Proof Portal
Omarchy
ProbeLabs65 findings · 95 requirementsA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
sddm.sh strips pam_gnome_keyring.so auth from /etc/pam.d/sddm but not /etc/pam.d/sddm-autologin
Reported by swiaam · filed Sep 4, 2026Closed upstream on 2026-09-21 by bjarneo via an automated message, as a duplicate of #5105 (R-1991). GitHub close reason: completed.
At a glance
- 1 · What is claimed?
- Only the report text below — no validator has restated it as checkable claims yet.
- 2 · What does it affect?
- Not yet mapped to any requirement or component.
- 3 · Is it reproducible?
- No validation has been run yet.
- 4 · What remains unclear?
- Not validated yet: no claims, no reproducer.
- 5 · What happens next?
- Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.
Original report
What happened
On a fresh Omarchy install with SDDM autologin enabled, the login (default)
keyring never auto-unlocks. Every boot logs:
sddm-helper[982]: gkr-pam: couldn't unlock the login keyring.
Because the keyring stays locked, apps that use libsecret for at-rest
encryption (e.g. Chrome with --password-store=gnome-libsecret, set by
migration 1784508556.sh) can't decrypt previously stored cookies/session
data on the next boot. Concretely: WhatsApp Web (run via
omarchy-launch-webapp as an --app) loses its session and shows the QR
login screen after every reboot, even though the underlying cookies and
IndexedDB session data are still present on disk with valid expiry dates.
Root cause
install/login/sddm.sh strips pam_gnome_keyring.so from the auth
stage of /etc/pam.d/sddm specifically to avoid the module encrypting the
login keyring with the user's typed password, which would conflict with
the passwordless default keyring install/user/default-keyring.sh sets up:
# Prevent password-based SDDM logins from creating an encrypted login
# keyring that conflicts with Omarchy's passwordless default keyring
# behavior.
sed -i '/-auth.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm
sed -i '/-password.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm
This sed only targets /etc/pam.d/sddm. /etc/pam.d/sddm-autologin still
ships the untouched pam_gnome_keyring.so auth line:
-auth optional pam_gnome_keyring.so
-session optional pam_gnome_keyring.so auto_start
With autologin, no password reaches this auth stage, so the module fails
to unlock instead of just being skipped, and the session stage's
auto_start never gets a properly unlocked keyring.
Expected
Same behavior as /etc/pam.d/sddm: no auth-stage pam_gnome_keyring.so call,
just the session-stage auto_start, letting the passwordless default
keyring unlock cleanly.
Workaround applied locally
sudo sed -i '/-auth.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm-autologin
System
- Omarchy version: 4.0.1-1 (stable channel)
- CPU: 11th Gen Intel Core i5-1145G7
- GPU: Intel Iris Xe (TigerLake-LP GT2)
- Kernel: 7.1.9-arch1-2
🤖 Generated with Claude Code
View raw text
## What happened
On a fresh Omarchy install with SDDM autologin enabled, the login (default)
keyring never auto-unlocks. Every boot logs:
sddm-helper[982]: gkr-pam: couldn't unlock the login keyring.
Because the keyring stays locked, apps that use libsecret for at-rest
encryption (e.g. Chrome with --password-store=gnome-libsecret, set by
migration 1784508556.sh) can't decrypt previously stored cookies/session
data on the next boot. Concretely: WhatsApp Web (run via
omarchy-launch-webapp as an --app) loses its session and shows the QR
login screen after every reboot, even though the underlying cookies and
IndexedDB session data are still present on disk with valid expiry dates.
## Root cause
install/login/sddm.sh strips `pam_gnome_keyring.so` from the **auth**
stage of /etc/pam.d/sddm specifically to avoid the module encrypting the
login keyring with the user's typed password, which would conflict with
the passwordless default keyring install/user/default-keyring.sh sets up:
# Prevent password-based SDDM logins from creating an encrypted login
# keyring that conflicts with Omarchy's passwordless default keyring
# behavior.
sed -i '/-auth.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm
sed -i '/-password.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm
This sed only targets /etc/pam.d/sddm. /etc/pam.d/sddm-autologin still
ships the untouched pam_gnome_keyring.so auth line:
-auth optional pam_gnome_keyring.so
-session optional pam_gnome_keyring.so auto_start
With autologin, no password reaches this auth stage, so the module fails
to unlock instead of just being skipped, and the session stage's
auto_start never gets a properly unlocked keyring.
## Expected
Same behavior as /etc/pam.d/sddm: no auth-stage pam_gnome_keyring.so call,
just the session-stage auto_start, letting the passwordless default
keyring unlock cleanly.
## Workaround applied locally
sudo sed -i '/-auth.*pam_gnome_keyring\.so/d' /etc/pam.d/sddm-autologin
## System
- Omarchy version: 4.0.1-1 (stable channel)
- CPU: 11th Gen Intel Core i5-1145G7
- GPU: Intel Iris Xe (TigerLake-LP GT2)
- Kernel: 7.1.9-arch1-2
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_012nh8KsvygPwZpTPR5xNYRGValidation
Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.
Linked
Not linked to any known issue, other report or change yet.
Decision
Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.
No decision has been recorded yet.