Keep git credentials in the GNOME keyring

Bazzite answered git's password prompts from KDE Wallet via ksshaskpass, which
Ubuntu won't have. Build git's libsecret helper (Ubuntu ships it as source only)
and point credential.helper at it, falling back to a week-long credential cache
if the build isn't possible. Note in the README that the first Gitea push has to
re-enter the password, since keyrings aren't in the backup.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -143,6 +143,9 @@ boot; if Podman says the device is unknown, run
   this width.
 - **PIA VPN:** the official Linux app works on Ubuntu (it couldn't on Bazzite's read-only
   `/usr`). Download the installer from PIA and run it.
+- **Gitea:** your first `git push` asks for your username and password (or token) once —
+  KDE Wallet was answering that for you here, and the GNOME keyring takes over on Ubuntu.
+  Keyrings aren't in the backup, so no other password comes across either.
 
 ## Coming from Bazzite: what moved
 

scripts/setup.sh

@@ -185,6 +185,35 @@ sudo systemctl daemon-reload
 sudo systemctl enable flatpak-update.timer
 
 # ---------------------------------------------------------------------------------------
+step "Git credentials in the keyring"
+# On Bazzite, KDE Wallet fed git your Gitea password through ksshaskpass. GNOME's keyring does
+# the same job via git's libsecret helper, which Ubuntu ships as source only — so build it.
+if ! git config --global --get credential.helper >/dev/null 2>&1; then
+  helper="" src=/usr/share/doc/git/contrib/credential/libsecret
+  if [[ -e $src/git-credential-libsecret.c || -e $src/git-credential-libsecret.c.gz ]]; then
+    apt_install libsecret-1-dev libglib2.0-dev
+    tmp=$(mktemp -d)
+    if [[ -e $src/git-credential-libsecret.c.gz ]]; then
+      zcat "$src/git-credential-libsecret.c.gz" > "$tmp/h.c"
+    else
+      cp "$src/git-credential-libsecret.c" "$tmp/h.c"
+    fi
+    read -ra cf < <(pkg-config --cflags libsecret-1 glib-2.0)
+    read -ra lf < <(pkg-config --libs libsecret-1 glib-2.0)
+    if cc -O2 "${cf[@]}" "$tmp/h.c" -o "$tmp/git-credential-libsecret" "${lf[@]}" 2>/dev/null; then
+      sudo install -m 755 "$tmp/git-credential-libsecret" /usr/local/bin/
+      helper=/usr/local/bin/git-credential-libsecret
+    fi
+    rm -rf "$tmp"
+  fi
+  if [[ -n $helper ]]; then
+    git config --global credential.helper "$helper"
+  else
+    git config --global credential.helper 'cache --timeout=604800'
+    warn "no keyring helper — git will hold your Gitea password for a week at a time instead"
+  fi
+fi
+
 step "Claude Code CLI"
 # No Node or .NET on the host by choice — LudosData and landingPage build in Docker.
 # If you want them back: sudo apt install mise dotnet-sdk-10.0 (mise needs ppa:jdxcode/mise).