Database error when switching from KDE to hyprland

[Juggo0]

Using a supported version?

• I have searched searched open and closed issues for duplicates.
• I am using Signal-Desktop as provided by the Signal team, not a 3rd-party package.

Overall summary

When signal is started once on KDE plasma , it stops working on hyprland completely.
The only way to fix it, is to remove everything from .config/Signal and re-link the device, then never start Signal on Plasma.

The error message is:

Database error

Unable to access the database encryption key because the OS encryption keyring backend has changed from kwallet6 to basic_text. This can occur if the desktop environment changes, for example between GNOME and KDE.

Please switch to the previous desktop environment.

Following the instructions, it is indeed possible to start Signal on Plasma, however this means I cannot ever start Signal on any other desktop environment. Obviously, this is not really a solution.

Even if I auto start kwallet on hyprland before anything else starts, the same issue persists.

Steps to reproduce

1. Start Signal on KDE Plasma
2. Switch to hyprland (presumably any other desktop environment)
3. Start Signal
4. Observe error

Expected result

Signal starts normally, without any errors.

Actual result

Signal doesn't start, only shows an error box.

Screenshots

Signal version

7.18.0-1

Operating system

Arch Linux

Version of Signal on your phone

7.9.6

Link to debug log

No response

[ayumi-signal]

Hi, sorry this is happening for you. Could you try this: be on hyprland and make sure kwallet is running, then start signal-desktop with the command line flag --password-store="kwallet6"

[Juggo0]

Hey, yup that works! Signal starts up normally on hyprland with that flag. Thanks!

[ayumi-signal]

glad to hear it! we'll update it so the dialog becomes a little more helpful

[github-signalapp-msf]

I have the same trouble since the last update of signal-desktop. But I don't want to grant access to kwallet (it's asking for "kdewallet") for signal-desktop. How did it work before, how can I get back to a (presumed) file-system based password-store?
I tried signal-desktop --password-store=basic_text but it keeps asking and only comes up if I grant access to "kdewallet".

[jamiebuilds-signal]

@github-signalapp-msf This is because of a recent change to use your OS's secure password storage to store the secret used to encrypt your local database.

[github-signalapp-msf]

@jamiebuilds-signal many thanks for the explanation. It helped my to get a bit further towards my goal of signal being independent from the desktop environment (gnome, various versions of kde).

I see a valid use case for users to (temporarily) migrate back to basic even while encryption is available, e.g. to support them during trying out different desktop environments. It might start with reverting be5829b.

[embeddedpenguin]

I'm also having this problem and also can solve it with the above method. I'm just curious if I will always have to pass this flag. Will there be an update at some point that saves the password store option?

[ayumi-signal]

@embeddedpenguin Currently you need to always pass the flag, sorry about that. A workaround would be if you have a file that launches the app, to append the command line flag.

It's a good idea to persist the last used keyring backend, so we can auto select it on app start. We'll work on doing that.

[embeddedpenguin]

@embeddedpenguin Currently you need to always pass the flag, sorry about that. A workaround would be if you have a file that launches the app, to append the command line flag.

It's a good idea to persist the last used keyring backend, so we can auto select it on app start. We'll work on doing that.

No need to apologize, just wanted to make sure aliasing with that flag was the right play for right now. Thank you for signal.

[chainria]

This just bit me. And it will bite a lot of other people, since Plasma 6 is out, Plasma 5 is deprecated.
And therefore the store changes from kwallet5 to kwallet6. Please provide a clean way to switch password stores.
Also, does the app support libsecret? Would be vastly preferred over kwallet (KeepassXC).

[ayumi-signal]

It's a good point that we need the ability to migrate between secret stores. We are planning to add it.

Regarding libsecret, it can be selected with the command line flag --password-store="gnome-libsecret". For details on flags see: https://www.electronjs.org/docs/latest/api/safe-storage#safestoragegetselectedstoragebackend-linux

[iqtedar]

Starting Signal with the flag wasn't enough: signal-desktop --password-store="gnome-libsecret".
I had to do: flatpak run org.signal.Signal --password-store="gnome-libsecret".
Signal launched but reported that the database is corrupt and must be deleted. I let it create a new one because there was no other option. It worked, but all previous messages were gone. However, it failed to launch again when using the app the second day. So, I deleted .config/Signal, but that didn't help, either.

I uninstalled and reinstalled Signal. It insists on switching to the "previous desktop environment", which I don't want to do. I'm using the Gnome desktop environment on Ubuntu, and only temporarily used X11, which is when the problem occurred. What else should I try?

[scottnonnenberg-signal]

@iqtedar First, switching beck and forth between window managers (like you said, Gnome and X11) will cause problems because Desktop will try to access its decryption key from the previous window manager's secure storage.

Next, make sure that you're on the very latest flatpak version, because they've made some fixes recently.

Lastly, did you know that the flatpak folks believe that any encrypted storage mechanism is risky? Perhaps you could consider installing Signal from the official apt repo? https://signal.org/download

[dyercode]

Is there an issue to follow for a proper fix such as the one mentioned above #6962 (comment) ? I wouldn't expect a workaround to be considered a solution.

For anyone else dealing with this on Nix, the workaround can be applied transparently by replacing the signal-desktop package declaration with the wrapper such as (changing kwallet6 as appropriate)

(pkgs.symlinkJoin {
  name = "signal-desktop";
  paths = [ pkgs.signal-desktop ];
  buildInputs = [ pkgs.makeWrapper ];
  postBuild = ''
    wrapProgram $out/bin/signal-desktop --add-flags --password-store="kwallet6"
  '';
})

[ayumi-signal]

@dyercode Thank you for figuring out a Nix workaround.

For secret store migration, I checked all the issues and it seems like this one would be most appropriate for tracking, so we'll reopen it until migration is implemented.

[erisdev]

This just bit me in the ass too after upgrading to Plasma 6. There is no longer kwallet5 on my system, so I don't know what I am meant to do here.

I don't understand what purpose this feature serves. It seems to me the program is going out of its way to break?

[chainria]

This just bit me in the ass too after upgrading to Plasma 6. There is no longer kwallet5 on my system, so I don't know what I am meant to do here.

I don't understand what purpose this feature serves. It seems to me the program is going out of its way to break?

You need to use the flag --password-store="kwallet5" when starting it.
Just right-click on your Signal App entry in the menu and then "edit application"
Then you go to program and edit the arguments.
For instance this is what I am having there now:
--password-store=kwallet5 --use-tray-icon %U

[Marsup]

I got the same thing after upgrading to plasma 6 as well, this indeed works but looks more like a workaround than a solution. Since only kwallet6 is installed, it feels very counter-intuitive to ask for kwallet5 that is just not anywhere on the system.

[chainria]

I got the same thing after upgrading to plasma 6 as well, this indeed works but looks more like a workaround than a solution. Since only kwallet6 is installed, it feels very counter-intuitive to ask for kwallet5 that is just not anywhere on the system.

Well, I am pretty sure that Plasma 6 contains kwallet5 for now because not everything is ported yet. For now, at least.
Gentoo as an instance automatically keeps kwallet5 and kwallet6 around, it's hardcoded. So this shouldn't be an issue. Well, for now at least. This should get fixed though, because we are basically depending on something transitional now.

[Marsup]

The only kwallet package I have is 6.6. There is a libpam-kwallet5 package but it's a 6.1.5, so maybe a compat package 🤷🏻‍♂️

[peteh]

For the guys that struggle after KDE6 update:

Edit:

/home/USER_NAME/.config/Signal/config.json

FROM

{
"mediaPermissions": true,
"mediaCameraPermissions": true,
"encryptedKey": "***************************>
"safeStorageBackend": "kwallet5"
}

TO

{
"mediaPermissions": true,
"mediaCameraPermissions": true,
"encryptedKey": "***************************>
"safeStorageBackend": "kwallet6"
}

Source: https://forums.gentoo.org/viewtopic-p-8841636.html?sid=21c475171c7c7349dbbf3066f2612459

[chainria]

For the guys that struggle after KDE6 update:

Edit:

/home/USER_NAME/.config/Signal/config.json

FROM

{
"mediaPermissions": true,
"mediaCameraPermissions": true,
"encryptedKey": "***************************>
"safeStorageBackend": "kwallet5"
}

TO

{
"mediaPermissions": true,
"mediaCameraPermissions": true,
"encryptedKey": "***************************>
"safeStorageBackend": "kwallet6"
}

Source: https://forums.gentoo.org/viewtopic-p-8841636.html?sid=21c475171c7c7349dbbf3066f2612459

Thank you. That's a good enough solution for now. Still, I would prefer to migrate the data to libsecret (KeepassXC) but I can't find the right field in the kwallet. I'll just wait for the migration feature. For now, this is good enough for me.