Skip to content

Instantly share code, notes, and snippets.

@kizzard

kizzard/UnlockGnomeKeyring.md

Last active December 6, 2025 16:00
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save kizzard/166470fefe8fa64d2aa65e0235115318 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save kizzard/166470fefe8fa64d2aa65e0235115318 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
UnlockGnomeKeyring.md

Automatically Unlock Gnome Keyring on Login on Pop OS or Ubuntu

For face or fingerprint unlock methods that log in but don't unlock the keyring

This works on Pop OS and probably any Ubuntu based distro

Uses https://codeberg.org/umglurf/gnome-keyring-unlock and https://github.com/tpm2-software/tpm2-tools

Add yourself to the tss group

This is required to use the TPM

sudo usermod -aG tss your_username

log out and back in, and check that you are in the tss group:

groups

Set up Dependencies

sudo apt install tpm2-tools
git clone https://codeberg.org/umglurf/gnome-keyring-unlock.git

Set up TPM keys and context

mkdir -p ~/.tpm && cd ~/.tpm
tpm2_createprimary -c primary.ctx
tpm2_create -C primary.ctx -Gaes128 -u key.pub -r key.priv
tpm2_load -C primary.ctx -u key.pub -r key.priv -c key.ctx

Encrypt password

read password
tpm2_encryptdecrypt -c key.ctx -o password.enc <<<$password

Create Unlock Script

Save the following as ~/Scripts/unlockKeyring.sh:

#!/bin/bash
# Load a TPM Context key, decode password and unlock the gnome keyring
tpm2_createprimary -Q -c ~/.tpm/primary.ctx
tpm2_load -Q -C ~/.tpm/primary.ctx -u ~/.tpm/key.pub -r ~/.tpm/key.priv -c ~/.tpm/key.ctx
tpm2_encryptdecrypt -Qd -c ~/.tpm/key.ctx ~/.tpm/password.enc | ~/gnome-keyring-unlock/unlock.py

Make it run on login

Add the following to the end of your ~/.profile:

# Wait 5 seconds then try to unlock the keyring
(sleep 5; ~/Scripts/unlockKeyring.sh &> ~/Scripts/unlockKeyring.log) &
@jaystocky
Copy link

jaystocky commented Dec 4, 2025

Thanks @maksims-terjohins i think that fixed it! The only issue I'm having now is that I'm still getting the two errors when I load into the OS asking me for the keyring password, but if I ignore them and then check passwords & keys I can see that it's unlocked!

@maksims-terjohins
Copy link

maksims-terjohins commented Dec 5, 2025

Thanks @maksims-terjohins i think that fixed it! The only issue I'm having now is that I'm still getting the two errors when I load into the OS asking me for the keyring password, but if I ignore them and then check passwords & keys I can see that it's unlocked!

It looks to me that the script runs to late in OS startup process, since you eventually get it unlocked without entering the password. You might want to play with the sleep duration in your ~/.profile. I would start with removing the sleep 5; command and see if keyring still gets unlocked. If it breaks, try adding some non-zero time, but less than 5 seconds. May be you will find the right delay that fits your concrete OS instance and unlocks the keyring yet without prompting the password.

@jaystocky
Copy link

jaystocky commented Dec 6, 2025

@maksims-terjohins given that a test, changed sleep 5 to sleep 0, sleep 1 etc and all still result in me having to dismiss three pop-ups despite the keyring being unlocked when i check afterwards! odd.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment