Dear Maintainer,

I run KDE Plasma 6 on Debian Trixie. kwalletd6 was my sole secret
service provider, with credentials accumulated over years stored in its
wallet (~/.local/share/kwalletd/kdewallet.kwl). Installing evolution-ews
pulled in evolution-data-server, which hard-depends on gnome-keyring.
This led to the following

1. gnome-keyring's package installs a systemd user unit
(gnome-keyring-daemon.socket, WantedBy=sockets.target) which is
preset-enabled and starts unconditionally at login, regardless of
desktop environment. Note that the XDG autostart file correctly carries
OnlyShowIn=GNOME;Unity;MATE; — but the systemd unit has no equivalent
guard and ignores OnlyShowIn entirely.

2. At the next login, gnome-keyring-daemon started before kwalletd6 and
claimed the org.freedesktop.secrets D-Bus name, because the D-Bus
activation file
/usr/share/dbus-1/services/org.freedesktop.secrets.service hardcodes
gnome-keyring, and the systemd socket is activated earlier in the boot
sequence than kwalletd6's PAM-based startup.

3. Applications using libsecret (OTPClient, GitHub CLI, GitHub Copilot
CLI) could no longer find their credentials, which remained in
kwalletd6's wallet. They prompted for re-authentication. Therefore
credentials gradually accumulated in gnome-keyring, while the originals
remained stranded in kwalletd6 — two divergent credential stores with no
automatic reconciliation.

This is user-visible data loss in the sense that previously accessible
credentials become inaccessible without any warning.

The proposed fix (gnome-keyring | kwallet6 | libkf5wallet-bin |
keepassxc- full, as suggested by Roman Lebedev) would have prevented
this , since kwalletd was already satisfying the secret service role.

A related active bug: #1131636 reports that gnome-keyring's postinst
unmasks gnome-keyring-daemon.socket on every package upgrade, overriding
deliberate user decisions to disable it.

Thanks!
Carsten