Improve keyring detection #587

christoph-blessing commented 2024年05月22日 16:39:01 +02:00 (Migrated from github.com)

Hi,

I am using the password manager KeepassXC and its secret service integration. The password manager saves changes immediately and because I am using a Yubikey as a second factor I have to touch the key every time changes are saved. This means that every time eduvpn saves something to the keyring I have to touch the Yubikey which would not be a problem if it happened rarely but it happens literally every time I invoke the cli (even just eduvpn-cli --help). This is annoying and seems unnecessary.

I took a look at the source code and the behavior I described seems to be caused by the way eduvpn checks whether or not the keyring is available. It seems to test this by saving something to the keyring, reading it and then deleting it [1].

Would it be possible to change the keyring detection such that it doesn't save something to the keyring or have that check only happen when necessary?

[1] github.com/eduvpn/python-eduvpn-client@1d37f56d07/eduvpn/keyring.py (L63)

PS: One workaround I know of is to invoke the cli with an empty DBUS session address, i.e. DBUS_SESSION_BUS_ADDRESS= eduvpn-cli

Hi, I am using the password manager KeepassXC and its secret service integration. The password manager saves changes immediately and because I am using a Yubikey as a second factor I have to touch the key every time changes are saved. This means that every time eduvpn saves something to the keyring I have to touch the Yubikey which would not be a problem if it happened rarely but it happens literally every time I invoke the cli (even just `eduvpn-cli --help`). This is annoying and seems unnecessary. I took a look at the source code and the behavior I described seems to be caused by the way eduvpn checks whether or not the keyring is available. It seems to test this by saving something to the keyring, reading it and then deleting it [1]. Would it be possible to change the keyring detection such that it doesn't save something to the keyring or have that check only happen when necessary? [1] https://github.com/eduvpn/python-eduvpn-client/blob/1d37f56d07d142b6cffa00d00329ad5fcc05f47e/eduvpn/keyring.py#L63 PS: One workaround I know of is to invoke the cli with an empty DBUS session address, i.e. `DBUS_SESSION_BUS_ADDRESS= eduvpn-cli`

jwijenbergh commented 2024年05月23日 14:23:12 +02:00 (Migrated from github.com)

Would it be possible to change the keyring detection such that it doesn't save something to the keyring or have that check only happen when necessary?

As far as I know this is not possible. the best way is to try the keyring, which is what we're doing. As far as I could find this is most commonly what linux applications do. Any other approaches are welcome of course, but this is the best I could find

> Would it be possible to change the keyring detection such that it doesn't save something to the keyring or have that check only happen when necessary? As far as I know this is not possible. the best way is to try the keyring, which is what we're doing. As far as I could find this is most commonly what linux applications do. Any other approaches are welcome of course, but this is the best I could find

christoph-blessing commented 2024年05月23日 15:42:46 +02:00 (Migrated from github.com)

In that case would it be possible to check less often? To me at least some of the checks seem unnecessary like for example eduvpn-cli --help.

In that case would it be possible to check less often? To me at least some of the checks seem unnecessary like for example `eduvpn-cli --help`.

jwijenbergh commented 2024年05月23日 15:56:53 +02:00 (Migrated from github.com)

In that case would it be possible to check less often? To me at least some of the checks seem unnecessary like for example eduvpn-cli --help.

That's a good point. I will think about some solutions for the next version

> In that case would it be possible to check less often? To me at least some of the checks seem unnecessary like for example `eduvpn-cli --help`. That's a good point. I will think about some solutions for the next version

jwijenbergh commented 2024年05月30日 18:26:17 +02:00 (Migrated from github.com)

leaving this open until the fix is in the release. The fix is that for the CLI it only does the test run when the keyring is needed for the first time. for the GUI it does it when the UI is open

leaving this open until the fix is in the release. The fix is that for the CLI it only does the test run when the keyring is needed for the first time. for the GUI it does it when the UI is open

jwijenbergh commented 2024年06月05日 10:35:18 +02:00 (Migrated from github.com)

New version is released

New version is released