The keyring

etyde-keyring is the session’s keyring. It answers to org.freedesktop.secrets on the session bus: the Secret Service, which is where programs keep passwords — browsers and anything else built on libsecret, git’s credential helper, mail programs. Netbird’s saved passwords and cookies are locked with a key kept here.

The file

There is one keyring, login, in ~/.local/share/etyde/keyring/login.keyring.

In the file, what says which secret is which (its name and attributes) is plain; each secret is locked on its own with AES-256-GCM, under a key made from the password with scrypt. So a locked keyring can tell whether it has what a program asks for, and asks to be opened only then.

The password is the login password

• At login, the login screen hands the password over in memory, readable by that user alone. The keyring reads it as the session starts, removes it, and is open. The first time, that is also how the keyring is made.
• Without that (logged in with no password, or a keyring made elsewhere) it asks once, when a program first needs it, in etyDE’s own password window. A new keyring only takes the login password, so that logging in opens it from then on.
• When the password is changed, PAM runs the same helper and the running keyring is locked anew with the new one. etyde-keyring change-password does it by hand, given the old and the new.

What it does not do

• Secrets cross the bus the “plain” way only. The session bus is the user’s own, and so is every program on it.
• There is one collection. A program that asks for another is given this one.
• On a machine where another desktop’s keyring already serves the session, this one leaves it to it.