GNOME Keyring MR !112 – independent Ubuntu 26.10 source validation Hello Debian GNOME maintainers,
I retrieved and reviewed the upstream GNOME gnome-keyring merge-request diff: https://gitlab.gnome.org/GNOME/gnome-keyring/-/merge_requests/112.diff Important correction to my previous RFC: the two NULL-PKCS#11 error paths I proposed for aes_negotiate() and plain_negotiate() are ALREADY present in GNOME MR !112. My earlier patch is only a subset of that MR and should not be treated as a separate competing fix. MR !112 additionally: - synchronously ensures a missing caller ServiceClient record in gkd_secret_service_get_pkcs11_session(); - ensures the record in gkd_secret_service_publish_dispatch(); - checks the boolean return plus non-NULL OpenSession output/result in service_method_open_session(), returning a proper D-Bus failure rather than allowing NULL reply values. I recreated all five functional changes against the official gnome-keyring 51.1 release source and performed an independent build and full test suite inside a disposable Ubuntu 26.10 Docker container. This was a reconstruction from the published diff, not the exact upstream Git commit. Evidence: - Source tarball SHA-256 dfe7adc5876ef0670e7eba2907799bdbb8875ce58bb4208e1a52169bd16a47ca - Source patch application guards: PASS (five target sites) - Meson configuration: PASS - Ninja compilation: PASS - meson test, non-root under dbus-run-session: 61/61 PASS, 0 failures, exit code 0 - Test binary SHA-256 165ff2bdbc0eaa249dbc470357b005a5f0143b2b461fdca53303e0454d817164 Caveats: - No deterministic missing-client OpenSession race reproducer; the standard test suite passing is not proof of race elimination. - This evidence concerns OpenSession. The originally filed Debian #1147303 involves a distinct property GET failure path; that path needs separate guards/review. - No replacement of the production password store or daemon, and no real credentials were accessed. Recommendation: prioritize review/integration of GNOME MR !112 upstream instead of duplicating its included changes. I am continuing a targeted synthetic D-Bus race regression investigation before recommending any local binary deployment. Regards, Alexander Stepanov
