Bug 2560819

I run into an issue with my Online Accounts today. I needed to revoke the Nextcloud permission and re-authenticate my account in GNOME. This normally wouldn't be a problem, you typically just wait after revocation until Online Account catches up and asks you to log in again.

However, after doing so today, i.e. revoking and re-authorizing, Online Accounts showed the "Invalid password with username "..." (goa-error-quark, 4)" error. 

Turns out the items migrated from a gnome-keyring keyring carry the attribute xdg:content-type = application/octet-stream, meanwhile the items created by Secret Service D-Bus API now carry xdg:content-type = text/plain. The oo7 MR #549 (https://github.com/linux-credentials/oo7/pull/549, fix for #541) made it so that CreateItem(replace=true) only removes items whose attributes match exactly, so the Online Accounts, after having me re-authenticate, does *not* replace the previous entry and, instad, adds a duplicate. Now, SearchItems still uses subset matching and returns the migrated item first, so secret_password_lookup() keeps returning the stale secret, making goa-daemon return an error.


Reproducible: Always

Steps to Reproduce:
1. Upgrade a system to oo7 keyring
2. Revoke the account credential on the server side (e.g. in your Nextcloud or Google account profile)
3. In Settings, Online Accounts, wait until it catches up with log-in failure (or force it with pkill -x goa-daemon), then log-in again.
4. Observe that GOA still fails to authenticate.
5. Inspect the keyring

Actual Results:
$ secret-tool search --all xdg:schema org.gnome.OnlineAccounts | grep -E '^\[|goa-identity|content-type|created'
[/48]
created = 2026-09-27 23:53:43
attribute.goa-identity = owncloud:gen0:account_1770817713_0
attribute.xdg:content-type = application/octet-stream
[/74]
created = 2026-10-26 14:21:42
attribute.goa-identity = owncloud:gen0:account_1770817713_0
attribute.xdg:content-type = text/plain

`secret-tool lookup goa-identity owncloud:gen0:account_1770817713_0` returns the secret of item 48, the migrated one.

oo7-daemon log for step 3:

INFO create_item{label="GOA owncloud credentials for identity account_1770817713_0" replace=true}: oo7::file::unlocked_keyring: Successfully created item
INFO oo7_daemon::collection: Item `/org/freedesktop/secrets/collection/login/74` created by :1.4086 (gnome-control-center[450242]).

No item is removed despite replace=true.

Expected Results:
CreateItem(replace=true) should replace an item that has the same client-supplied attributes. xdg:content-type is set by the service, not by the client, so it should either be excluded from the exact-match comparison, or the migration should assign the same content type that a fresh store produces.


Additional Information:
This was already fixed upstream in https://github.com/linux-credentials/oo7/pull/578, but hasn't been ported over to F45 nor rawhide package yet.

Workaround for the time being is to delete the migrated items by hand:
`secret-tool clear goa-identity owncloud:gen0:account_1770817713_0 xdg:content-type application/octet-stream`

Environment:
- Fedora 45, GNOME 51.1 (gnome-shell 51.1-1.fc45)
- oo7-daemon 0.7.0~beta-2.fc45, oo7-portal 0.7.0~beta-2.fc45
- gnome-online-accounts 3.58.1-4.fc45, libsecret 0.21.8.2-2.fc45