moonD4rk/HackBrowserData · error

get secret for %s: %w

Error message

get secret for %s: %w

What it means

A keyring item whose label exactly matches the requested storage (e.g. 'Chromium Safe Storage') was found, but reading its secret via item.GetSecret(session.Path()) failed. The library treats this as fatal for the D-Bus tier instead of skipping the item.

Source

Thrown at masterkey/retriever_linux.go:60

	collections, err := svc.GetAllCollections()
	if err != nil {
		return nil, fmt.Errorf("get collections: %w", err)
	}

	for _, col := range collections {
		items, err := col.GetAllItems()
		if err != nil {
			continue
		}
		for _, item := range items {
			label, err := item.GetLabel()
			if err != nil {
				continue
			}
			if label == storage {
				secret, err := item.GetSecret(session.Path())
				if err != nil {
					return nil, fmt.Errorf("get secret for %s: %w", storage, err)
				}
				if len(secret.Value) > 0 {
					return linuxParams.deriveKey(secret.Value), nil
				}
			}
		}
	}

	return nil, fmt.Errorf("%q: %w", storage, errStorageNotFound)
}

// PosixRetriever derives Chromium's kV10Key via PBKDF2 over the hardcoded "peanuts" password — the
// deterministic v10 key used when no keyring exists (headless/Docker/CI). Mirrors PosixKeyProvider.
type PosixRetriever struct{}

func (r *PosixRetriever) RetrieveKey(_ Hints) ([]byte, error) {
	return linuxParams.deriveKey([]byte("peanuts")), nil
}

View on GitHub (pinned to 0503d04d7a)

Solutions

1. Unlock the collection first: secret-tool unlock, or run once in the GUI session so the unlock prompt appears and the keyring stays unlocked
2. Ensure you are on the same user session that owns the keyring (correct DBUS_SESSION_BUS_ADDRESS / XDG_RUNTIME_DIR)
3. If the item is locked but its password is known, recreate it unlocked via secret-tool store or seahorse
4. Fall back to PosixRetriever (v10 PBKDF2("peanuts")) which needs no keyring at all

null

key, err := dbusRetriever.RetrieveKey(hints)
if err != nil && strings.Contains(err.Error(), "get secret for") {
    // collection locked / item unreadable — use v10 key instead
    key, err = posixRetriever.RetrieveKey(hints)
}

When it happens

Trigger: GetSecret fails on a matching item: the collection is locked and no unlock prompt could be shown (headless/no agent), the item was deleted between enumeration and read, or the session path was rejected by the daemon.

Common situations: SSH or headless environments where gnome-keyring cannot prompt to unlock the 'login' collection; items in a secondary locked collection; race with the user deleting entries in Seahorse/KWalletManager.

Related errors

• secret service: %w
• open session: %w
• get collections: %w
• not found in credential store
• dbus session: %w

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/ced5693724607e6d. Report an issue: GitHub.