{"id":22293572,"url":"https://github.com/xi/xi-keyring","last_synced_at":"2025-06-23T02:04:31.142Z","repository":{"id":231697595,"uuid":"782466124","full_name":"xi/xi-keyring","owner":"xi","description":"simple and extensible alternative for gnome-keyring","archived":false,"fork":false,"pushed_at":"2025-02-07T15:53:53.000Z","size":64,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-06-23T02:02:23.408Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/xi.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-04-05T11:08:42.000Z","updated_at":"2025-05-10T19:25:57.000Z","dependencies_parsed_at":"2024-06-01T08:50:48.714Z","dependency_job_id":"283cb79d-845e-496c-aaf4-62af5bb8ce63","html_url":"https://github.com/xi/xi-keyring","commit_stats":null,"previous_names":["xi/xi-keyring"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/xi/xi-keyring","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xi%2Fxi-keyring","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xi%2Fxi-keyring/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xi%2Fxi-keyring/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xi%2Fxi-keyring/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/xi","download_url":"https://codeload.github.com/xi/xi-keyring/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/xi%2Fxi-keyring/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261397373,"owners_count":23152487,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-12-03T17:29:42.358Z","updated_at":"2025-06-23T02:04:26.124Z","avatar_url":"https://github.com/xi.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# xi keyring\n\na simple and extensible alternative for gnome-keyring.\n\ngnome-keyring is tightly integrated into the linux desktop. There are many\nother password managers with interesting features. Just to name a few:\n[KeePassXC](https://github.com/keepassxreboot/keepassxc),\n[Bitwarden](https://bitwarden.com), [pass](https://www.passwordstore.org/), and\n[Himitsu](https://sr.ht/~sircmpwn/himitsu/). Unfortunately, none of them really\nimplement the `org.freedesktop.Secrets` dbus specification, so they cannot\ncompletely replace gnome-keyring. On the other hand, gnome-keyring itself has\naccumulated a sizable legacy, which makes it very hard to extend.\n\nSo this project tries to fill the gap:\n\n-   Work as a drop-in replacement for gnome-keyring for most common use cases\n-   Keep the code simple and extensible\n-   Experiment with new features\n\n## Threat model\n\n*As the main focus for now is experimentation, there is no fixed threat model\nyet. There are some ideas though.*\n\nWith gnome-keyring, secrets in an unlocked collection can be read by a\nmalicious application that is running on the user's desktop. This does startle\nsome users, but the developers have repeatedly explained that [there is just no\npoint in trying to protect against malicious un-sandboxed\napplications](https://gitlab.gnome.org/GNOME/gnome-keyring/-/issues/5#note_1876550).\n\nWhile I am very critical of security theater myself, I feel like there is room\nfor nuance here. These are some of the **ideas** I want to experiment with:\n\n-   Prompt the user when an application tries to access a password to provide some degree of observability\n-   Prevent malicious applications from taking memory dumps by using [`PR_SET_DUMPABLE`](https://www.man7.org/linux/man-pages/man2/prctl.2.html)\n-   Use a yubikey to store the encryption secret off-device\n-   Allow to configure access rules (always allow, always deny, prompt) per application\n-   Encrypt the meta data\n-   Keep the keyring locked as much as possible without impacting user comfort too much. For example, don't unlock automatically on login.\n-   Use separate namespaces for different applications, so one application can not access the secrets stored by another.\n\n**I am not claiming that this is or ever will be more secure than\ngnome-keyring.** The gnome-keyring developers are much more experienced with\nthis stuff than I am. For example, they have put a lot of effort into\npreventing secrets from being swapped to disk. That is not something I am even\nconsidering (partially because I rely on full disk encryption).\n\n## Deviations from the dbus specification\n\nWhile this project aims to be a drop-in replacement for gnome-keyring, some\nfeatures of the `org.freedesktop.Secrets` specification have been simplified:\n\n-   There is only a single collection (called \"it\")\n    -   Trying to create or delete a collection fails\n-   Whether the keyring is locked or not is not exposed\n    -   All objects present themselves as unlocked\n    -   The process of unlocking a keyring is transparent for the caller\n    -   The `Unlock` method fails\n    -   The `Lock` method still has an effect though\n-   Prompts are transparent for the caller. No prompt is ever returned\n-   Labels are generated automatically and cannot be changed\n-   `Created`/`Modified` is always 0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxi%2Fxi-keyring","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fxi%2Fxi-keyring","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fxi%2Fxi-keyring/lists"}