Build libsecret without gcrypt #756

bbhtt · 2024-09-29T11:08:38Z

If you previously had basic storage, run it as flatpak run --env=SIGNAL_PASSWORD_STORE=gnome-libsecret org.signal.Signal and check if it's storing in the keyring correctly.

flathubbot · 2024-09-29T11:09:43Z

Started test build 150490

flathubbot · 2024-09-29T11:16:27Z

Build 150490 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/133582/org.signal.Signal.flatpakref

minosimo · 2024-09-29T11:31:35Z

On Fedora 40 this works.

minosimo · 2024-09-29T11:48:29Z

We should use the keyring as default again, and if it's possible, also recover the key from the app_id org.signal.Signal entry if it exists.

salim-b · 2024-09-29T11:49:23Z

Nice! With this change, SIGNAL_PASSWORD_STORE=gnome-libsecret now works for me on Ubuntu 22.04 (gnome-keyring: 40.0).

secret-tool search application Signal now gives:

[/45]
label = Chromium Safe Storage
secret = yadayadayada
created = 2024-09-29 11:43:38
modified = 2024-09-29 11:43:38
schema = chrome_libsecret_os_crypt_password_v2
attribute.application = Signal

Does that mean, the underlying issue was on the libsecret side of things and not Electron's or Signal's fault?

bermeitinger-b · 2024-09-29T12:24:42Z

It's nice that it's working.

If it was not working with Gnome before, what's the point of flatpak? It's supposed to be agnostic and be able to run anywhere.

Doesn't Ubuntu provide this library, or is it outdated maybe?

I recommend a bit more testing, especially without the env var and its checking, so that it defaults to use the keyring if available, just like upstream.

salim-b · 2024-09-29T12:31:20Z

If it was not working with Gnome before, what's the point of flatpak? It's supposed to be agnostic and be able to run anywhere.

I guess this is just yet another part that is not (yet) agnostic.

Doesn't Ubuntu provide this library, or is it outdated maybe?

> apt info libsecret-1-0
Package: libsecret-1-0
Version: 0.20.5-2
Priority: optional
Section: libs
Source: libsecret
Origin: Ubuntu
Maintainer: Ubuntu Developers <[email protected]>
Original-Maintainer: Debian GNOME Maintainers <[email protected]>
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Installed-Size: 439 kB
Depends: libc6 (>= 2.14), libgcrypt20 (>= 1.9.0), libglib2.0-0 (>= 2.59.0), libsecret-common
Breaks: seahorse (<< 3.10)
Homepage: https://wiki.gnome.org/Projects/Libsecret
Task: ubuntu-desktop-minimal, ubuntu-desktop, ubuntu-desktop-raspi, kubuntu-desktop, kubuntu-full, xubuntu-core, xubuntu-desktop, lubuntu-desktop, ubuntustudio-desktop, ubuntukylin-desktop, ubuntu-mate-core, ubuntu-mate-desktop, ubuntu-budgie-desktop, ubuntu-budgie-desktop-raspi
Download-Size: 124 kB
APT-Manual-Installed: yes
APT-Sources: http://ch.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
Description: Secret store
 Library for storing and retrieving passwords and other secrets.
 It communicates with the "Secret Service" using DBus.

bbhtt · 2024-09-29T12:31:31Z

libsecret uses a file based backend inside Flatpak specifically which is incompatible with how Chromium tries to use it. Disabling this compiles out that backend and it reverts to the usual DBus backend same as how it works outside Flatpak.

We should use the keyring as default again, and if it's possible, also recover the key from the app_id org.signal.Signal entry if it exists.

I don't think it's possible to do that

bbhtt · 2024-09-29T12:36:18Z

The library was already present through the electron baseapp btw but it isn't compiled with -Dgcrypt=false, it uses the upstream default.

salim-b · 2024-09-29T13:49:45Z

Great research @bbhtt, I guess!

libsecret uses a file based backend inside Flatpak specifically which is incompatible with how Chromium tries to use it.

Are the upstream (Electron/Chromium) devs aware of this?

The library was already present through the electron baseapp btw but it isn't compiled with -Dgcrypt=false, it uses the upstream default.

With "electron baseapp", you're referring to this repo? Any specific reason to not add the -Dgcrypt=false compilation flag to this base app rather than Signal here?

flathubbot · 2024-09-29T13:50:42Z

Started test build 150509

bbhtt · 2024-09-29T13:53:45Z

I don't know if chromium/electron developers are aware, but libsecret has an issue open for a long time https://gitlab.gnome.org/GNOME/libsecret/-/issues/49 The fix is for Chromium to use the proper API.

With "electron baseapp", you're referring to this repo? Any specific reason to not add the -Dgcrypt=false compilation flag to this base app rather than Signal here?

There is no migration path between the backends, switching the backend will mean the app cannot retrieve the secrets anymore.

Electron baseapp was using gcrypt backend ever since its inception. Disabling it now and switching it will break any app that depends on it.

It doesn't matter for signal because it was using plain text before.

flathubbot · 2024-09-29T13:57:22Z

Build 150509 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/133602/org.signal.Signal.flatpakref

This uses the Dbus backend instead of the file based ones under Flatpak

flathubbot · 2024-09-29T15:29:23Z

Started test build 150532

pm4rcin · 2024-09-29T15:33:31Z

Not sure if it's related but Tutanota Flatpak that's based on Electron creates dummy entry in keyring because of the bug in Chromium. Not sure if it's related to this bug but here's the text of the entry:

Because of quirks in the gnome libsecret API, Chrome needs to store a dummy entry to guarantee that this keyring was properly unlocked. More details at http://crbug.com/660005.

bbhtt · 2024-09-29T15:34:43Z

No that's unrelated.

flathubbot · 2024-09-29T15:34:55Z

Build 150532 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/133625/org.signal.Signal.flatpakref

salim-b · 2024-09-29T19:18:15Z

I don't know if chromium/electron developers are aware, but libsecret has an issue open for a long time https://gitlab.gnome.org/GNOME/libsecret/-/issues/49 The fix is for Chromium to use the proper API.

The relevant discussion (this thread) happended almost 3 years ago. There was no further activity in the issue after that. Hence I'd consider it plausible that Chromium/Electron development never got a scent of this...

rugk · 2024-09-30T20:57:57Z

So then open an issue with Electron or what is preventing you from doing that?

I don't know the technical details well enough here to describe the problem, so it would be great if one of you could do it.

salim-b · 2024-09-30T22:07:11Z

So then open an issue with Electron or what is preventing you from doing that?

Expertness, mainly. But I tried my best: https://issues.chromium.org/issues/370535829 (the original culprit is Chromium, not Electron, if I'm not mistaken).

ramcq · 2024-09-30T22:11:35Z

@bbhtt This works here. Thanks v. much!

BentHaase · 2024-10-01T10:02:53Z

@bbhtt Works for me, F40 👍

mbridon · 2024-10-17T14:47:24Z

So, Signal now works for me, but it takes insanely long to start, like, I started Signal about an hour ago and it's still not up with the window visible yet. 🤯

Running it in the command line I see this:

$ flatpak run org.signal.Signal 
Debug: Using password store: gnome-libsecret
Debug: Will run signal with the following arguments: --password-store=gnome-libsecret
Debug: Additionally, user gave: 
Set Windows Application User Model ID (AUMID) { AUMID: 'org.whispersystems.signal-desktop' }
NODE_ENV production
NODE_CONFIG_DIR /app/Signal/resources/app.asar/config
NODE_CONFIG {}
ALLOW_CONFIG_MUTATIONS undefined
HOSTNAME lappy
NODE_APP_INSTANCE undefined
SUPPRESS_NO_CONFIG_WARNING undefined
SIGNAL_ENABLE_HTTP undefined
userData: /home/bochecha/.var/app/org.signal.Signal/config/Signal
config/get: Successfully read user config file
config/get: Successfully read ephemeral config file
making app single instance
LaunchProcess: failed to execvp:
xdg-settings
LaunchProcess: failed to execvp:
xdg-settings
Gtk-Message: 10:13:01.677: Failed to load module "pk-gtk-module"
Gtk-Message: 10:13:01.679: Failed to load module "pk-gtk-module"

And that's pretty much it, it doesn't go any further than that, but sometimes I eventually see the window at some point. 😕

So I left it hanging for several hours and it wouldn't do anything, then hit ctrl+c to kill it and restarted the same command, and now the window opened just fine. 🤷

minosimo · 2024-10-26T11:45:53Z

bot build

Aha, that doesn't work in PRs I guess. Are the expired test builds still available anywhere?

RayJW · 2024-10-26T12:28:11Z

Aha, that doesn't work in PRs I guess. Are the expired test builds still available anywhere?

bot, build

You need the comma for it to work.

flathubbot · 2024-10-26T12:28:13Z

Queued test build for org.signal.Signal.

flathubbot · 2024-10-26T12:28:25Z

Started test build 157016

flathubbot · 2024-10-26T12:31:33Z

Build 157016 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/140104/org.signal.Signal.flatpakref

flathubbot · 2024-10-26T14:05:08Z

Started test build 157026

flathubbot · 2024-10-26T14:08:13Z

Build 157026 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/140113/org.signal.Signal.flatpakref

flathubbot · 2024-11-01T12:48:12Z

Started test build 158290

flathubbot · 2024-11-01T12:55:03Z

Build 158290 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/141375/org.signal.Signal.flatpakref

p-fruck · 2024-11-13T08:45:28Z

would be great if we could get this merged. There should be no downsides to non-gnome users I think, and gnome users will be able to finally utilize the safeStorage API. Thanks a lot for your investigation @bbhtt!

flathubbot · 2024-11-13T08:54:44Z

Started test build 161704

flathubbot · 2024-11-13T09:11:13Z

Build 161704 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/144774/org.signal.Signal.flatpakref

sebasmonia · 2024-11-19T13:36:50Z

bot, build

flathubbot · 2024-11-19T13:36:53Z

Queued test build for org.signal.Signal.

flathubbot · 2024-11-19T13:37:05Z

Started test build 163206

flathubbot · 2024-11-19T13:39:25Z

Build 163206 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/146276/org.signal.Signal.flatpakref

flathubbot · 2024-11-19T15:31:33Z

Started test build 163231

flathubbot · 2024-11-19T15:35:33Z

Build 163231 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/146301/org.signal.Signal.flatpakref

calexandru2018 · 2024-11-22T13:06:13Z

Indeed this solves the issue. Honestly have no clue why this wasn't considered in the very beginning. Most of the distros come either with gnome-keyring or KDE pre-installed. Leaving a simple text-file should've been only in the case that these systems are not support, as leaving everything unencrypted is a major privacy flaw. Can confirm that for me on F41 this issue is finally solved, thanks @bbhtt for fixing this, have build the signal app from this MR is and it's working flawlessly!

pm4rcin · 2024-11-22T14:36:13Z

@bbhtt is there anything felt to do until it's merged? It appears that it works for people including me.

flathubbot · 2024-11-22T14:53:31Z

Started test build 163943

flathubbot · 2024-11-22T15:06:47Z

Build 163943 successful
To test this build, install it from the testing repository:

flatpak install --user https://dl.flathub.org/build-repo/147023/org.signal.Signal.flatpakref

fluoriteByte · 2024-11-23T13:41:27Z

this latest version is working fine, i wonder what's taking so long for this to get merged

bbhtt marked this pull request as draft September 29, 2024 11:08

bbhtt marked this pull request as ready for review September 29, 2024 11:34

bbhtt mentioned this pull request Sep 29, 2024

Signal encryption keyring changed from gnome_libsecret to basic_text #753

Open

bbhtt force-pushed the bbhtt/test-libsecret branch from 117ef20 to 9df1b09 Compare September 29, 2024 13:23

Provide libsecret without crypto backend

2caf105

This uses the Dbus backend instead of the file based ones under Flatpak

bbhtt force-pushed the bbhtt/test-libsecret branch from 9df1b09 to 2caf105 Compare September 29, 2024 15:28

This was referenced Oct 1, 2024

Database Error #723

Open

v7.24.1 is Breaking database signalapp/Signal-Desktop#7029

Open

Merge branch 'master' into bbhtt/test-libsecret

9efc4e8

Merge branch 'master' into bbhtt/test-libsecret

aab666f

czhang03 mentioned this pull request Nov 10, 2024

GitHub Extension Requests Authentication Every Time on Gnome flathub/com.vscodium.codium#379

Closed

Merge branch 'master' into bbhtt/test-libsecret

a8865de

Merge branch 'master' into bbhtt/test-libsecret

0c88f5c

Merge branch 'master' into bbhtt/test-libsecret

b5306ce

Build libsecret without gcrypt #756

Are you sure you want to change the base?

Build libsecret without gcrypt #756

Conversation

bbhtt commented Sep 29, 2024 • edited Loading

flathubbot commented Sep 29, 2024

flathubbot commented Sep 29, 2024

minosimo commented Sep 29, 2024

minosimo commented Sep 29, 2024 • edited Loading

salim-b commented Sep 29, 2024 • edited Loading

bermeitinger-b commented Sep 29, 2024

salim-b commented Sep 29, 2024

bbhtt commented Sep 29, 2024 • edited Loading

bbhtt commented Sep 29, 2024

salim-b commented Sep 29, 2024

flathubbot commented Sep 29, 2024

bbhtt commented Sep 29, 2024 • edited Loading

flathubbot commented Sep 29, 2024

flathubbot commented Sep 29, 2024

pm4rcin commented Sep 29, 2024

bbhtt commented Sep 29, 2024

flathubbot commented Sep 29, 2024

salim-b commented Sep 29, 2024

rugk commented Sep 30, 2024 • edited Loading

salim-b commented Sep 30, 2024

ramcq commented Sep 30, 2024

BentHaase commented Oct 1, 2024

mbridon commented Oct 17, 2024

minosimo commented Oct 26, 2024 • edited Loading

RayJW commented Oct 26, 2024

flathubbot commented Oct 26, 2024

flathubbot commented Oct 26, 2024

flathubbot commented Oct 26, 2024

flathubbot commented Oct 26, 2024

flathubbot commented Oct 26, 2024

flathubbot commented Nov 1, 2024

flathubbot commented Nov 1, 2024

p-fruck commented Nov 13, 2024

flathubbot commented Nov 13, 2024

flathubbot commented Nov 13, 2024

sebasmonia commented Nov 19, 2024

flathubbot commented Nov 19, 2024

flathubbot commented Nov 19, 2024

flathubbot commented Nov 19, 2024

flathubbot commented Nov 19, 2024

flathubbot commented Nov 19, 2024

calexandru2018 commented Nov 22, 2024 • edited Loading

pm4rcin commented Nov 22, 2024

flathubbot commented Nov 22, 2024

flathubbot commented Nov 22, 2024

fluoriteByte commented Nov 23, 2024

bbhtt commented Sep 29, 2024 •

edited

Loading

minosimo commented Sep 29, 2024 •

edited

Loading

salim-b commented Sep 29, 2024 •

edited

Loading

bbhtt commented Sep 29, 2024 •

edited

Loading

bbhtt commented Sep 29, 2024 •

edited

Loading

rugk commented Sep 30, 2024 •

edited

Loading

minosimo commented Oct 26, 2024 •

edited

Loading

calexandru2018 commented Nov 22, 2024 •

edited

Loading