From a4156dd79da599ce34ec3a6b4aa66d936c2f2168 Mon Sep 17 00:00:00 2001
From: Christopher Koch <ckoch@lazypug.net>
Date: Wed, 23 Sep 2026 15:54:31 -0400
Subject: [PATCH] Keep git credentials in the GNOME keyring

Bazzite answered git's password prompts from KDE Wallet via ksshaskpass, which
Ubuntu won't have. Build git's libsecret helper (Ubuntu ships it as source only)
and point credential.helper at it, falling back to a week-long credential cache
if the build isn't possible. Note in the README that the first Gitea push has to
re-enter the password, since keyrings aren't in the backup.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 README.md        |  3 +++
 scripts/setup.sh | 29 +++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/README.md b/README.md
index e43c9fb..168e9c9 100644
--- a/README.md
+++ b/README.md
@@ -143,6 +143,9 @@ boot; if Podman says the device is unknown, run
   this width.
 - **PIA VPN:** the official Linux app works on Ubuntu (it couldn't on Bazzite's read-only
   `/usr`). Download the installer from PIA and run it.
+- **Gitea:** your first `git push` asks for your username and password (or token) once —
+  KDE Wallet was answering that for you here, and the GNOME keyring takes over on Ubuntu.
+  Keyrings aren't in the backup, so no other password comes across either.
 
 ## Coming from Bazzite: what moved
 
diff --git a/scripts/setup.sh b/scripts/setup.sh
index dfd83e8..f3dcb2b 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -185,6 +185,35 @@ sudo systemctl daemon-reload
 sudo systemctl enable flatpak-update.timer
 
 # ---------------------------------------------------------------------------------------
+step "Git credentials in the keyring"
+# On Bazzite, KDE Wallet fed git your Gitea password through ksshaskpass. GNOME's keyring does
+# the same job via git's libsecret helper, which Ubuntu ships as source only — so build it.
+if ! git config --global --get credential.helper >/dev/null 2>&1; then
+  helper="" src=/usr/share/doc/git/contrib/credential/libsecret
+  if [[ -e $src/git-credential-libsecret.c || -e $src/git-credential-libsecret.c.gz ]]; then
+    apt_install libsecret-1-dev libglib2.0-dev
+    tmp=$(mktemp -d)
+    if [[ -e $src/git-credential-libsecret.c.gz ]]; then
+      zcat "$src/git-credential-libsecret.c.gz" > "$tmp/h.c"
+    else
+      cp "$src/git-credential-libsecret.c" "$tmp/h.c"
+    fi
+    read -ra cf < <(pkg-config --cflags libsecret-1 glib-2.0)
+    read -ra lf < <(pkg-config --libs libsecret-1 glib-2.0)
+    if cc -O2 "${cf[@]}" "$tmp/h.c" -o "$tmp/git-credential-libsecret" "${lf[@]}" 2>/dev/null; then
+      sudo install -m 755 "$tmp/git-credential-libsecret" /usr/local/bin/
+      helper=/usr/local/bin/git-credential-libsecret
+    fi
+    rm -rf "$tmp"
+  fi
+  if [[ -n $helper ]]; then
+    git config --global credential.helper "$helper"
+  else
+    git config --global credential.helper 'cache --timeout=604800'
+    warn "no keyring helper — git will hold your Gitea password for a week at a time instead"
+  fi
+fi
+
 step "Claude Code CLI"
 # No Node or .NET on the host by choice — LudosData and landingPage build in Docker.
 # If you want them back: sudo apt install mise dotnet-sdk-10.0 (mise needs ppa:jdxcode/mise).