a proper sandbox.

Using the native application built for Opensuse, the same issue occurs. I have gnome-keyring (seahorse), alongside kwallet6, which I understand is the preferred keyring manager. I open up seahorse, unlock the existing wallet with the existing Pithos credentials, try Pithos again, no dice.

I then disabled the KDEWallet system altogether thinking there might be a problem with both gnome and kde, but still no go.

Not sure where to go from here to have either application be able to access the passwords that already existed in the system. I updated my DE from kde5 to kde6 and with it the wallet, so maybe that has something to do with it?

[Erfboom]

Might be my wallet system is busted. I'll close this once I confirm.

[Erfboom]

Updating my system and doing a reboot fixed the native application not being able to access KWallet. However, the flatpak version remains the same.

[TingPing]

Unfortunately xdg-desktop-portal depends on gnome-keyring.

KWallet could in theory implement org.freedesktop.impl.portal.Secret but it doesn't currently.

[TingPing]

Using Flatseal I then try to give it talk permissions to org.freedesktop.secrets, but that seems to be depreciated(?) as the flatpak is not supposed to talk to anything outside of its immediate directory as a proper sandbox.

Adding this permission should bypass the portal and work fine. It is insecure but... oh well.

[Erfboom]

It did for a while, but it no longer does since the KDE update.

…

On Mon, Mar 18, 2024, 1:20 PM Patrick ***@***.***> wrote: Using Flatseal I then try to give it talk permissions to org.freedesktop.secrets, but that seems to be depreciated(?) as the flatpak is not supposed to talk to anything outside of its immediate directory as a proper sandbox. Adding this permission *should* bypass the portal and work fine. It is insecure but... oh well. — Reply to this email directly, view it on GitHub <#707 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANOCNB4CYVD76HCEX7LUCB3YY4O4ZAVCNFSM6AAAAABE2V3ULOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBUGUYDOOJWHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[Erfboom]

Found a fix here: #696

1. Download seahorse
2. Create a new Keyring and call it login
3. Close out of seahorse
4. Re-open it, unlock the keyring
5. Open Pithos and enter your credentials.

You should now see the passwords be entered into seahorse successfully. I chose default blowfish encryption.

Not sure if Pithos is expecting something that doesn't exist, or if the keyring in seahorse is incompatible with pithos until it's recreated.

I should note this is with the flatpak version which is now updated to 1.6.2. The credentials broke with the native app despite having previously worked a few days ago, so something in KDE was updated and is not making Pithos happy.

The fix mentioned above worked for the flatpak version.

[Erfboom]

the above fix will indeed fix the pithos password issue, but it will then break everything else. kdewallet disappears when you create a new keyring. everything else needs kdewallet, pithos needs login.

upon reboot, kdewallet will remake itself after you unlock the wallet and the keyring login will disappear.

[TingPing]

Not sure if Pithos is expecting something that doesn't exist, or if the keyring in seahorse is incompatible with pithos until it's recreated.

FWIW Pithos isn't really doing anything unique. This is all handled by the libsecret library/gnome-keyring daemon.

[Erfboom]

Right but that is currently not working with KDE. Not saying it's Pithos that broke, but on two different systems with KDE6, the flatpack can't create an encrypted credential in KDE Wallet. Up until recently, the distribution package could make a password, but now it can't create nor read the KDE wallet even if it's unlocked. Creating a new keyring fixes this problem, but then things like wifi won't be able to save credentials in the keyring Pithos likes. So is it a break in the gnome keyring daemon as it talks to KDE? Is it KDE and the permissions set on kdewallet tripping the gnome keyring up?

…

On Mon, Apr 29, 2024, 10:26 AM Patrick ***@***.***> wrote: Not sure if Pithos is expecting something that doesn't exist, or if the keyring in seahorse is incompatible with pithos until it's recreated. FWIW Pithos isn't really doing anything unique. This is all handled by the libsecret library/gnome-keyring daemon. — Reply to this email directly, view it on GitHub <#707 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANOCNBYJEP4OINEGPLJTL7DY7ZKBHAVCNFSM6AAAAABE2V3ULOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAOBSHA4TMMRZGU> . You are receiving this because you modified the open/close state.Message ID: ***@***.***>

[TingPing]

Up until recently, the distribution package could make a password, but now
it can't create nor read the KDE wallet even if it's unlocked.

AFAICT KDE 5.97.0 added org.freedesktop.secrets support to KWallet. So that is likely what introduced this issue.

Whether the bug is in KWallet or libsecret I cannot say.