Fallback to kernel keyring when Linux Secret Service is unavailable#637
Open
bharris-devoted wants to merge 1 commit into
Open
Fallback to kernel keyring when Linux Secret Service is unavailable#637bharris-devoted wants to merge 1 commit into
bharris-devoted wants to merge 1 commit into
Conversation
jack-edmonds-dd
previously approved these changes
Jul 7, 2026
This comment has been minimized.
This comment has been minimized.
On Linux, when the DBus Secret Service (org.freedesktop.secrets) is not available, fall back to the kernel keyring (keyutils) before resorting to file storage. This gives headless/container environments secure in-memory credential storage without requiring a running secret service daemon. Fallback chain: Secret Service → kernel keyring → file storage
bharris-devoted
force-pushed
the
feat/keychain-fallback-dbus-serviceunknown
branch
from
2f132de to
0cc3660
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
On Linux, when the DBus Secret Service (
org.freedesktop.secrets) is not available, pup now falls back to the kernel keyring (keyutils) before resorting to file storage.Fallback chain: Secret Service → kernel keyring → file storage
Why
On headless Linux environments (containers, SSH sessions without a desktop, CI runners), the Secret Service daemon is typically absent. Previously this caused a hard error during
auth login:#627 mistakenly assumed that keychain.rs would gracefully fallback. It does not andf the latest
pup authdoes not work on Linux systems with no DBus service available.Changes
KeychainStorage::new()now performs a read probe on Linux (not just entry construction) to detect Secret Service unavailability earlydetect_backend_with()on Linux: when the first probe fails, switches the keyring credential builder to keyutils and retries before falling through to file storagelinux_keychain_probe_result()helper for testabilityTesting
cargo checkpassesDBUS_SESSION_BUS_ADDRESS=unix:path=/missing pup auth statusnow prints warning and falls back to kernel keyring