Linux

Entries go to the Secret Service over D-Bus (dbus-secret-service-keyring-store with the crypto-rust feature, so no host OpenSSL is needed). Any provider works: GNOME Keyring, KWallet, KeePassXC with Secret Service enabled.

Build

sudo apt install libdbus-1-dev pkg-config   # Debian / Ubuntu
sudo dnf install dbus-devel pkgconf-pkg-config   # Fedora

Run time

A Secret Service must be running in the user's session. Desktop sessions of GNOME and KDE start one. On minimal window managers, start gnome-keyring-daemon (or another provider) with the session.

If D-Bus or the service is not up yet when the app starts, the first call fails with plugin initialization failed: dbus secret service init failed: …. The error is not cached: the next call after a 2-second pause tries again.

The unlock prompt

When the collection is locked, the Secret Service asks for the password in a GUI prompt and the call waits until the user answers. Without a display nobody can answer it, and the call (and the plugin command) waits for a very long time: the underlying library allows up to a year.

On servers and in CI unlock the keyring before the app runs:

dbus-run-session -- bash -c '
  echo -n "password" | gnome-keyring-daemon --unlock --components=secrets
  ./your-app
'

This is what the plugin's own CI does on Ubuntu. If you need no Secret Service at all, use another store for your own Rust code with KeyringStore::with_store, e.g. linux-keyutils-keyring-store, which never prompts but keeps secrets only for the login session.

Where to see them

GNOME: Passwords and Keys (Seahorse). KDE: KWallet Manager.