Flatpak issues with gnome keyring after Crimson update

Ni! Update to Crimson was quite smooth, except for one thing : flatpaks that kept secrets in the Gnome keyring started complaining about an incorrect secret, and the application would refuse to start. For me this happened with Authenticator, Flare and Fractal.

I found a solution to the problem and thought it was worth documenting it here. It was caused by the way flatpak communicates with more recent gnome-keyring, using a portal, which wasn’t the case before. That is explained in detail here:

So, the way I solved the issue was to:

  1. Disable gnome-keyring-daemon, to stop the “Secret” portal
    • systemctl --user stop gnome-keyring-daemon
  2. Start the affected apps, which will work because there’s no portal
  3. Backup any data you may need to preserve (I exported my Authenticator keys)
  4. Remove the apps, purging their data
    • flatpak uninstall --delete-data ${package}
  5. Install seahorse (aka “Passwords and Keys”) and remove any keys created by the affected apps from all keyrings
  6. Restart gnome-keyring-daemon
    • systemctl --user start gnome-keyring-daemon
  7. Reinstall the apps and import the backed up data

Took me a while to figure out what was happening, so I hope this can save you the trouble.

Cheers!

7 Likes

I have the same problem on my Librem5 with Authenticator. Unfortunately the above solution does not seem to work: after I enter the command to stop the keyring daemon there is no feedback (such as ‘daemon stopped’ or anything), and the same Secret Service error message appears when I start the Authenticator.

I am not a big fan of this whole keyring thing as it is, and this doesn’t help.

Are there other solutions to this problem? I don’t mind if this includes uninstalling Seahorse and the whole keyring facility. Your help will be greatly appreciated, especially because this is the only part of the L5 I need for work.

Are you on Crimson?

Did you run the command as root?

What do you get with status instead of stop?

I am on Crimson. But I gave up on trying to get the Authenticator working again. I just removed in and installed another one: Clockodev-vlooks nice, does the job equally well.

Strange error though: when I try to fire up the camera in order to read a QR code, I get some message about a pipeline not working. (Can’t give you the exact wording just now, because my L5 is refusing to start up after the battery had been depleted; it always has to charge for hours after that before it will restart. Never a dull moment with an L5!)

My L5 decided to boot.

The error message after trying to start the camera in Clockode: “Failed to start pipeline. The element failed to change its state.”

Sorry, can’t help you much with that, I’ve never used Clockode. Since this topic is about gnome-keyring, you might get more attention if you start an on-topic thread.

So is the authenticator app working or not?

Weird error messages that are of no consequence have been part of Linux for a long time. So if you get “failed to start pipeline …” but the authenticator app works, I would ignore the error message.

The Authenticator app does work on Crimson - just prompts for keyring unlock if it wasn’t unlocked.

The Authenticator app by Bilal Elmoussaoui used to work fine - camera function and all. It did ask for the keyring to be unlocked at start up - as it should do.

After the update to Crimson, Ahthenticator complained about no Secret Service being available, and refused to start at all. Since the above solution did not work for me, I decided to just delete it and set up my 2fa codes anew.

Two years ago when I started using 2fa’s, Authenticator was one of the few - if not the only - app that worked on the L5. Because I was curious whether by now it had been joined by others, I thought I´d give Clockode a try. Turns out it works nicely, except for the camera function: the camera does not start after hitting the button in the app. I have to start up the camera myself and copy/paste the required key by hand.

I have no doubt Authenticator would have worked just as well, had I chosen to reinstall that.