F45 Change Proposal: oo7 Secrets Service Provider (system-wide)

Project Discussion Change Proposals
,
1

oo7 Secrets Service Provider

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Wiki
Announced

:link: Summary

Switch the default Secrets Service provider for Fedora desktops from KWallet and GNOME Keyring to oo7.

:link: Owner

:link: Current status

  • Targeted release: Fedora Linux 45
  • Last updated: 2026-06-30
  • [ Announced]
  • [ Discussion thread]
  • FESCo issue:
  • Tracker bug:
  • Release notes tracker:

:link: Detailed Description

A new universal secrets storage system has been developed in the form of oo7 that replaces KWallet’s backend and GNOME Keyring. Package up oo7-daemon and associated support code and change the Fedora default secrets storage backend to it across all desktops.

:link: Feedback

:link: Benefit to Fedora

The idea with this new secrets storage system is to support a new model for credentials where scoped authorization is possible for applications and services. Additionally, it opens the door for mediating access to FIDO2-based authentication mechanisms. This lends itself well to enabling limited trust to secrets for sandboxed applications, among other things. KDE Plasma, COSMIC, and GNOME (among others) are all converging on this and so enabling this allows Fedora to remain at the forefront of supporting desktop technologies.

:link: Scope

  • Proposal owners:

    • Package oo7-daemon, PAM module, and other support code
    • Add oo7 PAM module to relevant PAM configs where gnome-keyring and kwallet PAM modules are listed
    • Adjust comps to replace gnome-keyring with oo7-daemon
    • Adjust dependencies in desktops to use oo7 instead of gnome-keyring

  • Other developers: N/A (not needed for this Change)

  • Release engineering: #13405

  • Policies and guidelines: N/A (not needed for this Change)

  • Trademark approval: N/A (not needed for this Change)

  • Alignment with the Fedora Strategy: N/A (not needed for this Change)

:link: Upgrade/compatibility impact

The oo7 service will automatically migrate existing data from GNOME Keyring and KWallet, so no user interaction is required to handle the transition.

:link: How To Test

Once oo7-daemon and related code are packaged and updated configuration lands in Rawhide, users can test this simply by upgrading and using things that leverage the secrets service like normal.

:link: User Experience

This is expected to be fairly transparent to the user.

:link: Dependencies

This will involve updating the PAM configuration files for the desktops and login managers used across Fedora deliverables.

:link: Contingency Plan

  • Contingency mechanism: Revert swap to oo7 and defer to the next release
  • Contingency deadline: Beta freeze
  • Blocks release? Yes

:link: Documentation

More information about oo7 is present in the upstream project documentation.

:link: Release Notes

Fedora Linux now uses the oo7 as the default secrets service provider, replacing older solutions like GNOME Keyring. This brings enhanced security to secrets management, particularly for sandboxed applications, and enables FIDO2 authentication secrets.

Last edited by @amoloney 2026-06-30T17:27:41Z

Last edited by @amoloney 2026-06-30T17:27:41Z

1 Like
2

How do you feel about the proposal as written?

  • Strongly in favor
  • In favor, with reservations
  • Neutral
  • Opposed, but could be convinced
  • Strongly opposed
0 voters

If you are in favor but have reservations, or are opposed but something could change your mind, please explain in a reply.

We want everyone to be heard, but many posts repeating the same thing actually makes that harder. If you have something new to say, please say it. If, instead, you find someone has already covered what you’d like to express, please simply give that post a :heart: instead of reiterating. You can even do this by email, by replying with the heart emoji or just “+1”. This will make long topics easier to follow.

Please note that this is an advisory “straw poll” meant to gauge sentiment. It isn’t a vote or a scientific survey. See About the Change Proposals category for more about the Change Process and moderation policy.

3

This change proposal has now been submitted to FESCo with ticket #3640 for voting.

To find out more, please visit our Changes Policy documentation.