My YubiKey Logs Me In. My Keyring Never Got Told.
Log in with a YubiKey and GNOME asks for a password anyway, because the login keyring is encrypted with a password your login never produced. This post covers why pam_u2f being sufficient starves the keyring, what the usual fixes cost (blank password, typing it anyway, the TPM), and the fix I built: the key’s FIDO2 hmac-secret, gated on PIN and touch, decrypting a stored copy of the account password and unlocking oo7-daemon at login. Then what the build turned up: Fedora 45 had swapped gnome-keyring for oo7, oo7’s placeholder keyring takes the first password you type as its own, the FIDO2 tools only read a PIN from a terminal, and a reset script that would have left me with no keyring at all, caught by testing it against a throwaway daemon first. The scripts, an installer and that test harness are available to download.