Staying signed in on Linux when the keyring doesn't survive a reboot
We keep people signed in on desktop the same way we do on mobile: the session is an access/refresh token pair, and we would much rather store it in the operating system's secure store than in a plaintext file. On Linux that secure store is the keyring — libsecret talking to the Secret Service that gnome-keyring implements. Getting Flutter Linux secure storage to behave on every machine turned out…
The article discusses the issue of maintaining user sessions on Linux when the keyring doesn't survive a reboot. It explains that on desktop platforms, sessions are stored as access/refresh token pairs in a secure store, with the keyring being the secure store on Linux. The article highlights that storing a plaintext fallback would be unsafe, so instead, they use a proof-gated fallback, which is only trusted after evidence that the keyring can keep values across reboots.
The core of the story is a bug discovered on a Linux machine running Arch Linux, where a keyring only lived for the current session and lost its session data upon reboot. The bug was caused by a proof that only considered if a value survived the process that wrote it, rather than the more critical event of a session (boot) exit.
The fix involved adding a cross-boot proof, which required writing the proof record to include the kernel boot identifier. This ensured that the proof was only considered valid if it survived across boot events, thus fixing the issue of sessions being lost when the keyring couldn't survive reboots.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
