Login fails without Secret Service (headless Linux/WSL2): consider a file-based fallback
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- go, linux
- Domain
- authentication, cli, security
Research direction
Start by reading internal/keyring/keyring.go and tracing credential encryption and retrieval from the nais login -n and nais alpha mcp serve entry points. Reproduce the missing Secret Service behavior on headless Linux or WSL2, then agree on the opt-in fallback and its configuration surface. Done means the selected store works with appropriate file permissions and unusable systems receive an actionable error, with tests covering both paths.
Written by the indexing model from the issue text.
Description
nais/cli keeps its credentials encryption key in the OS keyring through zalando/go-keyring (internal/keyring/keyring.go, service cli.nais.io). On Linux, go-keyring only supports Secret Service over the D-Bus session bus, and has no fallback.
On headless WSL2, or on servers without gnome-keyring or KeePassXC, nais login -n likely fails at keyring.SetBytes. We inferred this from the source and haven't reproduced it on a real host. As a result, the Nais MCP server (nais alpha mcp serve) can't be used there.
Suggestion: an opt-in file-based key store, for example under the config dir with mode 0600, or an env/flag to choose it. Also a clear error that points to installing a Secret Service provider.
Context: Nav's cplt sandbox runs nais alpha mcp serve on the host for AI agents (navikt/cplt#838), and we want it to work on WSL2.
- Dominant language
- Go
- Stars
- 2
- Forks
- 5
- Avg merge
- 6h 59m
- Merged PRs (30d)
- 36
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nais/cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 57/100
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 64/100
Maintainers usually reply within 1 day
Similar issues
-
date_time, url_encode, html_escape, to_unix_time, contains_all and contains_any panic when called without argumentsPossibly taken @antcybersec claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
projectdiscovery/dsl#372 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
JuliusBrussee/caveman#1449 ·
Maintainers usually reply within 1 day
-
bot-found bug priority: P3
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
madenvel/KalinkaPlayer#498 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:ux-friction issue-rating: 🦞 diamond lobster P2
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
openclaw/gogcli#1291 · 1 comment · 1 reaction ·
Maintainers usually reply within 1 day