CLI login with token fails on Windows 11 ARM WSL

[eliasylanen]

Environment (required):

• Computer: Microsoft Surface 7 ARM
• OS: Ubuntu 24.04 on Windows 11 WSL
• Version 3.26.0

Describe the bug

elias@LAPTOP-7VLOTAIM:~ $ echo "$TOKEN" | upctl account login --with-token
✗ Saving provided token to the system keyring.
  Error: failed to unlock correct collection '/org/freedesktop/secrets/aliases/default'
Error: Command execution failed for 1 resource(s)

Expected behavior
The login succeeds and ~/.config/upctl.yml is created

Observed behavior
The aforementioned error, and the config file remains uncreated

Additional context
Running WSL on a Windows ARM laptop, so the reason could lie with either one 😅
The exact same token and command has been confirmed working on plain AMD64 Fedora.

[kangasta]

Thank you for the bug report! Not sure if we have any Windows ARM machines around that we could use to debug this, so unfortunately might be a while until we can get this fixed unless there is a bug fix available in the keyring library we use. Workaround would be to use UPCLOUD_TOKEN environment variable to configure the token.

[mgajda]

@eliasylanen Did you try to unlock keyring first:

1. Inside a dbus session: dbus-run-session -- sh
2. Unlock keyring with: gnome-keyring-daemon --unlock
3. Proceed using upctl

It seems that WSL workarounds may harm security, and WSL keyring may not work for awhile.

I suggest adding a --no-keyring option and configuration variable that prevents crash.

[mgajda]

@eliasylanen Can you please check if option added in PR #653 works for you. (You may install PR after looking through changes using go install github.com/mgajda/upcloud-cli/cmd/upctl@feat/no-keyring.)

[kangasta]

There should be no need for --no-keyring flag: keyring has least priority when parsing the credentials, so with --no-keyring user would just get a slightly different error message. I.e., if credentials are defined in environment variables, the keyring should not be accessed. Maybe instead of adding --no-keyring flag the keyring access failed error message could be clarified.

For login --with-token, the --no-keyring flag would not make sense as we do not currently have any alternative methods for saving the token. One alternative would be to save the token to upctl configuration file, but in that case the parameter should be about allowing this less secure fallback.

[mgajda]

For login --with-token, the --no-keyring flag would not make sense as we do not currently have any alternative methods for saving the token. One alternative would be to save the token to upctl configuration file, but in that case the parameter should be about allowing this less secure fallback.

Indeed it would be better to have a separate file for credentials shared with other UpCloud CLI tools. However, there is clearly a bug in handling saving failure.

[eliasylanen]

Hi! I've been busy with work for the last few months, so haven't been able to return to this. I've also switched to full-on Linux, where this all just works, so I sadly won't be able to debug or test this any further on my end