From a1e0875eb4d28425c7e78890357d2dfd4e9e5ac5 Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Sun, 19 Jul 2026 18:07:02 -0700 Subject: [PATCH] Pin browser password store to gnome-libsecret (#6065) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Chromium-based browsers auto-detect their os_crypt backend at launch. On Hyprland the xdg-desktop-portal Secret backend has no provider, so the autodetect can fall back to the 'basic' (v10) store, making previously v11-encrypted cookies and saved passwords undecryptable — the user is silently logged out of everything. Pin gnome-libsecret (the stock omarchy keyring) so the backend is deterministic, matching what we already do for VSCode. Migration covers chromium, brave, chrome, and edge flags confs for existing installs. Co-authored-by: Niklas Tscheppe Co-Authored-By: Claude Fable 5 --- config/chromium-flags.conf | 1 + migrations/1784508556.sh | 13 +++++++++++++ 2 files changed, 14 insertions(+) create mode 100644 migrations/1784508556.sh diff --git a/config/chromium-flags.conf b/config/chromium-flags.conf index 134fa04e..5edf16a7 100644 --- a/config/chromium-flags.conf +++ b/config/chromium-flags.conf @@ -1,4 +1,5 @@ --ozone-platform=wayland --ozone-platform-hint=wayland +--password-store=gnome-libsecret --enable-features=TouchpadOverscrollHistoryNavigation --load-extension=/usr/share/omarchy/default/chromium/extensions/copy-url,/usr/share/omarchy/default/chromium/extensions/yt-dlp diff --git a/migrations/1784508556.sh b/migrations/1784508556.sh new file mode 100644 index 00000000..7859fd01 --- /dev/null +++ b/migrations/1784508556.sh @@ -0,0 +1,13 @@ +echo "Pin browser password store to gnome-libsecret (prevents cookie/login loss on Hyprland)" + +# Chromium-based browsers auto-detect their os_crypt backend; on Hyprland the xdg-desktop-portal +# Secret backend has no provider and fails, so they can fall back to the 'basic' (v10) store. +# A swap from the gnome-libsecret (v11) key to the basic key makes existing cookies and saved +# passwords undecryptable, so the browser silently drops them and the user is logged out of +# everything. Pin gnome-libsecret so the backend is deterministic across reboots and updates. +for conf in ~/.config/{chromium,brave,chrome,microsoft-edge-stable}-flags.conf; do + if [[ -f $conf ]] && ! grep -q -- '--password-store=' "$conf"; then + [[ -n $(tail -c1 "$conf") ]] && echo >>"$conf" + echo '--password-store=gnome-libsecret' >>"$conf" + fi +done