working login

unity-ssh.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+unity_cli="${UNITY_CLI:-$HOME/.local/bin/unity}"
+if [[ ! -x "$unity_cli" ]]; then
+    echo "Set UNITY_CLI to the installed Unity CLI executable." >&2
+    exit 1
+fi
+
+# Always use a private bus, including when SSH inherited a desktop bus.
+if [[ "${1:-}" != --keyring-session ]]; then
+    exec dbus-run-session -- bash "$0" --keyring-session "$@"
+fi
+shift
+unset GNOME_KEYRING_CONTROL
+
+# Give Unity its own credential collection. Do not read or modify the user's
+# desktop login.keyring, which may be locked, damaged, or in use elsewhere.
+keyring_data_dir="${UNITY_SSH_KEYRING_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/unity-ssh}"
+umask 077
+mkdir -p "$keyring_data_dir"
+exec 9>"$keyring_data_dir/session.lock"
+if ! flock -n 9; then
+    echo "A Unity SSH keyring session is already open. Exit it before starting another." >&2
+    exit 1
+fi
+
+read -r -s -p "Unity keyring password (choose one on first use): " unity_keyring_password
+echo
+if [[ -z "$unity_keyring_password" ]]; then
+    echo "A nonempty password is required for the encrypted keyring." >&2
+    exit 1
+fi
+runtime_dir="$(mktemp -d "${TMPDIR:-/tmp}/unity-keyring.XXXXXX")"
+daemon_pid=""
+cleanup() {
+    if [[ -n "$daemon_pid" ]]; then
+        kill "$daemon_pid" 2>/dev/null || true
+        wait "$daemon_pid" 2>/dev/null || true
+    fi
+    rm -rf -- "$runtime_dir"
+}
+trap cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+# Keep the daemon on this bus, wait for it to register, and stop it on exit.
+# Only the daemon sees the alternate data directory; Unity keeps its normal
+# configuration and license-file locations.
+XDG_DATA_HOME="$keyring_data_dir" gnome-keyring-daemon \
+    --foreground --unlock --components=secrets --control-directory="$runtime_dir" \
+    < <(printf '%s' "$unity_keyring_password") >"$runtime_dir/daemon.log" 2>&1 &
+daemon_pid=$!
+unset unity_keyring_password
+
+owner='(false,)'
+for (( attempt=0; attempt<100; attempt++ )); do
+    owner="$(gdbus call --session --dest org.freedesktop.DBus \
+        --object-path /org/freedesktop/DBus \
+        --method org.freedesktop.DBus.NameHasOwner org.freedesktop.secrets)"
+    [[ "$owner" != '(true,)' ]] || break
+    kill -0 "$daemon_pid" 2>/dev/null || break
+    sleep 0.1
+done
+if [[ "$owner" != '(true,)' ]]; then
+    echo "The Unity keyring service did not start." >&2
+    cat "$runtime_dir/daemon.log" >&2
+    exit 1
+fi
+
+locked="$(gdbus call --session --dest org.freedesktop.secrets \
+    --object-path /org/freedesktop/secrets/collection/login \
+    --method org.freedesktop.DBus.Properties.Get org.freedesktop.Secret.Collection Locked 2>/dev/null)" || locked='missing'
+if [[ "$locked" != '(<false>,)' ]]; then
+    echo "Could not unlock the Unity keyring at $keyring_data_dir/keyrings." >&2
+    echo "Use the password chosen for this helper. No credential files were removed." >&2
+    exit 1
+fi
+
+# Check persistence before asking the user to complete a browser sign-in.
+probe="unity-ssh-$$-$RANDOM"
+printf '%s' "$probe" | timeout 10 secret-tool store --label='Unity SSH keyring check' unity-ssh-check "$probe"
+saved="$(timeout 10 secret-tool lookup unity-ssh-check "$probe")"
+timeout 10 secret-tool clear unity-ssh-check "$probe"
+if [[ "$saved" != "$probe" ]]; then
+    echo "The Unity keyring could not save and retrieve a test credential." >&2
+    exit 1
+fi
+echo "Unity keyring storage check passed."
+
+export PATH="$(dirname -- "$unity_cli"):$PATH"
+export UNITY_NO_CLI_INVOKED_TELEMETRY=1
+if [[ "${1:-}" == --check ]]; then
+    exit 0
+fi
+if (( $# )); then
+    "$unity_cli" "$@"
+    exit $?
+fi
+
+echo "Unity login shell ready. Run: unity auth login"
+echo "Open the printed sign-in URL in your own computer's browser."
+echo "After signing in and reviewing the Personal terms, run:"
+echo "  unity license activate --personal --accept-eula"
+echo "  unity license status"
+echo "Type exit to close this shell and its keyring session."
+bash --noprofile --norc -i