rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

quickshell: unlock login keyring on lockscreen unlock

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-08-22 10:21:03 +01:00
parent c93d908cfa
commit bdefae41bc
1 changed files with 31 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

33
settings/quickshell.nix
View file

@ -635,6 +635,31 @@ in
onExited: code => { if (code === 0) lock.locked = true; }
}
// Chromium/Electron apps ask the Secret Service for their
// credentials as soon as they launch — spotify autostarts, so
// it hit gcr's unlock dialog every boot. The login keyring is
// still locked at that point: greetd's autologin gave
// pam_gnome_keyring no password to stash, and PamContext only
// runs pam_authenticate, never the session phase that
// auto_start unlocks from. So feed the daemon the password
// ourselves once PAM has accepted it.
//
// --unlock without --replace reaches the daemon already
// running over its control socket; --replace would kill it and
// drop the clients that connected first. No trailing newline:
// the daemon reads stdin to EOF and doesn't strip one.
Process {
id: keyringUnlock
property string secret: ""
command: [ "${pkgs.gnome-keyring}/bin/gnome-keyring-daemon", "--unlock" ]
onStarted: {
write(secret);
secret = "";
// EOF, or the daemon blocks on that read forever.
stdinEnabled = false;
}
}
PamContext {
id: pam
// NixOS ships a "login" pam service; pam_unix verifies the
@ -644,9 +669,13 @@ in
if (this.responseRequired) this.respond(root.password);
}
onCompleted: result => {
if (result === PamResult.Success) {
keyringUnlock.secret = root.password;
keyringUnlock.stdinEnabled = true;
keyringUnlock.running = true;
lock.locked = false;
} else root.failed = true;
root.password = "";
if (result === PamResult.Success) lock.locked = false;
else root.failed = true;
}
}