[filing this as priority normal, since it might be a debhelper issue,
but it overwrites a local admin decision which is a policy violation]

Hi,

I have gnome-keyring installed because it is needed by bluedevil. I use
KDE, and I have a PIV ssh key on a yubikey. That mandates the use of the
OpenSSH ssh-agent. I therefore have gnome-keyring-daemon masked so that
it doesn't interfere with my ssh-agent.

Every gnome-keyring update removes that mask. Since it is overriding a
local admin decision, that is a policy violation.

I guess that the culprit is the following code from
gnome-keyring.postinst:

|# Automatically added by dh_installsystemduser/13.31
|if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ] ; then
|        if [ -z "$DPKG_ROOT" ] ; then
|                # The following line should be removed in trixie or trixie+1
|                deb-systemd-helper --user unmask 'gnome-keyring-daemon.service' >/dev/null || true

Greetings
Marc

That code is set by debhelper so I think you ought to report this
issue against debhelper.

Thank you,
Jeremy Bícha