mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-10 19:27:03 +01:00
Krzysztof kuhy Rudnicki
ec2da0b575
Some checks are pending
dependency freshness / dependencies on newest stable (push) Waiting to run
md-naming / markdown naming convention (push) Waiting to run
Pre-commit checks / pre-commit (push) Waiting to run
Python tests / test (push) Waiting to run
Shell tests / shell-tests (push) Waiting to run
Shell tests / arch-tests (push) Waiting to run
`secret-tool lookup` is non-interactive — on a locked keyring it returns nothing and shows no dialog — and a busctl Unlock+Prompt pair cannot work either, because Secret Service prompt objects die with the D-Bus connection that created them. secretstorage keeps one connection: get_default_collection().unlock() pops the gcr dialog and blocks until it is answered. Verified on the real profile: 5 v11 rows -> v10, then with the keyring re-locked Helium (through the wrapper, so the flags file and LeechBlock apply) lists all 5 logins and keeps every row. `pgrep -f /opt/helium-browser-bin` also matched the invoking shell when its argv mentioned the path, so the guard refused on an idle machine; now anchored to `^/opt/helium-browser-bin/`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01M8YGXVZdNUG79q5DGsdMm3
39 lines
3.0 KiB
JSON
39 lines
3.0 KiB
JSON
{
|
|
"intent": "Make migrate_helium_passwords_to_basic.py actually work on the user's box: the first version handed back twice never showed the keyring dialog, and the running-Helium guard false-positived on an idle machine.",
|
|
"scope": [
|
|
"linux_configuration/installers/migrate_helium_passwords_to_basic.py (unlock via secretstorage; anchored process check)",
|
|
"linux_configuration/installers/verify_helium.py (anchored process check)",
|
|
"linux_configuration/installers/install_helium.sh (+python-secretstorage dep)",
|
|
".pre-commit-config.yaml pylint deps, meta/requirements.txt (+secretstorage 3.5.0)"
|
|
],
|
|
"changes": [
|
|
"`secret-tool lookup` is non-interactive: on a locked keyring it returns nothing and shows no dialog. A busctl Unlock+Prompt sequence also cannot work because Secret Service prompt objects die with the connection that created them. secretstorage keeps one D-Bus connection: get_default_collection().unlock() pops the gcr dialog and blocks until answered.",
|
|
"`pgrep -f /opt/helium-browser-bin` matched the invoking shell whose argv mentioned the path, so the guard reported Helium running on an idle machine; the pattern is now anchored to `^/opt/helium-browser-bin/`."
|
|
],
|
|
"verification": [
|
|
{
|
|
"command": "linux_configuration/installers/migrate_helium_passwords_to_basic.py (run by Claude, user answered the gcr dialog)",
|
|
"result": "pass",
|
|
"evidence": "keyring is locked — answer the unlock dialog on screen; backup: Default/Login Data.pre-basic-20260920-182556; converted 5 v11 -> v10 rows; 0 already v10; added --password-store=basic to ~/.config/helium-browser-flags.conf"
|
|
},
|
|
{
|
|
"command": "keyring re-locked via Secret.Service.Lock; /usr/local/bin/helium-browser (wrapper) on the real profile under Xvfb; chrome://password-manager/passwords deep-text; chrome://version command line; /json/list",
|
|
"result": "pass",
|
|
"evidence": "all 5 sites listed (kuhy-cloud.duckdns.org, google.com, typeracer.com, leetcode.com, infakt.pl); command line has --password-store=basic and the LeechBlock --load-extension; uBO background_page present; keyring still locked afterwards; Login Data still 5 rows, all v10 (nothing deleted on read)"
|
|
},
|
|
{
|
|
"command": "pre-commit run --files <changed files> (in the commit worktree)",
|
|
"result": "pass",
|
|
"evidence": "ruff, ruff-format, pylint, shellcheck, codespell, file-length, dependency-freshness green"
|
|
}
|
|
],
|
|
"risks": [
|
|
"secretstorage's unlock() blocks with no timeout until the dialog is answered or dismissed; the script says so on stdout before it blocks.",
|
|
"The backup file Login Data.pre-basic-<ts> still holds the v11 (keyring-encrypted) blobs; it is useless without the keyring key and can be deleted once the user is happy."
|
|
],
|
|
"rollback": [
|
|
"Restore Default/'Login Data.pre-basic-20260920-182556' over 'Login Data' and remove --password-store=basic from ~/.config/helium-browser-flags.conf.",
|
|
"Validate: Helium prompts for the keyring again and the 5 logins decrypt after unlock."
|
|
]
|
|
}
|