Bridge 1.6.3 loses configured accounts

Timost commented 3 years ago

Hi, First of all thank you for making Bridge.

Today, I updated from bridge 1.5.7-1 to 1.6.3-1. When launching the new version, it displays no configured account despite the fact that I have one account configured. After downgrading back to bridge 1.5.7-1, I can see my existing account again.

Expected Behavior

I would expect the existing account to be displayed in the new version and do not have to reconfigure it.

Current Behavior

The new version displays No accounts added and I have to go through the configuration process again.

Possible Solution

For now Downgrading back to 1.5.7-1 "solves" the tissue

Steps to Reproduce

Download the new protonmail-bridge_1.6.3-1_amd64.deb (https://protonmail.com/download/bridge/protonmail-bridge_1.6.3-1_amd64.deb)
install it sudo dpkg protonmail-bridge_1.6.3-1_amd64.deb
Open bridge
No accounts are displayed

Version Information

proton-bridge 1.6.3-1

Context (Environment)

Installed .deb packages, on Debian "bullseye".

Problem exists in Bridge 1.6.3-1. Worked fine before upgrading from 1.5.7-1

Timost commented 3 years ago

Also, I can't log in using 1.63-1. I'm getting a: add user to credentials store: pass not initialized: exit status 1: Error: password store is empty

jameshoulahan commented 3 years ago

Hi @Timost, this is an unfortunate bug in 1.6.3 which affects users who have both pass and gnome-keyring installed, where pass is not initialised. Sorry for the inconvenience, we hope to remedy this ASAP.

You can force bridge to use gnome-keyring by editing ~/.config/protonmail/bridge/prefs.json and changing preferred_keychain from pass-app to gnome-keyring ~~and restarting bridge~~ after closing bridge. This will be doable in an upcoming release from within the bridge settings itself.

Timost commented 3 years ago

Hi @jameshoulahan, Thank you for your help. If possible I would prefer not to use gnome-keyring. Looking at the changelog, I think I can live with 1.5.7-1 until a fix is ready. Let me know if I can help with testing or something else.

waterkip commented 3 years ago

I just want to add a small devitation from this bug report, this is what I get when running 1.6.3, the workaround posted in https://github.com/ProtonMail/proton-bridge/issues/169#issuecomment-780464871p works.

time="Feb 17 06:55:58.076" level=error msg="Could not get credentials from native keychain" error="exit status 2: gpg: decryption failed: No secret key\n" pkg=credentials user="xxxxx"

pera commented 3 years ago

FYI you need to close Bridge before modifying prefs.json, otherwise the settings will be overwritten.

jameshoulahan commented 3 years ago

Hi @Timost, perhaps I misunderstood your original situation.

I assumed you had been using gnome-keyring all along, and just had pass installed but not configured on your system. I therefore assumed you were affected by the bug in which we detect that pass is available but don't check that it is actually initialized.

However, you say you'd prefer not to use gnome-keyring. Does this mean you were using pass all along?

Where is your password store located -- is it at a non-default location? Perhaps you are experiencing #168, which I am still investigating (and cannot reproduce on Ubuntu 20.04.1).

Timost commented 3 years ago

No problem, I'm indeed already using pass and it's using a non default location, but I'm not using it for proton-bridge, at least not knowingly.

As far as I can remember, I didn't change any settings of protonmail-bridge. Is using pass a new addition of 1.6.3 ?

Edit: I'm indeed getting the same error as #168 when trying to login.

jameshoulahan commented 3 years ago

Thanks for the reply. Bridge supports pass and gnome-keyring, and has done for quite some time. The change in 1.6.3 was to implement backend work to enable users to configure which was used (with a GUI switcher coming in 1.6.4); previous behaviour was to always use pass if it was available and unlocked, otherwise to fallback to gnome-keyring.

If bridge is in fact using pass, you should find a directory called protonmail-credentials inside your password store. If that isn't the case, it means that bridge must be using gnome-keyring and you should see an entry protonmail/bridge/users/... by using some gnome-keyring GUI like seahorse.

Timost commented 3 years ago

Alright, thank you for the detailed explanation !

I don't have anything in my password store and I have an entry in gnome-keyring starting with protonmail/bridge/users/... (I learned something about bridge, thank you :pray: )

However in ~/.config/protonmail/bridge/prefs.json I have pass-app. I don't think I have ever changed this file, so here is what I'm thinking:

Maybe the way the default value for preferred_keychain is set, has been changed in a breaking manner (for debian users) ?
The fallback to gnome-keyring no longer works as intended in 1.6.3 ?

jameshoulahan commented 3 years ago

Great, that confirms that you were indeed using gnome-keyring all along, and changing preferred_keychain to gnome-keychain in prefs.json is the correct thing to do. This will be doable from within bridge itself in the next release.

Essentially, what happened is:

in 1.6.3, bridge tries to pick which keychain to use by default (either pass or gnome-keyring) in order to set a default value for preferred_keychain (this field wasn't there in previous versions)
it does this by checking which of the two are installed (but doesn't check whether they are usable, which is the bug)
if both are installed, it prefers pass (to match the behaviour of previous releases)

Timost commented 3 years ago

Ok thank you ! I confirm this works. I'm now using 1.6.3. Thank you for your help !

jameshoulahan commented 3 years ago

Thanks for assisting the investigation and I'm glad we got it resolved. UX should be better in an upcoming release; we'll improve the logic to only choose pass by default if it is both installed and usable.

waterkip commented 3 years ago

Can we keep the bug open? There is still an issue, the work around to set the preferred keychain works, but I'd like to use pass.

I used to use pass and it fails with 1.6.3:

├── protonmail-credentials
│   └── xxxx
│       └── yyyy

andrzejsza commented 3 years ago

the upcoming release will allow you to choose preferred keychain from the GUI. sure, will keep it open until the fix is out and confirmed working.

andrzejsza commented 3 years ago

all should be fine and working from 1.6.6 up. Let us know if otherwise.

Timost commented 3 years ago

Yes I think it's working properly on 1.6.6. Thank you ! :muscle: :pray:

ProtonMail / proton-bridge