git-ecosystem/git-credential-manager · critical · InteropException

Failed to open secret service session

Error message

Failed to open secret service session

What it means

GetSecretService opens a session with the Secret Service via secret_service_get_sync (or equivalent). If the call returns a GError it frees it and throws an InteropException carrying the daemon's code and message, meaning no keyring session could be established and all keyring operations will be unavailable.

Solutions

1. Install and start a Secret Service implementation (e.g. gnome-keyring: `apt-get install gnome-keyring` then start the daemon)
2. Run within a D-Bus session (eval `dbus-launch` or ensure DBUS_SESSION_BUS_ADDRESS is set)
3. Read the inner exception's GError message to identify the exact transport failure
4. On headless hosts, switch to an alternative credential storage (file-based, encrypted store) instead of Secret Service

Example fix

// before
var collection = new SecretServiceCollection(); // fails with no dbus/keyring
// after
dbus-launch gnome-keyring-daemon --start --components=secrets  # environment setup
var collection = new SecretServiceCollection();

bool SecretServiceReachable() =>
    Environment.GetEnvironmentVariable("DBUS_SESSION_BUS_ADDRESS") != null &&
    Directory.Exists("/run/user/" + Environment.UserId);

try { var c = new SecretServiceCollection(); }
catch (InteropException ex) when (ex.Message.Contains("open secret service session")) { throw new StartupException("Install/start a Secret Service provider (gnome-keyring) with a D-Bus session", ex); }

When it happens

Trigger: Any first use of the SecretServiceCollection (Get/GetAccounts/AddOrUpdate/Remove) when connecting to the Secret Service fails: no D-Bus session bus, no Secret Service provider, daemon not responding.

Common situations: Headless Linux servers or CI containers without gnome-keyring; WSL without a keyring bridge; DBUS_SESSION_BUS_ADDRESS unset because no session manager is running.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• Cannot use the ' ' credential backing store without a…
• Failed to search for credentials
• Failed to unlock item
• Failed to store credentials
• -1

AI-assisted analysis of git-ecosystem/git-credential-manager@e8ce762cd0 (2026-09-11). Data as JSON: /api/errors/5d530cc41794fc83. Report an issue: GitHub.

Appendix: source

Thrown at src/Core/Interop/Linux/SecretServiceCollection.cs:342

            sb.Append(service);
            return sb.ToString();
        }

        private static unsafe SecretService* GetSecretService()
        {
            // Get a handle to the default secret service, open a session,
            // and load all collections
            SecretService* service = secret_service_get_sync(
                SecretServiceFlags.SECRET_SERVICE_OPEN_SESSION | SecretServiceFlags.SECRET_SERVICE_LOAD_COLLECTIONS,
                IntPtr.Zero, out GError* error);

            if (error != null)
            {
                int code = error->code;
                string message = Marshal.PtrToStringAuto(error->message)!;
                g_error_free(error);
                throw new InteropException("Failed to open secret service session", code, new Exception(message));
            }

            return service;
        }

        private static SecretSchema GetSchema()
        {
            var schema = new SecretSchema
            {
                name = SchemaName,
                flags = SECRET_SCHEMA_DONT_MATCH_NAME,
                attributes = new SecretSchemaAttribute[32]
            };

            schema.attributes[0] = new SecretSchemaAttribute
            {
                name = ServiceAttributeName,
                type = SECRET_SCHEMA_ATTRIBUTE_STRING

View on GitHub (pinned to e8ce762cd0)