Bug 2491140

Summary:	After latest dnf update, kwallet lost Passwords
Product:	[Fedora] Fedora	Reporter:	Yves Salathe <ysa>
Component:	qtkeychain	Assignee:	Mukundan Ragavan <nonamedotc>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	44	CC:	daninshed, dietrich.moerman, eekopp, farchord, jappleii, JustAnotherWebUser, kde-sig, macieksitarz, nonamedotc, tdawson, than
Target Milestone:	---	Flags:	than: needinfo? (JustAnotherWebUser)
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Yves Salathe 2026-06-21 10:03:31 UTC

Description of problem:

I regularly update my Fedora 44 (KDE Plasma desktop version) system with `dnf update`. However, after rebooting after today's update, I was prompted for the wifi password, even though I previously stored the password in the KDE wallet. 

So I started digging with some help by an LLM: `kwallet-query -l kdewallet` returned `The folder Passwords does not exist!`.  My wallet data is still on disk in the old Blowfish format (`~/.local/share/kwalletd/kdewallet.kwl`), opened fine via `kwalletmanager5`, but showed no "Passwords" folder/entries.

However, this doesn't seem to be the main issue since I see now in the Wallet Manager (kwalletmanager5) that there is indeed a “Passwords” folder, it is just under “Network Management (2)” → “Passwords”. In the meantime I re-entered my Wifi password and thus there is now an entry with the nm UUID (after the update this entry was not there). I think the remaining question is why the password got lost after the update?


Best regards,
Yves


Version-Release number of selected component (if applicable): 

There seem to be multiple versions of kwallet installed: 
```
$ rpm -qa | grep kwallet
kf5-kwallet-libs-5.116.0-5.fc44.x86_64
kf5-kwallet-5.116.0-5.fc44.x86_64
kwalletmanager5-26.04.2-1.fc44.x86_64
signon-kwallet-extension-26.04.2-1.fc44.x86_64
kf6-kwallet-6.27.0-1.fc44.x86_64
kf6-kwallet-libs-6.27.0-1.fc44.x86_64
pam-kwallet-6.7.0-1.fc44.x86_64
```

Transaction history of dnf:
```
yves@stellaris:~$ dnf history info 219 | grep kwallet
  Upgrade  kf6-kwallet-0:6.27.0-1.fc44.x86_64         Dependency      updates
  Upgrade  kf6-kwallet-libs-0:6.27.0-1.fc44.x86_64    Dependency      updates
  Upgrade  pam-kwallet-0:6.7.0-1.fc44.x86_64          Group           updates
  Replaced kf6-kwallet-0:6.26.0-1.fc44.x86_64         Dependency      @System
  Replaced kf6-kwallet-libs-0:6.26.0-1.fc44.x86_64    Dependency      @System
  Replaced pam-kwallet-0:6.6.5-1.fc44.x86_64          Group           @System
```

How reproducible:

Didn't try to reproduce as that would involve downgrading to a prior version I guess.

Steps to Reproduce:

The following is an unverified guess:

1. install prior version of kf6-kwallet (0:6.26.0-1.fc44), kf6-kwallet-libs (0:6.26.0-1.fc44), pam-kwallet (0:6.6.5-1.fc44)
2. register a password (e.g. store a wifi password via network manager)
3. update to kf6-kwallet (0:6.27.0-1.fc44), kf6-kwallet-libs (0:6.27.0-1.fc44), pam-kwallet (0:6.7.0-1.fc44)

Actual results:

Wifi password no longer found

Expected results:

Wifi password persists after update

Additional info:


Following services are running:
```
$ systemctl --user list-units --all  | grep -i wallet
  app-kwalletmanager5\x2dkwalletd                                                            loaded    active   running   KWalletManager - Password Manager
  dbus-:1.2-org.kde.kwalletd6                                                                                               loaded    active   running   dbus-:1.2-org.kde.kwalletd6
  plasma-kwallet-pam.service                                                                                                          loaded    inactive dead      Unlock kwallet from pam credentials
```

I also noticed that  `pam-kwallet` (v6.7.0) only ships `pam_kwallet5.so`, with no `pam_kwallet.so`/v6 equivalent on disk, even though `/etc/pam.d/sddm` references both:
```
-auth     optional   pam_kwallet5.so
-auth     optional   pam_kwallet.so
```

However, only `pam_kwallet5.so` exists:
```
$ ll /usr/lib64/security/pam_kwallet*
-rwxr-xr-x. 1 root root 27824 Jun 11 02:00 /usr/lib64/security/pam_kwallet5.so
```

Could it be that `kwalletd6` can't read or properly migrate the old format of the database stored in `~/.local/share/kwalletd/`?

Note: while writing this bug report I noticed that somebody else was writing an upstream bug report for the same issue: https://bugs.kde.org/show_bug.cgi?id=521584

Comment 1 Than Ngo 2026-06-22 07:03:21 UTC

It seems a bug in plasma-nm. reassign

Comment 2 Will 2026-06-22 18:54:17 UTC

@than I believe it can be fixed by RedHat by shipping QtKeychain >= 0.16, can someone from the devs confirm this finding?

https://bugs.kde.org/show_bug.cgi?id=521595#c3

Comment 3 Than Ngo 2026-06-23 08:34:34 UTC

https://koji.fedoraproject.org/koji/taskinfo?taskID=146960439(In reply to Will from comment #2)
> @than I believe it can be fixed by RedHat by shipping QtKeychain
> >= 0.16, can someone from the devs confirm this finding?
> 
> https://bugs.kde.org/show_bug.cgi?id=521595#c3

I did scratchbuild qtkeychain-0.16.0, https://koji.fedoraproject.org/koji/taskinfo?taskID=146960439
Could you please download and test?

Thanks

Comment 4 John Apple II 2026-06-23 14:28:14 UTC

I have the exact same issue, but I've found that if I manually open the kdewallet as soon as I login, then wifi passwords will work cleanly (e.g. the kwallet stays closed upon login, unless I manually open it).  As soon as I'm at a stopping point today, I'll reboot and see if this solves the issue I'm seeing.

```
 10:15:56  ✘  user@localhost  ~  ⬡ v22.22.2  30s 
$ rpm -qa | grep qtkeychain
qtkeychain-qt6-0.15.0-3.fc44.x86_64
qtkeychain-qt5-0.15.0-3.fc44.x86_64

 10:23:38  user@localhost  ~  ⬡ v22.22.2 
$ cat /etc/redhat-release 
Fedora release 44 (Forty Four)

 10:23:45  user@localhost  ~  ⬡ v22.22.2 
$ uname -a
Linux localhost 7.0.12-201.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jun 11 01:30:16 UTC 2026 x86_64 GNU/Linux
$ sudo dnf install ./qtkeychain*
[sudo] password for jappleii: 
Updating and loading repositories:
 ....
Repositories loaded.
Package                                                         Arch           Version                                                          Repository                               Size
Upgrading:
 qtkeychain-qt5                                                 x86_64         0:0.16.0-1.fc44                                                  @commandline                        214.7 KiB
   replacing qtkeychain-qt5                                     x86_64         0:0.15.0-3.fc44                                                  <unknown>                           191.6 KiB
 qtkeychain-qt6                                                 x86_64         0:0.16.0-1.fc44                                                  @commandline                        254.2 KiB
   replacing qtkeychain-qt6                                     x86_64         0:0.15.0-3.fc44                                                  <unknown>                           231.0 KiB
Installing:
 qtkeychain-debuginfo                                           x86_64         0:0.16.0-1.fc44                                                  @commandline                        331.6 KiB
 qtkeychain-qt5-debuginfo                                       x86_64         0:0.16.0-1.fc44                                                  @commandline                          2.5 MiB
 qtkeychain-qt6-debuginfo                                       x86_64         0:0.16.0-1.fc44                                                  @commandline                          3.7 MiB

Transaction Summary:
 Installing:         3 packages
 Upgrading:          2 packages
 Replacing:          2 packages

Total size of inbound packages is 2 MiB. Need to download 0 B.
After this operation, 7 MiB extra will be used (install 7 MiB, remove 423 KiB).
...
```

Comment 5 John Apple II 2026-06-23 14:35:35 UTC

One other piece of information after the same upgrade that might point to a root cause - when I did the KDE 6.7.0 upgrade on F44, flatpaks couldn't access the secrets manager.  For example, to allow Obsidian to store secrets in the wallet, I had to run these overrides to provide flatpaks access to the secret store.  Would these potentially be linked?
```
flatpak override md.obsidian.Obsidian --user --talk-name=org.freedesktop.secrets --talk-name=org.kde.kwalletd6
flatpak override md.obsidian.Obsidian --user --env=ELECTRON_PASSWORD_STORE=gnome-libsecret
```

After those two, I restarted and Obsidian was once again able to access secrets in the wallet.

Comment 6 John Apple II 2026-06-23 18:20:32 UTC

I got time to upgraded those RPMs and reboot.  While the modal popped up again asking for my password to unlock the wallet showed, after about 1s, it went away and my wifi connected.

So it seems these qtkeychain 0.16 RPMs definitely helped - though there's still something out-of-order that's still causing the unlock request to come in before my login unlocks kwallet.