{"record":{"id":"5d530cc41794fc83","repo":"git-ecosystem/git-credential-manager","slug":"failed-to-open-secret-service-session","errorCode":null,"errorMessage":"Failed to open secret service session","messagePattern":"Failed to open secret service session","errorType":"exception","errorClass":"InteropException","httpStatus":null,"severity":"critical","filePath":"src/Core/Interop/Linux/SecretServiceCollection.cs","lineNumber":342,"sourceCode":"\r\n            sb.Append(service);\r\n            return sb.ToString();\r\n        }\r\n\r\n        private static unsafe SecretService* GetSecretService()\r\n        {\r\n            // Get a handle to the default secret service, open a session,\r\n            // and load all collections\r\n            SecretService* service = secret_service_get_sync(\r\n                SecretServiceFlags.SECRET_SERVICE_OPEN_SESSION | SecretServiceFlags.SECRET_SERVICE_LOAD_COLLECTIONS,\r\n                IntPtr.Zero, out GError* error);\r\n\r\n            if (error != null)\r\n            {\r\n                int code = error->code;\r\n                string message = Marshal.PtrToStringAuto(error->message)!;\r\n                g_error_free(error);\r\n                throw new InteropException(\"Failed to open secret service session\", code, new Exception(message));\r\n            }\r\n\r\n            return service;\r\n        }\r\n\r\n        private static SecretSchema GetSchema()\r\n        {\r\n            var schema = new SecretSchema\r\n            {\r\n                name = SchemaName,\r\n                flags = SECRET_SCHEMA_DONT_MATCH_NAME,\r\n                attributes = new SecretSchemaAttribute[32]\r\n            };\r\n\r\n            schema.attributes[0] = new SecretSchemaAttribute\r\n            {\r\n                name = ServiceAttributeName,\r\n                type = SECRET_SCHEMA_ATTRIBUTE_STRING\r","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Core/Interop/Linux/SecretServiceCollection.cs#L324-L360","documentation":"GetSecretService opens a session with the Secret Service via secret_service_get_sync (or equivalent). If the call returns a GError it frees it and throws an InteropException carrying the daemon's code and message, meaning no keyring session could be established and all keyring operations will be unavailable.","triggerScenarios":"Any first use of the SecretServiceCollection (Get/GetAccounts/AddOrUpdate/Remove) when connecting to the Secret Service fails: no D-Bus session bus, no Secret Service provider, daemon not responding.","commonSituations":"Headless Linux servers or CI containers without gnome-keyring; WSL without a keyring bridge; DBUS_SESSION_BUS_ADDRESS unset because no session manager is running.","solutions":["Install and start a Secret Service implementation (e.g. gnome-keyring: `apt-get install gnome-keyring` then start the daemon)","Run within a D-Bus session (eval `dbus-launch` or ensure DBUS_SESSION_BUS_ADDRESS is set)","Read the inner exception's GError message to identify the exact transport failure","On headless hosts, switch to an alternative credential storage (file-based, encrypted store) instead of Secret Service"],"exampleFix":"// before\nvar collection = new SecretServiceCollection(); // fails with no dbus/keyring\n// after\ndbus-launch gnome-keyring-daemon --start --components=secrets  # environment setup\nvar collection = new SecretServiceCollection();","handlingStrategy":"try-catch","validationCode":"bool SecretServiceReachable() =>\n    Environment.GetEnvironmentVariable(\"DBUS_SESSION_BUS_ADDRESS\") != null &&\n    Directory.Exists(\"/run/user/\" + Environment.UserId);","typeGuard":null,"tryCatchPattern":"try { var c = new SecretServiceCollection(); }\ncatch (InteropException ex) when (ex.Message.Contains(\"open secret service session\")) { throw new StartupException(\"Install/start a Secret Service provider (gnome-keyring) with a D-Bus session\", ex); }","preventionTips":["Install gnome-keyring (or kwallet) on every host that runs the app","Start the daemon and set DBUS_SESSION_BUS_ADDRESS before app startup","Use dbus-launch in headless scripts that need keyring access","Check keyring availability at application startup with a cheap probe call"],"tags":["linux","keyring","dbus","environment"],"backgroundTag":"connection-refused","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}