Package: evolution-data-server
Version: 3.56.2-0+deb13u1
Followup-For: Bug #1037108
Dear Maintainer,
I run KDE Plasma 6 on Debian Trixie. kwalletd6 was my sole secret
service provider, with credentials accumulated over years stored in its
wallet (~/.local/share/kwalletd/kdewallet.kwl). Installing evolution-ews
pulled in evolution-data-server, which hard-depends on gnome-keyring.
This led to the following
1. gnome-keyring's package installs a systemd user unit
(gnome-keyring-daemon.socket, WantedBy=sockets.target) which is
preset-enabled and starts unconditionally at login, regardless of
desktop environment. Note that the XDG autostart file correctly carries
OnlyShowIn=GNOME;Unity;MATE; — but the systemd unit has no equivalent
guard and ignores OnlyShowIn entirely.
2. At the next login, gnome-keyring-daemon started before kwalletd6 and
claimed the org.freedesktop.secrets D-Bus name, because the D-Bus
activation file
/usr/share/dbus-1/services/org.freedesktop.secrets.service hardcodes
gnome-keyring, and the systemd socket is activated earlier in the boot
sequence than kwalletd6's PAM-based startup.
3. Applications using libsecret (OTPClient, GitHub CLI, GitHub Copilot
CLI) could no longer find their credentials, which remained in
kwalletd6's wallet. They prompted for re-authentication. Therefore
credentials gradually accumulated in gnome-keyring, while the originals
remained stranded in kwalletd6 — two divergent credential stores with no
automatic reconciliation.
This is user-visible data loss in the sense that previously accessible
credentials become inaccessible without any warning.
The proposed fix (gnome-keyring | kwallet6 | libkf5wallet-bin |
keepassxc- full, as suggested by Roman Lebedev) would have prevented
this , since kwalletd was already satisfying the secret service role.
A related active bug: #1131636 reports that gnome-keyring's postinst
unmasks gnome-keyring-daemon.socket on every package upgrade, overriding
deliberate user decisions to disable it.
Thanks!
Carsten
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.95+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE,
TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE
not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages evolution-data-server depends on:
ii evolution-data-server-common 3.56.2-0+deb13u1
ii gnome-keyring 48.0-1
ii libc6 2.41-12+deb13u3
ii libcamel-1.2-64t64 3.56.2-0+deb13u1
ii libcanberra-gtk3-0 0.30-18
ii libcanberra0 0.30-18
ii libdb5.3t64 5.3.28+dfsg2-9
ii libebackend-1.2-11t64 3.56.2-0+deb13u1
ii libebook-1.2-21t64 3.56.2-0+deb13u1
ii libebook-contacts-1.2-4t64 3.56.2-0+deb13u1
ii libecal-2.0-3 3.56.2-0+deb13u1
ii libedata-book-1.2-27t64 3.56.2-0+deb13u1
ii libedata-cal-2.0-2t64 3.56.2-0+deb13u1
ii libedataserver-1.2-27t64 3.56.2-0+deb13u1
ii libedataserverui-1.2-4t64 3.56.2-0+deb13u1
ii libglib2.0-0t64 2.84.4-3~deb13u3
ii libgoa-1.0-0b 3.54.5-1~deb13u1
ii libgtk-3-0t64 3.24.49-3
ii libgweather-4-0t64 4.4.4-1
ii libical3t64 3.0.20-1+b1
ii libjson-glib-1.0-0 1.10.6+ds-2
ii libldap2 2.6.10+dfsg-1
ii libpango-1.0-0 1.56.3-1
ii libsecret-1-0 0.21.7-1
ii libsoup-3.0-0 3.6.5-3
ii libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3
evolution-data-server recommends no packages.
Versions of packages evolution-data-server suggests:
ii evolution 3.56.2-0+deb13u1
-- no debconf information
