Skip to content
Fedora Community Docs
Fedora
Docs networkNetwork
Search Fedora

    Browse this documentation

    oo7 in Fedora 45: the desktop secret service changed implementation

    Fedora 45 unifies the desktop secret service on oo7 (official ChangeSet: oo7 Secrets Service Provider). This is not “one more package” — it takes over the org.freedesktop.secrets D-Bus name, previously provided by gnome-keyring.

    Evidence: who provides the secret service

    Section titled “Evidence: who provides the secret service”
    Terminal window
    rpm -q oo7-cli oo7-daemon oo7-portal
    ls -l /usr/lib/systemd/user/dbus-org.freedesktop.secrets.service
    rpm -qf /usr/lib/systemd/user/dbus-org.freedesktop.secrets.service
    rpm -q gnome-keyring
    oo7-cli-0.7.0~beta-2.fc45.x86_64
    oo7-daemon-0.7.0~beta-2.fc45.x86_64
    oo7-portal-0.7.0~beta-2.fc45.x86_64
    

    /usr/lib/systemd/user/dbus-org.freedesktop.secrets.service -> oo7-daemon.service
    

    oo7-daemon-0.7.0~beta-2.fc45.x86_64
    

    package gnome-keyring is not installed

    Three conclusions:

    1. dbus-org.freedesktop.secrets.service is a symlink pointing at oo7-daemon.service;
    2. the link is owned by the oo7-daemon package;
    3. gnome-keyring is gone on F45.

    The ~beta in the version matters too: F45 ships a beta of 0.7.0.

    What the three packages do

    Section titled “What the three packages do”
    Terminal window
    cat /usr/lib/systemd/user/oo7-daemon.service
    [Unit]
    Description=Secret service (oo7 implementation)
    

    [Service]
    Type=dbus
    BusName=org.freedesktop.secrets
    StandardError=journal
    ExecStart=/usr/libexec/oo7-daemon
    PackageProvidesRole
    oo7-daemonoo7-daemon.service, dbus-org.freedesktop.secrets.serviceimplements the Secret Service and holds the D-Bus name
    oo7-portaloo7-portal.service, /usr/libexec/oo7-portalportal backend for sandboxed applications
    oo7-cli/usr/bin/oo7-clicommand-line access to the keyring

    Type=dbus plus BusName= is the key: the daemon starts only when a client asks for org.freedesktop.secrets. That explains why systemctl status oo7-daemon is normally inactive (dead) — it is activated on demand, not resident.

    Reading and writing with oo7-cli

    Section titled “Reading and writing with oo7-cli”
    Terminal window
    oo7-cli --help
    oo7-cli --version
    System keyring access from the terminal
    

    Commands:
      delete  lookup  search  store  list  lock  unlock  repair  change-secret
    

    oo7-cli 0.7.0-beta

    Storing an entry (the arguments are positional, not --label / --attribute):

    Terminal window
    oo7-cli store t1 app=x -s hello

    The daemon log confirms it:

    INFO create_item{label="t1" replace=true}: oo7::file::unlocked_keyring: Successfully created item

    A dependency you should know about

    Section titled “A dependency you should know about”

    oo7-cli list and oo7-cli lookup fail in an environment without a systemd user session:

    Activating service name='org.freedesktop.systemd1' ... failed: Process org.freedesktop.systemd1 exited with status 1

    The reason: the daemon reaches for org.freedesktop.systemd1.Manager (for lock and unlock management), and a bare D-Bus session has no user-level systemd.

    What it means in practice: store works, list and lookup need a real login session. In automation over SSH or in containers, confirm systemctl --user works first (loginctl enable-linger).

    Post-upgrade migration checklist

    Section titled “Post-upgrade migration checklist”
    1. rpm -q oo7-daemon gnome-keyring — the first present, the second gone;
    2. ls -l /usr/lib/systemd/user/dbus-org.freedesktop.secrets.service — pointing at oo7-daemon.service;
    3. open a passwords-and-keys tool and confirm the default keyring is there and readable;
    4. exercise one application that stores credentials (browser, mail, Git credential helper) to verify read and write;
    5. on auto-login machines, reboot and confirm unlock still happens automatically.

    Evidence boundary

    Section titled “Evidence boundary”

    The package layout, the D-Bus name takeover and a successful oo7-cli store were all measured on F45. Migration behaviour in a desktop session, automatic unlock and SSH agent integration were not tested end to end — the lab has no Workstation desktop session. Verify those on your own desktop with the checklist above.

    Section titled “Related pages”