Public bug reported: [ Impact ]
With KeePassXC as the Secret Service provider and "Confirm when passwords are retrieved by clients" ticked, gh fails within about 30 ms with "no oauth token found for github.com" and shows no prompt. With the option off, or with upstream gh 2.103.2, it works. Reproduced on Ubuntu 26.04.1 LTS with gh 2.46.0-4ubuntu0.26.04.1~esm1 and KeePassXC 2.7.10. The official upstream gh 2.46.0 binary, which embeds go-keyring v0.2.4, fails the same way. packages.ubuntu.com lists gh 2.46.0-4 for stonking, 2.46.0-3 for questing and 2.45.0 for noble. I tested only 26.04. [ Root cause ] With confirmation on, KeePassXC locks each item separately, so a client must unlock the item before reading it. go-keyring 0.2.4 unlocks only the collection. On dbus-monitor, 2.46.0 sends Item.GetSecret and gets Secret.Error.IsLocked back in under 60 microseconds, with no item-level Unlock. Upstream 2.103.2, which embeds go-keyring v0.2.8, sends Service.Unlock on the item, waits for the prompt, then reads the secret. Upstream go-keyring PR 108, commit 14b7cd2, adds the item unlock. It was merged on 2024-06-06 and released in v0.2.5. gh 2.46.0-4 build-depends on golang-github-zalando-go-keyring-dev >= 0.2.4. Ubuntu and Debian both package the library at 0.2.4-1, and Debian's tracker flags 0.2.8 as available. A fixed library plus a gh rebuild delivers the fix. [ Test Plan ] 1. Install KeePassXC. Enable Secret Service Integration and tick "Confirm when passwords are retrieved by clients". 2. Run gh auth login -h github.com, then gh auth token. Before the fix, gh prints "no oauth token found for github.com", exits 1 and shows no prompt. After the fix, KeePassXC prompts, and approving it prints the token and exits 0. 3. Repeat with gnome-keyring as the provider. Behaviour must not change. [ Where problems could occur ] The fix makes the client unlock any item reported as locked before reading it, so a provider that used to return an error may now show an unlock prompt. I expect gnome-keyring to behave as before, since upstream's CI runs against it, but I have not tested that. Updating the library to 0.2.8 instead of patching 0.2.4 would also bring unrelated upstream changes and affect every other package built from that library. [ Proposed fix ] Cherry-pick commit 14b7cd2 as a patch to golang-github-zalando-go- keyring and rebuild gh. Updating the library package and rebuilding gh also works. SRU policy needs the development series fixed first. [ Other Info ] go-keyring PR 108: https://github.com/zalando/go-keyring/pull/108 KeePassXC report of the same symptom: https://github.com/keepassxreboot/keepassxc/issues/9334 Misleading "no oauth token found" message in gh: https://github.com/cli/cli/issues/13317 Workarounds are unticking the confirm option, using the cli.github.com apt repository, or using an upstream release binary. System details Ubuntu 26.04.1 LTS Installed: gh 2.46.0-4ubuntu0.26.04.1~esm1 Origin: https://esm.ubuntu.com/apps/ubuntu resolute-apps-security ubuntu-bug gh refused to file this report because it does not treat the ESM package as an official Ubuntu package, so I filed it through the web form. ** Affects: gh (Ubuntu) Importance: Undecided Status: New ** Affects: golang-github-zalando-go-keyring (Debian) Importance: Unknown Status: Unknown ** Bug watch added: Debian Bug tracker #1152144 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1152144 ** Also affects: gh (Debian) via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1152144 Importance: Unknown Status: Unknown ** No longer affects: gh (Debian) ** Also affects: golang-github-zalando-go-keyring (Debian) via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1152144 Importance: Unknown Status: Unknown -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172205 Title: gh 2.46.0 cannot read its token from KeePassXC when confirm on retrieve is on, because go-keyring 0.2.4 never unlocks the item To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gh/+bug/2172205/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
