Repository navigation
fix(connections): report keychain failures as such, not as an unreachable SSH server - #934
Merged
Merged
Conversation
…able SSH server When the OS keychain does not answer (a Secret Service provider that owns org.freedesktop.secrets but never replies), saving a connection fails with "Platform secure storage failure: DBus error: Did not receive a reply ... the reply timeout expired, or the network connection was broken". The connection error classifier matched "timeout" and "broken" as a network failure and, with SSH enabled, labelled it "SSH server unreachable", which sent users to debug a tunnel that works. Keychain errors now get their own "keychain" category, checked before the SSH and network rules, with a recovery hint pointing at the Secret Service provider and the "Save passwords in Keychain" option. The SSH tab is no longer flagged for these errors. Refs #932
Contributor
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (13 files)
Reviewed by free · Input: 890.9K · Output: 4.9K · Cached: 1M |
NewtTheWolf
approved these changes
Nov 10, 2026
NewtTheWolf
left a comment
NewtTheWolf
left a comment
Collaborator
There was a problem hiding this comment.
I ported the keychain classification to the current web-ui paths, resolved the old-path conflicts and added the missing Vietnamese and Traditional Chinese message keys. Secure-storage failures are checked before SSH/network failures, so the DBus timeout from #932 receives the credential-store recovery message.
All 17 classifier tests and 8,791 frontend tests pass, with lint and typecheck green. Approved on c6a1736, subject to the current CI checks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #932
Problem
Saving (or deleting) a connection writes the passwords to the OS keychain. When the keychain does not answer, for example a Secret Service provider that owns
org.freedesktop.secretsbut never replies,keyringreturns:The modal runs save errors through
classifyConnectionError. That text matches theNETWORKrule ("timeout", "broken"), and with SSH enabled it is shown as SSH server unreachable, with the SSH tab flagged. The reporter's tunnel and database test both pass, so the message points them at the wrong thing.The keychain code itself did not change between v0.26.0 and v0.27.0, so the underlying failure is environmental (the Secret Service on the reporter's machine is not responding). This PR fixes how we report it.
What changed
src/utils/connectionErrors.ts: newkeychaincategory, matched before the SSH and network rules (secure storage, keychain, keyring, Secret Service,org.freedesktop.secrets). It also covers the snap hint and the "Failed to read the stored connection URI from the OS keychain" error.connectionErrors.keychainsummary and recovery strings in all 11 locales. The recovery hint suggests checking that a Secret Service provider (GNOME Keyring, KWallet, KeePassXC) is running and unlocked, or turning off "Save passwords in Keychain" (each locale quotes its own label for that checkbox).ssh, the SSH tab is no longer marked as failing for these errors.Verification
org.freedesktop.secretson an isolateddbus-run-sessionbus and swallows every call, plus a small crate usingkeyring 3.6.3with the same features as Tabularis:set_passwordfails after about 2s with exactly the message from the issue.tests/utils/connectionErrors.test.tswith the exact string from the issue (failed before the change, pass now).pnpm vitest run tests/utils/connectionErrors.test.ts tests/components/modals/NewConnectionModal.test.tsx tests/i18n: all green.tsc --noEmitand eslint clean.