Migrating to oo7

Desktop Environments Plasma
1

Since oo7 seems like it may be the future for secrets storage, I tried replacing kwallet and kwalletmanager with oo7 and keepsecret.

It was a bit of a manual process, but it now seems to be working fine.

Ultimately, I have nothing interesting to report. I did it and it works but since it isn’t something you generally interact with on a regular basis, I don’t notice anything different.

In theory, it supports scoped keys which limits secrets access when using flatpaks but I am not sure how to easily verify that.

2

In Fedora 45 they are moving to oo7 as well!

3

I’ve been looking at replacing kwallet since it doesn’t always unlock in time to keep Vorta backup from giving an error. Keep us posted on oo7. :detective:

4

I tried this, but python-proton-keyring-linux is an issue, it has gnome-keyring as a hard depend.

5

Wanna do a write up on how you replaced it. I gave it a try myself months back, but failed. Currently I am using greetd along side this project https://git.sr.ht/~kennylevinsen/pam_fde_boot_pw to unlock kwallet on login.

6

I don’t remember every step but the basics were:

  • Install oo7 and keepsecret
  • Disable kwallet in system settings
  • Kill the kwalletd and secretd services
  • Import the secrets from kwallet(which also created the wallet)
  • Start and enable the oo7 daemon service
  • Open up keepsecret
  • Edit the pam configs for passwd and plasmalogin
7

I did migrate my PC to 007 last week when I installed gnome51 from gnome-unstable. It was pretty straight forward. I had to remove the gnome-keyring package and I had to create an extra PAM config file for gdm:

# cat /etc/pam.d/gdm-password

#%PAM-1.0

auth       include                     system-local-login
auth       optional                    pam_oo7.so

account    include                     system-local-login

password   include                     system-local-login
password   optional                    pam_oo7.so use_authtok

session    include                     system-local-login
session    optional                    pam_oo7.so auto_start

After that, oo7 works. Unfortunately the old gnome-keyring is lost during that process. I had to enter all the passwords again. E.g. evolution email client was asking for the passwords again. But that was ok.

And signal-messenger was not starting anymore without gnome-keyring. I had to start signal-messenger all over again: remove the old connection to my phone, add a new connection and allow it to copy all chat history.

Other than that oo7 works seamless. I do not notice a difference.

8

Thanks for the help, but alas with me using autologin with greetd. None of it worked. I ended up having to sidestep pam altogether and use systemd instead.

For anyone interested in going down this path, basically use systemd to store the login password encrypted and oo7 will look for that assuming that it has the correct name.

Just a couple lines in bash actually.

mkdir -p ${XDG_CONFIG_HOME:-~/.config}/credstore.encrypted
systemd-ask-password -n | systemd-creds encrypt --user \
    --name=oo7.keyring-encryption-password - \
    ${XDG_CONFIG_HOME:-~/.config}/credstore.encrypted/oo7.keyring-encryption-password