Replace gnome-keyring-daemon with oo7-daemon

bilelmoussaoui commented

2026-03-25 11:54:15 +00:00

I would like to suggest replacing gnome-keyring-daemon with oo7-daemon https://github.com/linux-credentials/oo7/tree/main/server as a Rust re-implementation of the secret service specification.

Currently fedora already ships oo7 (the client library that the daemon is built upon) along with oo7-cli, a secret-tool replacement so most of the dependencies are there already.

oo7-daemon, offers a full drop-in replacement of gnome-keyring-daemon with PAM support as well. It has good test coverage and works out of the box on both GNOME and KDE Plasma making it possible to eventually drop both gnome-keyring-daemon and kwallet.

The major difference between gnome-keyring-daemon and oo7-daemon is the keyring file format. The former uses v0 for host keyrings and v1 for sandboxed applications keyrings. The later uses v1 for both and automatically migrate v0 keyrings to v1 once the user unlocks the keyring either manually or through PAM integration.

I have also suggested doing the change at https://gitlab.gnome.org/GNOME/gnome-build-meta/-/issues/1253 for upstream GNOME. KDE iirc is also interested in using that as a replacement of kwallet as they have implemented the necessary prompting interfaces at https://invent.kde.org/mart/ksecretprompter.

Both the daemon and client library offers two cryptographic backends; one based on Rust native libraries and one based on openssl so it not be a problem to use the opeenssl based one if desired.

Please let me know if further information is needed.

I would like to suggest replacing gnome-keyring-daemon with oo7-daemon https://github.com/linux-credentials/oo7/tree/main/server as a Rust re-implementation of the secret service specification. Currently fedora already ships oo7 (the client library that the daemon is built upon) along with oo7-cli, a secret-tool replacement so most of the dependencies are there already. oo7-daemon, offers a full drop-in replacement of gnome-keyring-daemon with PAM support as well. It has good test coverage and works out of the box on both GNOME and KDE Plasma making it possible to eventually drop both gnome-keyring-daemon and kwallet. The major difference between gnome-keyring-daemon and oo7-daemon is the keyring file format. The former uses v0 for host keyrings and v1 for sandboxed applications keyrings. The later uses v1 for both and automatically migrate v0 keyrings to v1 once the user unlocks the keyring either manually or through PAM integration. I have also suggested doing the change at https://gitlab.gnome.org/GNOME/gnome-build-meta/-/issues/1253 for upstream GNOME. KDE iirc is also interested in using that as a replacement of kwallet as they have implemented the necessary prompting interfaces at https://invent.kde.org/mart/ksecretprompter. Both the daemon and client library offers two cryptographic backends; one based on Rust native libraries and one based on openssl so it not be a problem to use the opeenssl based one if desired. Please let me know if further information is needed.

👍 2

ngompa commented

2026-03-25 11:55:50 +00:00

Owner

Please also file a ticket with the KDE SIG about this. https://forge.fedoraproject.org/kde/tracker

ngompa commented

2026-03-25 11:56:39 +00:00

Owner

(This is going to have to be a coordinated Fedora 45 Change to switch, since it touches so many things.)

bilelmoussaoui referenced this issue from kde/tracker

2026-03-25 12:04:04 +00:00

Replace kwallet with oo7-daemon #700

ngompa added this to the Fedora 45 milestone

2026-03-25 12:13:46 +00:00

ngompa added the

default-apps

experience

packaging

labels

2026-03-25 12:14:04 +00:00

catanzaro added the

meeting-request

label

2026-03-25 14:41:54 +00:00

siosm commented

2026-03-25 15:07:58 +00:00

Contributor

Copying my comment from kde/tracker#700 (comment) here:

For Silverblue, it would be great to have an (automatic ideally) migration path. We might end up having to ship both in the image for a while.

Copying my comment from https://forge.fedoraproject.org/kde/tracker/issues/700#issuecomment-593192 here: For Silverblue, it would be great to have an (automatic ideally) migration path. We might end up having to ship both in the image for a while.

bilelmoussaoui commented

2026-03-26 08:30:58 +00:00

Author

we already have an automatic migration for gnome-keyring-daemon v0 format to v1.

catanzaro added

meeting

and removed

meeting-request

labels

2026-04-07 14:09:47 +00:00

catanzaro added

meeting-request

and removed

meeting

labels

2026-04-20 14:31:16 +00:00

catanzaro added

meeting

and removed

meeting-request

labels

2026-04-21 15:02:31 +00:00

catanzaro removed the

meeting

label

2026-04-28 14:40:27 +00:00

catanzaro commented

2026-04-28 14:40:51 +00:00

Owner

Discussed at today's meeting. This change is approved.

Does anybody volunteer to implement it?

Discussed at today's meeting. This change is approved. Does anybody volunteer to implement it?

ngompa commented

2026-04-28 16:50:12 +00:00

Owner

Since this needs to be coordinated with KDE too, I can work on a good chunk of it.

decathorpe commented

2026-04-29 21:55:31 +00:00

I suggest approaching the Rust SIG wrt/ packaging concerns (though hopefully this should be relatively straightforward since we already have the oo7 library and CLI packaged).

ngompa self-assigned this

2026-06-02 14:14:51 +00:00