Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
[Bug]: Changing password via Super Menu updater breaks SDDM login due to gkr-pam keyring mismatch
Reported by BSBrouwers · filed Aug 30, 2026 · open at source
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- AreaOutside the audited area· Decided by agents · verified
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Decided by agents and verified by a second, independent agent — see the decision.
Original report
System details
AMD 7945HX3D, 5070 Ti, Omarchy 4.0.1-1
What's wrong?
Description
Updating the user account password via the built-in Super Menu password tool works when logging out and back in within an active session, but fails upon a full system restart.
On cold boot, SDDM fails to log in with the new password and silently resets the progress bar. System logs confirm gkr-pam fails to unlock the physical login.keyring file because its encryption password was not synced by the menu tool.
Steps to Reproduce
1. Open the Omarchy Super menu and run the built-in password updater tool.
2. Change the password.
3. Log out and log back in -> Succeeds (daemon running in memory).
4. Restart the system.
5. Enter the new password at the initial SDDM login screen.
6. Result: SDDM resets the login progress bar on cold boot because gkr-pam cannot decrypt login.keyring on disk.
Expected Behavior
The Super Menu password utility should update both the passwd entry and sync/re-encrypt the login.keyring file (or prompt to update the keyring password) so cold boot SDDM authentication succeeds.
System Info & logs
=== SYSTEM INFO ===
7.1.9-arch1-2
=== OMARCHY ===
4.0.1-1
=== HYPRLAND ===
Hyprland 0.56.2
### Logs
Aug 30 10:27:04 omarchy sddm-helper[1895]: gkr-pam: no password is available for user
Aug 30 10:27:04 omarchy sddm-helper[1895]: pam_unix(sddm-autologin:session): session opened for user bob(uid=1000) by bob(uid=0)
Aug 30 10:27:05 omarchy sddm-helper[1895]: gkr-pam: couldn't unlock the login keyring.View raw text
### System details AMD 7945HX3D, 5070 Ti, Omarchy 4.0.1-1 ### What's wrong? ### Description Updating the user account password via the built-in Super Menu password tool works when logging out and back in within an active session, but fails upon a full system restart. On cold boot, SDDM fails to log in with the new password and silently resets the progress bar. System logs confirm `gkr-pam` fails to unlock the physical `login.keyring` file because its encryption password was not synced by the menu tool. Steps to Reproduce 1. Open the Omarchy Super menu and run the built-in password updater tool. 2. Change the password. 3. Log out and log back in -> Succeeds (daemon running in memory). 4. Restart the system. 5. Enter the new password at the initial SDDM login screen. 6. Result: SDDM resets the login progress bar on cold boot because gkr-pam cannot decrypt login.keyring on disk. Expected Behavior The Super Menu password utility should update both the passwd entry and sync/re-encrypt the login.keyring file (or prompt to update the keyring password) so cold boot SDDM authentication succeeds. ### System Info & logs ```plain === SYSTEM INFO === 7.1.9-arch1-2 === OMARCHY === 4.0.1-1 === HYPRLAND === Hyprland 0.56.2 ### Logs Aug 30 10:27:04 omarchy sddm-helper[1895]: gkr-pam: no password is available for user Aug 30 10:27:04 omarchy sddm-helper[1895]: pam_unix(sddm-autologin:session): session opened for user bob(uid=1000) by bob(uid=0) Aug 30 10:27:05 omarchy sddm-helper[1895]: gkr-pam: couldn't unlock the login keyring.
Validation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
- Related PRpr/13215· confirmed
- Related PRpr/9239· confirmed
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
- Out of scopeDecided by agents · verified · 2026-10-09 02:17 UTC