{"record":{"id":"ced5693724607e6d","repo":"moonD4rk/HackBrowserData","slug":"get-secret-for-s-w","errorCode":null,"errorMessage":"get secret for %s: %w","messagePattern":"get secret for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"masterkey/retriever_linux.go","lineNumber":60,"sourceCode":"\tcollections, err := svc.GetAllCollections()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"get collections: %w\", err)\n\t}\n\n\tfor _, col := range collections {\n\t\titems, err := col.GetAllItems()\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tfor _, item := range items {\n\t\t\tlabel, err := item.GetLabel()\n\t\t\tif err != nil {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif label == storage {\n\t\t\t\tsecret, err := item.GetSecret(session.Path())\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"get secret for %s: %w\", storage, err)\n\t\t\t\t}\n\t\t\t\tif len(secret.Value) > 0 {\n\t\t\t\t\treturn linuxParams.deriveKey(secret.Value), nil\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil, fmt.Errorf(\"%q: %w\", storage, errStorageNotFound)\n}\n\n// PosixRetriever derives Chromium's kV10Key via PBKDF2 over the hardcoded \"peanuts\" password — the\n// deterministic v10 key used when no keyring exists (headless/Docker/CI). Mirrors PosixKeyProvider.\ntype PosixRetriever struct{}\n\nfunc (r *PosixRetriever) RetrieveKey(_ Hints) ([]byte, error) {\n\treturn linuxParams.deriveKey([]byte(\"peanuts\")), nil\n}","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/moonD4rk/HackBrowserData/blob/0503d04d7a8d0379d060268a74f1b149e5a0aad5/masterkey/retriever_linux.go#L42-L78","documentation":"A keyring item whose label exactly matches the requested storage (e.g. 'Chromium Safe Storage') was found, but reading its secret via item.GetSecret(session.Path()) failed. The library treats this as fatal for the D-Bus tier instead of skipping the item.","triggerScenarios":"GetSecret fails on a matching item: the collection is locked and no unlock prompt could be shown (headless/no agent), the item was deleted between enumeration and read, or the session path was rejected by the daemon.","commonSituations":"SSH or headless environments where gnome-keyring cannot prompt to unlock the 'login' collection; items in a secondary locked collection; race with the user deleting entries in Seahorse/KWalletManager.","solutions":["Unlock the collection first: secret-tool unlock, or run once in the GUI session so the unlock prompt appears and the keyring stays unlocked","Ensure you are on the same user session that owns the keyring (correct DBUS_SESSION_BUS_ADDRESS / XDG_RUNTIME_DIR)","If the item is locked but its password is known, recreate it unlocked via secret-tool store or seahorse","Fall back to PosixRetriever (v10 PBKDF2(\"peanuts\")) which needs no keyring at all"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"null","typeGuard":null,"tryCatchPattern":"key, err := dbusRetriever.RetrieveKey(hints)\nif err != nil && strings.Contains(err.Error(), \"get secret for\") {\n    // collection locked / item unreadable — use v10 key instead\n    key, err = posixRetriever.RetrieveKey(hints)\n}","preventionTips":["Unlock the 'login' collection beforehand (secret-tool unlock) especially on headless/SSH runs","Run within the owning user's session so unlock prompts can appear and succeed","Avoid deleting/renaming Safe Storage items while extraction runs","Include PosixRetriever as a v10 fallback in the retriever chain"],"tags":["linux","secret-service","locked-keyring","secrets"],"backgroundTag":"authentication-required","analyzedSha":"0503d04d7a8d0379d060268a74f1b149e5a0aad5","analyzedAt":"2026-09-06T13:38:28.707Z","contentChangedAt":"2026-09-06T13:38:28.707Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}