I wrote an app that creates and uses its own keyring. I'd like to have that keyring with secrets attributes and all sync via U1 so that the same passwords are available on all the Linux devices.

  1. How do you determine if U1 is setup on a users system?
  2. Does U1 provide any option for syncing the users keyring? If not, what would the preferred programmatic approach be?
  3. What special considerations when using U1 should be taken into account to ensure security? Are there any, or is this something more left to the developer tying into U1?


I'm looking for official documentation or pointers covering the above questions.


OK. Your keyring(s) are stored in $HOME/.gnome2/keyrings.

So, the obvious way to sync your keyrings across machines is... just mark that folder as a synced folder with U1. No APIs required!

That will, of course, sync all your keyrings, though, which I believe you don't want to do. So, the next step is this:

  1. create your keyring, which will be in its own file, ~/.gnome2/keyrings/yourkeyring.keyring
  2. Create a folder somewhere for your app -- ~/.local/share/yourapp/keyrings perhaps
  3. move ~/.gnome2/keyrings/yourkeyring.keyring to ~/.local/share/yourapp/keyrings
  4. place a symlink in ~/.gnome2/keyrings/ pointing to ~/.local/share/yourapp/keyrings/yourkeyring.keyring
  5. Mark ~/.local/share/yourapp/keyrings as a synced folder with Ubuntu One.

That should do what you want! As noted by RAOF, the keyring file is encrypted, so syncing it to U1 is no security risk. No APIs needed.

If you want to do this programmatically -- that is, your app has a "Sync my app's keyring" checkbox which turns this feature on and off -- then you will, of course, need to detect U1, and lead the user through signing up if they want to sync but don't yet have a U1 account. For this, use, from Python, ubuntuone.platform.tools.SyncDaemonTool which gives you full control over the Ubuntu One syncdaemon.

|improve this answer|||||
  • Is it a good idea to place yourkeyring.keyring into ~/Ubuntu One/.yourapp/keyrings folder as it is alway in sync. And then symlink it to ~/.gnome2/keyrings/ ? – wik Jul 7 '12 at 8:26

I can't give a full answer - I'm not familiar with all parts of this. Some of this answer depends on current implementation details of GNOME Keyring, so may change (but haven't for a number of years).

UbuntuOne doesn't (currently?) have any specific support for synchronising keyrings, sadly.

If you're creating a keyring in the GNOME keyring then that's stored in ~/.gnome2/keyrings/your_keyring_name.keyring. If you're ok with relying on a GNOME keyring implementation detail, this reduces the problem to "how can I sync a single file with U1".

Here, I can point you at a blog post by Stuart Langridge where he talks about almost exactly this problem. Particularly, there's an API for U1 files which has python bindings. It should be reasonably easy to adapt his Save into Ubuntu One script to do what you're after.

There shouldn't be anything particular that you need to do, security wise. The files are private by default, so they're not trivially accessible by random internet users, and the keyring files are encrypted with the password you created it with.

|improve this answer|||||
  • Incidentally, cool project. I've got something similar as a Do plugin, which is unreleased because it's stupid and just copies to the clipboard. – RAOF Feb 28 '12 at 4:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.