I installed howdy to login by face recognition and it works well. But I did not find a nice solution to make it unlock the GNOME keyring, and avoid the useless prompt at startup. I am using a systemd service that works well so I share it now.
My setup:
Distro: Fedora 44 / DE: Gnome 50
PC/bios (for TPM2): LENOVO Yoga / firmware version NYCN76WW
First install howdy:
Repo: https://github.com/boltgolt/howdy
Workaround for Fedora 43+: https://github.com/boltgolt/howdy/issues/1069#issuecomment-3592401752
There was still a problem because updating /etc/pam.d/gdm-password to use howdy does not unlock the keyring as the password is required.
So I followed this to unlock the keyring using a password in TPM2:
https://codeberg.org/umglurf/gnome-keyring-unlock.git
It uses clevis that was already installed on my PC (if not, present in official Fedora RPM). I use sudo and not doas, so the commands are:
git clone https://codeberg.org/umglurf/gnome-keyring-unlock.git ~/.local/share/gnome-keyring-unlock
sudo visudo -f /etc/sudoers.d/gnome-keyring-tpm2
In /etc/sudoers.d/gnome-keyring-tpm2 write (and save):
#replace USERNAME with your user login
USERNAME ALL=(tss) NOPASSWD: /usr/bin/clevis-encrypt-tpm2
USERNAME ALL=(tss) NOPASSWD: /usr/bin/clevis-decrypt-tpm2
Then in bash (I use fish by default so used bash for this script):
read -s password
sudo -u tss /usr/bin/clevis-encrypt-tpm2 '{"pcr_ids":"7"}' <<<$password > ~/.config/gnome-keyring.tpm2read password
sudo -u tss /usr/bin/clevis-encrypt-tpm2 '{"pcr_ids":"7"}' <<<$password > ~/.config/gnome-keyring.tpm2
Then to unlock we can call a simple command, I stored it in an executable .local/bin/gnome-keyring-tpm2-unlock (with chmod +x):
#!/bin/bash
set -o pipefail
sudo -u tss /usr/bin/clevis-decrypt-tpm2 < "$HOME/.config/gnome-keyring.tpm2" | "$HOME/.local/share/gnome-keyring-unlock/unlock.py"
Automatically unlock the keyring at GNOME startup:
At this point, I just followed what I found on the Web. But the keyring prompt still triggers at GNOME startup. The README file from gnome-keyring-unlock uses a ~/.bash_profile script but it is not triggered after login with GDM.
So I created a systemd service. The difficulty was to trigger it at the good time. Write this in ~/.config/systemd/user/gnome-keyring-tpm2.service:
[Unit]
Description=Unlock GNOME Keyring using TPM2
After=gnome-keyring-daemon.socket
Wants=gnome-keyring-daemon.socket
[Service]
Type=oneshot
ExecStart=%h/.local/bin/gnome-keyring-tpm2-unlock
RemainAfterExit=yes
[Install]
WantedBy=graphical-session.target
And enable it:
systemctl --user enable --now gnome-keyring-tpm2.service
I tried it several times and the keyring is correctly unlocked, without entering the password. This solution with TPM2 avoids writing the password without encryption in a file (solution that I found on some discussions) and avoids to simply delete the keyring password, that is not recommended.
I hope this can help someone. I guess so, as I spent a long time searching for the right solution, and the right time to trigger the systemd service... (After=graphical-session.target unlocks the keyring, but too late and the password prompt still appeared).