Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: Clean F44 Workstation installed, fully updated, and upgraded to F45. gnome-keyring-daemon is still running: $ ps aux | grep keyring kparal 2094 0.0 0.0 170700 5008 ? Sl 15:03 0:00 /usr/bin/gnome-keyring-daemon --daemonize --login Why is it still installed, why wasn't it autoremoved? Because of NetworkManager-vpnc-gnome. $ sudo dnf remove gnome-keyring Package Arch Version Repository Size Removing: gnome-keyring x86_64 0:51.1-1.fc45 fedora 3.5 MiB Removing dependent packages: NetworkManager-vpnc-gnome x86_64 1:1.4.0-7.fc45 fedora 149.3 KiB gnome-keyring-pam x86_64 0:51.1-1.fc45 fedora 31.4 KiB Removing unused dependencies: NetworkManager-vpnc x86_64 1:1.4.0-7.fc45 fedora 541.1 KiB libuser x86_64 0:0.64-21.fc45 fedora 1.9 MiB usermode x86_64 0:1.114-17.fc45 fedora 831.0 KiB vpnc x86_64 0:0.5.3^20241114.git11e15 fedora 230.0 KiB Is this a problem? Will it collide with oo7-daemon somehow? Create hard-to-debug cases? Is it expected according to this Change? https://fedoraproject.org/wiki/Changes/oo7_Secrets_Service_Provider Version-Release number of selected component (if applicable): gnome-keyring-51.1-1.fc45.x86_64 gnome-keyring-pam-51.1-1.fc45.x86_64 oo7-daemon-0.7.0~beta-1.fc45.x86_64 pam_oo7-0.7.0~beta-1.fc45.x86_64 oo7-portal-0.7.0~beta-1.fc45.x86_64 How reproducible: always Steps to Reproduce: 1. clean F44 Workstation install 2. full update 3. system upgrade to F45
> Why is it still installed, why wasn't it autoremoved? Because of NetworkManager-vpnc-gnome. No, there is no "autoremove" happening on upgrade, so even without a dependency from NM-vpnc-gnome, it would still be there. > Is this a problem? Maybe? > Will it collide with oo7-daemon somehow? Possibly? > Create hard-to-debug cases? Likely! > Is it expected according to this Change? Probably not.
gnome-keyring should be removed. Also, even more critically, NetworkManager-vpnc and NetworkManager-vpnc-gnome should be too: https://forge.fedoraproject.org/fesco/tickets/issues/3693
We discussed this a little in the Workstation WG meeting today. I don't think gnome-keyring can be _retired_ yet anyway: ``` $ frpq 45 --wr gnome-keyring | grep -v i686 | grep -v gnome-keyring | grep -v testing NetworkManager-vpnc-gnome-1.4.0-7.fc45.x86_64 (f45-development) bubblemail-1.12-5.fc45.x86_64 (f45-development) gnome-flashback-3.58.0-4.fc45.x86_64 (f45-development) mailnag-2.2.0-26.fc45.noarch (f45-development) mate-control-center-1.28.2-2.fc45.x86_64 (f45-development) $ frpq 45 --wr gnome-keyring-pam | grep -v i686 | grep -v gnome-keyring | grep -v testing cinnamon-6.7.8^unstable-6.fc45.x86_64 (f45-development) cinnamon-screensaver-6.7.1^unstable-2.fc45.x86_64 (f45-development) mate-screensaver-1.28.1-2.fc45.x86_64 (f45-development) sugar-0.121-11.fc45.noarch (f45-development) $ frpq 45 --wr gnome-keyring-sharp | grep -v i686 | grep -v gnome-keyring gnome-do-0.95.3-33.fc45.x86_64 (f45-development) gnome-rdp-0.3.1.0-40.fc45.x86_64 (f45-development) ```
The announcement for this change should have been better worded. I saw the title and didn't bother reading it. https://discussion.fedoraproject.org/t/f45-change-proposal-oo7-secrets-service-provider-system-wide/195274 A major change like this should have included 'replaces gnome-keyring'
How does this beta software start? leigh@mpd-pc:~$ rpm -qa *\keyring\* python3-keyring-25.7.0-9.fc45.noarch python3-keyring+completion-25.7.0-9.fc45.noarch gnome-keyring-51.1-1.fc45.x86_64 gnome-keyring-pam-51.1-1.fc45.x86_64 leigh@mpd-pc:~$ rpm -qa *\oo7\* oo7-daemon-0.7.0~beta-1.fc45.x86_64 oo7-portal-0.7.0~beta-1.fc45.x86_64 pam_oo7-0.7.0~beta-1.fc45.x86_64 leigh@mpd-pc:~$ systemctl status --user oo7-daemon ○ oo7-daemon.service - Secret service (oo7 implementation) Loaded: loaded (/usr/lib/systemd/user/oo7-daemon.service; disabled; preset: disabled) Drop-In: /usr/lib/systemd/user/service.d └─10-timeout-abort.conf Active: inactive (dead) leigh@mpd-pc:~$ The change doesn't include directions for use? https://fedoraproject.org/wiki/Changes/oo7_Secrets_Service_Provider#How_To_Test
(In reply to Jens Petersen from comment #3) > We discussed this a little in the Workstation WG meeting today. > > I don't think gnome-keyring can be _retired_ yet anyway: > Maybe it's removal should be delayed to F46+ > $ frpq 45 --wr gnome-keyring-pam | grep -v i686 | grep -v gnome-keyring | > grep -v testing > cinnamon-6.7.8^unstable-6.fc45.x86_64 (f45-development) > cinnamon-screensaver-6.7.1^unstable-2.fc45.x86_64 (f45-development) > mate-screensaver-1.28.1-2.fc45.x86_64 (f45-development) > sugar-0.121-11.fc45.noarch (f45-development) It seems Neil missed some, cinnamon pr submitted. https://github.com/linuxmint/cinnamon/pull/14062 cinnamon-screensaver is orphaned. https://github.com/linuxmint/cinnamon-screensaver/pull/522
(In reply to Michael Catanzaro from comment #2) > gnome-keyring should be removed. > > Also, even more critically, NetworkManager-vpnc and > NetworkManager-vpnc-gnome should be too: > https://forge.fedoraproject.org/fesco/tickets/issues/3693 How does workstation enable oo7, I can't find any preset that enables it in f45.
The service is not enabled in Workstation, it seems to be dynamically started by some other mechanism.
https://gitlab.gnome.org/GNOME/gnome-session/-/commit/034f0ac5b9844b5d890c42073d7adb2e1443d053 is how GNOME does it.
So the initial issue here - with NetworkManager plugins - was resolved, I believe, by https://bodhi.fedoraproject.org/updates/FEDORA-2026-683cb404da But the discussion has shifted to "should something try to outright ensure gnome-keyring gets removed?" and "what about Cinnamon?" so it seems a bit messy, and it's not clear what (if anything) a freeze exception is being requested for. Could somebody summarize and clarify the current status? What's this bug for, what needs fixing where, is an FE needed? Thanks.
I wasn't sure about the impact of keeping gnome-keyring installed and running. It seems nobody is and what to do about it. I'll leave this for the Workstation to respond, but otherwise let's drop the FE request.
AGREED Delayed Decision (Punt) Discussed at the 2026-10-19 (blocker / freeze exception) review meeting: It's not entirely clear what an FE is being requested for, here. We've asked for clarification in the bug and will vote as appropriate if a clear FE request emerges. https://meetbot-raw.fedoraproject.org//blocker-review_matrix_fedoraproject-org/2026-10-19/f45-blocker-review.2026-10-19-16.00.log.txt
Removing gnome-keyring is part of the change proposal. It doesn't make sense to have two competing keyring daemons installed. If this is not implemented, then the contingency plan should be activated.
I have updated the original FESCo ticket: https://forge.fedoraproject.org/fesco/tickets/issues/3640#issuecomment-1367469 Michael, if you can follow-up with FESCo on the technical discussion, that would be great.
FEDORA-2026-18973b259d (cinnamon-6.7.9^unstable-7.fc45, cinnamon-control-center-6.7.7^unstable-1.fc45, and 8 more) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-18973b259d
(In reply to Adam Williamson (Fedora) from comment #10) > So the initial issue here - with NetworkManager plugins - was resolved, I > believe, by https://bodhi.fedoraproject.org/updates/FEDORA-2026-683cb404da > > But the discussion has shifted to "should something try to outright ensure > gnome-keyring gets removed?" and "what about Cinnamon?" so it seems a bit > messy, and it's not clear what (if anything) a freeze exception is being > requested for. > > Could somebody summarize and clarify the current status? What's this bug > for, what needs fixing where, is an FE needed? > > Thanks. Cinnamon now has full working oo7 support apart from broken ssh keyring unlock on Xorg only, see The ssh issue is likely to affect all Xorg desktops https://src.fedoraproject.org/rpms/xorg-x11-xinit/pull-request/8 Has anyone notified the Mate maintainer? he will need to find a way to start oo7-daemon to have working support.
(In reply to Adam Williamson (Fedora) from comment #9) > https://gitlab.gnome.org/GNOME/gnome-session/-/commit/ > 034f0ac5b9844b5d890c42073d7adb2e1443d053 is how GNOME does it. Thanks. https://src.fedoraproject.org/rpms/cinnamon-session/c/60dd860ff24a2a7030b5e773165724515da69a8e?branch=rawhide
+4 / -1 in https://forge.fedoraproject.org/quality/blocker-review/issues/2225 , marking accepted FE.
Oh, right, there was another thing - we also found we needed to get it to run during gnome-initial-setup in order for wifi configuration to work: https://bugzilla.redhat.com/show_bug.cgi?id=2540692 . I don't know whether Cinnamon has any kind of initial setup thingy, but if it does, you might need to mirror that also.
(In reply to Adam Williamson (Fedora) from comment #19) > I don't know whether > Cinnamon has any kind of initial setup thingy, but if it does, you might > need to mirror that also. There is none, cinnamon relies on anaconda for this.
Filed https://bugzilla.redhat.com/show_bug.cgi?id=2556316 for MATE.
FEDORA-2026-18973b259d has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-18973b259d` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-18973b259d See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
I verified the described bug ("clean F44->F45 upgrade still contains gnome-keyring-daemon running") is fixed in F45 RC2. I did find https://bugzilla.redhat.com/show_bug.cgi?id=2558595 during testing, though.
FEDORA-2026-18973b259d (cinnamon-6.7.9^unstable-8.fc45, cinnamon-control-center-6.7.7^unstable-1.fc45, and 10 more) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.