Bug 679914 - Replace libgnomekeyring with libsecret.libsecret

11 files changed, 180 insertions, 463 deletions

diff --git a/configure.ac b/configure.ac
index cee40b388..5caa1f412 100644
--- a/configure.ac
+++ b/configure.ac
@@ -36,7 +36,7 @@ dnl Required Package Versions
 m4_define([glib_minimum_version], [2.32])
 m4_define([gtk_minimum_version], [3.2])
 m4_define([gcr_minimum_version], [3.4])
-m4_define([gnome_keyring_minimum_version], [2.20.1])
+m4_define([libsecret_minimum_version], [0.5])
 m4_define([libxml_minimum_version], [2.0.0])		dnl XXX Just a Guess
 m4_define([libsoup_minimum_version], [2.38.1])
 m4_define([libgdata_minimum_version], [0.10])
@@ -396,11 +396,11 @@ dnl ***********************************
 dnl Check for GNOME Keyring.
 dnl ***********************************
 if test x$os_win32 = xno; then
-	PKG_CHECK_MODULES(GNOME_KEYRING,
-		[gnome-keyring-1 >= gnome_keyring_minimum_version])
+	PKG_CHECK_MODULES(LIBSECRET,
+		[libsecret-unstable >= libsecret_minimum_version])
 fi
-AC_SUBST(GNOME_KEYRING_CFLAGS)
-AC_SUBST(GNOME_KEYRING_LIBS)
+AC_SUBST(LIBSECRET_CFLAGS)
+AC_SUBST(LIBSECRET_LIBS)
 
 dnl **********************************************************
 dnl gcr-base is needed for secure password exchange over D-Bus
@@ -1296,7 +1296,7 @@ PKG_CHECK_MODULES(SQLITE3, [sqlite3 >= sqlite_minimum_version])
 dnl ******************************
 dnl libedataserver flags
 dnl ******************************
-E_DATA_SERVER_DEPS="gio-2.0 gmodule-2.0 gnome-keyring-1 libxml-2.0 libsoup-2.4 $mozilla_nspr"
+E_DATA_SERVER_DEPS="gio-2.0 gmodule-2.0 libsecret-1 libxml-2.0 libsoup-2.4 $mozilla_nspr"
 
 EVO_SET_COMPILE_FLAGS(E_DATA_SERVER, $E_DATA_SERVER_DEPS, $MANUAL_NSPR_CFLAGS, $MANUAL_NSPR_LIBS)
 AC_SUBST(E_DATA_SERVER_CFLAGS)
@@ -1318,7 +1318,7 @@ if test "x$enable_maintainer_mode" = "xyes" ; then
 	AC_SUBST(FACTORY_GTK_LIBS)
 fi
 
-E_BACKEND_DEPS="gio-2.0 gmodule-2.0 gnome-keyring-1 libsoup-2.4 libxml-2.0"
+E_BACKEND_DEPS="gio-2.0 gmodule-2.0 libsecret-1 libsoup-2.4 libxml-2.0"
 
 dnl ******************************
 dnl libebackend flags
@@ -1330,7 +1330,7 @@ AC_SUBST(E_BACKEND_LIBS)
 dnl ******************************
 dnl evolution-addressbook flags
 dnl ******************************
-EVOLUTION_ADDRESSBOOK_DEPS="gio-2.0 libxml-2.0 libsoup-2.4 gnome-keyring-1"
+EVOLUTION_ADDRESSBOOK_DEPS="gio-2.0 libxml-2.0 libsoup-2.4 libsecret-1"
 
 EVO_SET_COMPILE_FLAGS(EVOLUTION_ADDRESSBOOK, $EVOLUTION_ADDRESSBOOK_DEPS)
 AC_SUBST(EVOLUTION_ADDRESSBOOK_CFLAGS)
@@ -1339,7 +1339,7 @@ AC_SUBST(EVOLUTION_ADDRESSBOOK_LIBS)
 dnl ******************************
 dnl evolution-calendar flags
 dnl ******************************
-EVOLUTION_CALENDAR_DEPS="gio-2.0 libical >= libical_minimum_version libsoup-2.4 libxml-2.0 gnome-keyring-1"
+EVOLUTION_CALENDAR_DEPS="gio-2.0 libical >= libical_minimum_version libsoup-2.4 libxml-2.0 libsecret-1"
 
 dnl *****
 dnl libical.pc from libical-0.43 has a bug in it's CFlags.
diff --git a/libebackend/e-authentication-session.c b/libebackend/e-authentication-session.c
index 138b024a8..3a4571730 100644
--- a/libebackend/e-authentication-session.c
+++ b/libebackend/e-authentication-session.c
@@ -53,6 +53,7 @@
 #include <string.h>
 #include <glib/gi18n-lib.h>
 #include <gcr/gcr-base.h>
+#include <libsecret/secret.h>
 
 /* Private D-Bus classes. */
 #include <e-dbus-authenticator.h>
@@ -102,11 +103,12 @@ enum {
 	PROP_SOURCE_UID
 };
 
-static GnomeKeyringPasswordSchema schema = {
-	GNOME_KEYRING_ITEM_GENERIC_SECRET,
+static SecretSchema schema = {
+	"org.gnome.Evolution.Data.Source",
+	SECRET_SCHEMA_DONT_MATCH_NAME,
 	{
 		{ KEYRING_ITEM_ATTRIBUTE_NAME,
-		  GNOME_KEYRING_ATTRIBUTE_TYPE_STRING },
+		  SECRET_SCHEMA_ATTRIBUTE_STRING },
 		{ NULL, 0 }
 	}
 };
@@ -1289,47 +1291,31 @@ e_authentication_session_store_password_sync (EAuthenticationSession *session,
                                               GCancellable *cancellable,
                                               GError **error)
 {
-	GnomeKeyringResult result;
-	const gchar *keyring;
+	gboolean result;
+	const gchar *collection;
 	const gchar *uid;
 	gchar *display_name;
 
 	g_return_val_if_fail (E_IS_AUTHENTICATION_SESSION (session), FALSE);
 	g_return_val_if_fail (password != NULL, FALSE);
 
-	/* XXX Synchronous gnome-keyring functions are not cancellable.
-	 *     Maybe they will be someday, but in the meantime check for
-	 *     cancellation ourselves before doing this. */
-	if (g_cancellable_set_error_if_cancelled (cancellable, error))
-		return FALSE;
-
 	if (permanently)
-		keyring = GNOME_KEYRING_DEFAULT;
+		collection = SECRET_COLLECTION_DEFAULT;
 	else
-		keyring = GNOME_KEYRING_SESSION;
+		collection = SECRET_COLLECTION_SESSION;
 
 	uid = e_authentication_session_get_source_uid (session);
 	display_name = g_strdup_printf (KEYRING_ITEM_DISPLAY_FORMAT, uid);
 
-	result = gnome_keyring_store_password_sync (
-		&schema, keyring, display_name, password,
-		KEYRING_ITEM_ATTRIBUTE_NAME, uid, NULL);
-
-	if (result == GNOME_KEYRING_RESULT_CANCELLED) {
-		g_cancellable_cancel (cancellable);
-		g_set_error_literal (
-			error, G_IO_ERROR, G_IO_ERROR_CANCELLED,
-			_("Keyring operation was cancelled"));
-
-	} else if (result != GNOME_KEYRING_RESULT_OK) {
-		g_set_error_literal (
-			error, E_AUTHENTICATION_SESSION_KEYRING_ERROR,
-			result, gnome_keyring_result_to_message (result));
-	}
+	result = secret_password_store_sync (
+		&schema, collection, display_name,
+		password, cancellable, error,
+		KEYRING_ITEM_ATTRIBUTE_NAME, uid,
+		NULL);
 
 	g_free (display_name);
 
-	return (result == GNOME_KEYRING_RESULT_OK);
+	return result;
 }
 
 /**
@@ -1464,53 +1450,30 @@ e_authentication_session_lookup_password_sync (EAuthenticationSession *session,
                                                gchar **password,
                                                GError **error)
 {
-	GnomeKeyringResult result;
 	const gchar *uid;
 	gchar *temp = NULL;
+	gboolean success = TRUE;
+	GError *local_error = NULL;
 
 	g_return_val_if_fail (E_IS_AUTHENTICATION_SESSION (session), FALSE);
 
-	/* XXX Synchronous gnome-keyring functions are not cancellable.
-	 *     Maybe they will be someday, but in the meantime check for
-	 *     cancellation ourselves before doing this. */
-	if (g_cancellable_set_error_if_cancelled (cancellable, error))
-		return FALSE;
-
 	uid = e_authentication_session_get_source_uid (session);
 
-	result = gnome_keyring_find_password_sync (
-		&schema, &temp, KEYRING_ITEM_ATTRIBUTE_NAME, uid, NULL);
-
-	/* Not finding a data source password is not an error. */
-	if (result == GNOME_KEYRING_RESULT_NO_MATCH) {
-		result = GNOME_KEYRING_RESULT_OK;
-		gnome_keyring_free_password (temp);
-		temp = NULL;
-
-	} else if (result == GNOME_KEYRING_RESULT_CANCELLED) {
-		g_cancellable_cancel (cancellable);
-		g_set_error_literal (
-			error, G_IO_ERROR, G_IO_ERROR_CANCELLED,
-			_("Keyring operation was cancelled"));
-		g_warn_if_fail (temp == NULL);
+	temp = secret_password_lookup_sync (
+		&schema, cancellable, &local_error,
+		KEYRING_ITEM_ATTRIBUTE_NAME, uid, NULL);
 
-	} else if (result != GNOME_KEYRING_RESULT_OK) {
-		g_set_error_literal (
-			error, E_AUTHENTICATION_SESSION_KEYRING_ERROR,
-			result, gnome_keyring_result_to_message (result));
+	if (local_error != NULL) {
 		g_warn_if_fail (temp == NULL);
+		g_propagate_error (error, local_error);
+		success = FALSE;
+	} else if (password != NULL) {
+		*password = temp;  /* takes ownership */
+	} else {
+		secret_password_free (temp);
 	}
 
-	/* Do not impose gnome-keyring's non-pageable memory API on the
-	 * caller, it's not worth the hassle.  Return a newly-allocated
-	 * string so the caller can free it with g_free(). */
-	if (password != NULL)
-		*password = g_strdup (temp);
-
-	if (temp != NULL)
-		gnome_keyring_free_password (temp);
-
-	return (result == GNOME_KEYRING_RESULT_OK);
+	return success;
 }
 
 /**
@@ -1646,39 +1609,27 @@ e_authentication_session_delete_password_sync (EAuthenticationSession *session,
                                                GCancellable *cancellable,
                                                GError **error)
 {
-	GnomeKeyringResult result;
 	const gchar *uid;
+	gboolean success = TRUE;
+	GError *local_error = NULL;
 
 	g_return_val_if_fail (E_IS_AUTHENTICATION_SESSION (session), FALSE);
 
-	/* XXX Synchronous gnome-keyring functions are not cancellable.
-	 *     Maybe they will be someday, but in the meantime check for
-	 *     cancellation ourselves before doing this. */
-	if (g_cancellable_set_error_if_cancelled (cancellable, error))
-		return FALSE;
-
 	uid = e_authentication_session_get_source_uid (session);
 
-	result = gnome_keyring_delete_password_sync (
-		&schema, KEYRING_ITEM_ATTRIBUTE_NAME, uid, NULL);
-
-	/* Not finding a data source password is not an error. */
-	if (result == GNOME_KEYRING_RESULT_NO_MATCH) {
-		result = GNOME_KEYRING_RESULT_OK;
-
-	} else if (result == GNOME_KEYRING_RESULT_CANCELLED) {
-		g_cancellable_cancel (cancellable);
-		g_set_error_literal (
-			error, G_IO_ERROR, G_IO_ERROR_CANCELLED,
-			_("Keyring operation was cancelled"));
+	/* The return value indicates whether any passwords were removed,
+	 * not whether the operation completed successfully.  So we have
+	 * check the GError directly. */
+	secret_password_clear_sync (
+		&schema, cancellable, &local_error,
+		KEYRING_ITEM_ATTRIBUTE_NAME, uid, NULL);
 
-	} else if (result != GNOME_KEYRING_RESULT_OK) {
-		g_set_error_literal (
-			error, E_AUTHENTICATION_SESSION_KEYRING_ERROR,
-			result, gnome_keyring_result_to_message (result));
+	if (local_error != NULL) {
+		g_propagate_error (error, local_error);
+		success = FALSE;
 	}
 
-	return (result == GNOME_KEYRING_RESULT_OK);
+	return success;
 }
 
 /**
diff --git a/libebackend/e-authentication-session.h b/libebackend/e-authentication-session.h
index be0afec81..d9ca0a880 100644
--- a/libebackend/e-authentication-session.h
+++ b/libebackend/e-authentication-session.h
@@ -25,10 +25,6 @@
 
 #include <gio/gio.h>
 
-/* This needs to be in the public header since we're
- * reusing the GnomeKeyringResult enum for error codes. */
-#include <gnome-keyring.h>
-
 #include <libedataserver/libedataserver.h>
 
 #include <libebackend/e-backend-enums.h>
@@ -55,9 +51,9 @@
 /**
  * E_AUTHENTICATION_SESSION_KEYRING_ERROR:
  *
- * Error domain for password storage and retrieval.  Error codes in this
- * domain are defined by the #GnomeKeyringResult enumeration.  See #GError
- * for information on error domains.
+ * Error domain for password storage and retrieval.
+ *
+ * No longer used.
  *
  * Since: 3.6
  **/
diff --git a/libedataserverui/Makefile.am b/libedataserverui/Makefile.am
index abecb126f..aee706137 100644
--- a/libedataserverui/Makefile.am
+++ b/libedataserverui/Makefile.am
@@ -15,7 +15,7 @@ libedataserverui_3_0_la_CPPFLAGS = 		\
 	-DG_LOG_DOMAIN=\"e-data-server-ui\"	\
 	-DE_DATA_SERVER_UI_UIDIR=\""$(uidir)"\"	\
 	$(E_DATA_SERVER_UI_CFLAGS)		\
-	$(GNOME_KEYRING_CFLAGS)			\
+	$(LIBSECRET_CFLAGS)			\
 	$(CAMEL_CFLAGS)				\
 	$(SOUP_CFLAGS)				\
 	$(CODE_COVERAGE_CFLAGS)			\
@@ -82,7 +82,7 @@ libedataserverui_3_0_la_LIBADD = 				\
 	$(top_builddir)/libebackend/libebackend-1.2.la		\
 	$(top_builddir)/camel/libcamel-1.2.la			\
 	$(E_DATA_SERVER_UI_LIBS)				\
-	$(GNOME_KEYRING_LIBS)					\
+	$(LIBSECRET_LIBS)					\
 	$(CAMEL_LIBS)						\
 	$(SOUP_LIBS)
 
diff --git a/libedataserverui/e-passwords.c b/libedataserverui/e-passwords.c
index 96ce70e0b..f54bcf35d 100644
--- a/libedataserverui/e-passwords.c
+++ b/libedataserverui/e-passwords.c
@@ -46,7 +46,7 @@
 #include <string.h>
 #include <gtk/gtk.h>
 #include <glib/gi18n-lib.h>
-#include <gnome-keyring.h>
+#include <libsecret/secret.h>
 
 #include <libedataserver/libedataserver.h>
 
@@ -81,6 +81,18 @@ struct _EPassMsg {
 				 * dispatch functions from others */
 };
 
+/* XXX probably want to share this with evalution-source-registry-migrate-sources.c */
+static const SecretSchema e_passwords_schema = {
+	"org.gnome.Evolution.Password",
+	SECRET_SCHEMA_DONT_MATCH_NAME,
+	{
+		{ "application", SECRET_SCHEMA_ATTRIBUTE_STRING, },
+		{ "user", SECRET_SCHEMA_ATTRIBUTE_STRING, },
+		{ "server", SECRET_SCHEMA_ATTRIBUTE_STRING, },
+		{ "protocol", SECRET_SCHEMA_ATTRIBUTE_STRING, },
+	}
+};
+
 G_LOCK_DEFINE_STATIC (passwords);
 static GThread *main_thread = NULL;
 static GHashTable *password_cache = NULL;
@@ -88,21 +100,6 @@ static GtkDialog *password_dialog = NULL;
 static GQueue message_queue = G_QUEUE_INIT;
 static gint idle_id;
 static gint ep_online_state = TRUE;
-static gchar *default_keyring = NULL;
-
-/* XXX Unfortunately, gnome-keyring doesn't use GErrors. */
-#define EP_KEYRING_ERROR	(ep_keyring_error_domain ())
-
-static GQuark
-ep_keyring_error_domain (void)
-{
-	static GQuark quark = 0;
-
-	if (G_UNLIKELY (quark == 0))
-		quark = g_quark_from_static_string ("ep-keyring-error-quark");
-
-	return quark;
-}
 
 static EUri *
 ep_keyring_uri_new (const gchar *string,
@@ -121,8 +118,8 @@ ep_keyring_uri_new (const gchar *string,
 	/* Make sure the URI has the required components. */
 	if (uri->user == NULL && uri->host == NULL) {
 		g_set_error_literal (
-			error, EP_KEYRING_ERROR,
-			GNOME_KEYRING_RESULT_BAD_ARGUMENTS,
+			error, G_IO_ERROR,
+			G_IO_ERROR_INVALID_ARGUMENT,
 			_("Keyring key is unusable: no user or host name"));
 		e_uri_free (uri);
 		uri = NULL;
@@ -132,187 +129,6 @@ ep_keyring_uri_new (const gchar *string,
 }
 
 static gboolean
-ep_keyring_validate (const gchar *user,
-                     const gchar *server,
-                     const gchar *protocol,
-                     GnomeKeyringAttributeList *attributes)
-{
-	const gchar *user_value = NULL;
-	const gchar *server_value = NULL;
-	const gchar *protocol_value = NULL;
-	gint ii;
-
-	g_return_val_if_fail (attributes != NULL, FALSE);
-
-	/* Is there anything to validate? */
-	if (user == NULL && server == NULL && protocol == NULL)
-		return TRUE;
-
-	/* Look for "user", "server", and "protocol" attributes. */
-	for (ii = 0; ii < attributes->len; ii++) {
-		GnomeKeyringAttribute *attr;
-
-		attr = &g_array_index (attributes, GnomeKeyringAttribute, ii);
-
-		/* Just assume the attribute values are strings. */
-		if (strcmp (attr->name, "user") == 0)
-			user_value = attr->value.string;
-		else if (strcmp (attr->name, "server") == 0)
-			server_value = attr->value.string;
-		else if (strcmp (attr->name, "protocol") == 0)
-			protocol_value = attr->value.string;
-	}
-
-	/* Is there a "user" attribute? */
-	if (user != NULL && user_value == NULL)
-		return FALSE;
-
-	/* Does it match what we're looking for? */
-	if (user != NULL && strcmp (user, user_value) != 0)
-		return FALSE;
-
-	/* Is there a "server" attribute? */
-	if (server != NULL && server_value == NULL)
-		return FALSE;
-
-	/* Does it match what we're looking for? */
-	if (server != NULL && strcmp (server, server_value) != 0)
-		return FALSE;
-
-	/* Is there a "protocol" attribute? */
-	if (protocol != NULL && protocol_value == NULL)
-		return FALSE;
-
-	/* Does it match what we're looking for? */
-	if (protocol != NULL && strcmp (protocol, protocol_value) != 0)
-		return FALSE;
-
-	return TRUE;
-}
-
-static gboolean
-ep_keyring_delete_passwords (const gchar *user,
-                             const gchar *server,
-                             const gchar *protocol,
-                             GList *passwords,
-                             GError **error)
-{
-	while (passwords != NULL) {
-		GnomeKeyringFound *found = passwords->data;
-		GnomeKeyringResult result;
-
-		/* Validate the item before deleting it. */
-		if (!ep_keyring_validate (user, server, protocol, found->attributes)) {
-			/* XXX We didn't always store protocols in the
-			 *     keyring, so for backward-compatibility
-			 *     try validating by user and server only. */
-			if (!ep_keyring_validate (user, server, NULL, found->attributes)) {
-				passwords = g_list_next (passwords);
-				continue;
-			}
-		}
-
-		result = gnome_keyring_item_delete_sync (NULL, found->item_id);
-		if (result != GNOME_KEYRING_RESULT_OK) {
-			g_set_error (
-				error, EP_KEYRING_ERROR, result,
-				"Unable to delete password in "
-				"keyring (Keyring reports: %s)",
-				gnome_keyring_result_to_message (result));
-			return FALSE;
-		}
-
-		passwords = g_list_next (passwords);
-	}
-
-	return TRUE;
-}
-
-static gboolean
-ep_keyring_insert_password (const gchar *user,
-                            const gchar *server,
-                            const gchar *protocol,
-                            const gchar *display_name,
-                            const gchar *password,
-                            GError **error)
-{
-	GnomeKeyringAttributeList *attributes;
-	GnomeKeyringResult result;
-	guint32 item_id;
-
-	g_return_val_if_fail (user != NULL, FALSE);
-	g_return_val_if_fail (server != NULL, FALSE);
-	g_return_val_if_fail (protocol != NULL, FALSE);
-	g_return_val_if_fail (display_name != NULL, FALSE);
-	g_return_val_if_fail (password != NULL, FALSE);
-
-	attributes = gnome_keyring_attribute_list_new ();
-	gnome_keyring_attribute_list_append_string (
-		attributes, "application", "Evolution");
-	gnome_keyring_attribute_list_append_string (
-		attributes, "user", user);
-	gnome_keyring_attribute_list_append_string (
-		attributes, "server", server);
-	gnome_keyring_attribute_list_append_string (
-		attributes, "protocol", protocol);
-
-	/* XXX We don't use item_id but gnome-keyring doesn't allow
-	 *     for a NULL pointer.  In fact it doesn't even check! */
-	result = gnome_keyring_item_create_sync (
-		NULL, GNOME_KEYRING_ITEM_NETWORK_PASSWORD,
-		display_name, attributes, password, TRUE, &item_id);
-	if (result != GNOME_KEYRING_RESULT_OK) {
-		g_set_error (
-			error, EP_KEYRING_ERROR, result,
-			"Unable to create password in "
-			"keyring (Keyring reports: %s)",
-			gnome_keyring_result_to_message (result));
-	}
-
-	gnome_keyring_attribute_list_free (attributes);
-
-	return (result == GNOME_KEYRING_RESULT_OK);
-}
-
-static GList *
-ep_keyring_lookup_passwords (const gchar *user,
-                             const gchar *server,
-                             const gchar *protocol,
-                             GError **error)
-{
-	GnomeKeyringAttributeList *attributes;
-	GnomeKeyringResult result;
-	GList *passwords = NULL;
-
-	attributes = gnome_keyring_attribute_list_new ();
-	gnome_keyring_attribute_list_append_string (
-		attributes, "application", "Evolution");
-	if (user != NULL)
-		gnome_keyring_attribute_list_append_string (
-			attributes, "user", user);
-	if (server != NULL)
-		gnome_keyring_attribute_list_append_string (
-			attributes, "server", server);
-	if (protocol != NULL)
-		gnome_keyring_attribute_list_append_string (
-			attributes, "protocol", protocol);
-
-	result = gnome_keyring_find_items_sync (
-		GNOME_KEYRING_ITEM_NETWORK_PASSWORD, attributes, &passwords);
-	if (result != GNOME_KEYRING_RESULT_OK) {
-		g_set_error (
-			error, EP_KEYRING_ERROR, result,
-			"Unable to find password(s) in "
-			"keyring (Keyring reports: %s)",
-			gnome_keyring_result_to_message (result));
-	}
-
-	gnome_keyring_attribute_list_free (attributes);
-
-	return passwords;
-}
-
-static gboolean
 ep_idle_dispatch (gpointer data)
 {
 	EPassMsg *msg;
@@ -393,43 +209,12 @@ ep_msg_send (EPassMsg *msg)
 static void
 ep_clear_passwords (EPassMsg *msg)
 {
-	GList *passwords;
 	GError *error = NULL;
 
 	/* Find all Evolution passwords and delete them. */
-	passwords = ep_keyring_lookup_passwords (NULL, NULL, NULL, &error);
-	if (passwords != NULL) {
-		ep_keyring_delete_passwords (NULL, NULL, NULL, passwords, &error);
-		gnome_keyring_found_list_free (passwords);
-	}
-
-	/* Not finding the requested key is acceptable, but we still
-	 * want to leave an informational message on the terminal. */
-	if (g_error_matches (error, EP_KEYRING_ERROR, GNOME_KEYRING_RESULT_NO_MATCH)) {
-		g_message ("%s", error->message);
-		g_error_free (error);
-
-	} else if (error != NULL)
-		g_propagate_error (&msg->error, error);
-
-	if (!msg->noreply)
-		e_flag_set (msg->done);
-}
-
-static void
-ep_forget_passwords (EPassMsg *msg)
-{
-	GList *passwords;
-	GError *error = NULL;
-
-	g_hash_table_remove_all (password_cache);
-
-	/* Find all Evolution passwords and delete them. */
-	passwords = ep_keyring_lookup_passwords (NULL, NULL, NULL, &error);
-	if (passwords != NULL) {
-		ep_keyring_delete_passwords (NULL, NULL, NULL, passwords, &error);
-		gnome_keyring_found_list_free (passwords);
-	}
+	secret_password_clear_sync (
+		&e_passwords_schema, NULL, &error,
+		"application", "Evolution", NULL);
 
 	if (error != NULL)
 		g_propagate_error (&msg->error, error);
@@ -455,12 +240,22 @@ ep_remember_password (EPassMsg *msg)
 	if (uri == NULL)
 		goto exit;
 
+	secret_password_store_sync (
+		&e_passwords_schema,
+		SECRET_COLLECTION_DEFAULT,
+		msg->key, password,
+		NULL, &error,
+		"application", "Evolution",
+		"user", uri->user,
+		"server", uri->host,
+		"protocol", uri->protocol,
+		NULL);
+
 	/* Only remove the password from the session hash
 	 * if the keyring insertion was successful. */
-	if (ep_keyring_insert_password (uri->user, uri->host, uri->protocol, msg->key, password, &error))
+	if (error == NULL)
 		g_hash_table_remove (password_cache, msg->key);
-
-	if (error != NULL)
+	else
 		g_propagate_error (&msg->error, error);
 
 	e_uri_free (uri);
@@ -473,7 +268,6 @@ exit:
 static void
 ep_forget_password (EPassMsg *msg)
 {
-	GList *passwords;
 	EUri *uri;
 	GError *error = NULL;
 
@@ -491,11 +285,12 @@ ep_forget_password (EPassMsg *msg)
 	 *     to ep_keyring_delete_passwords(), which also knows about
 	 *     the backward-compatibility issue and will filter the list
 	 *     appropriately. */
-	passwords = ep_keyring_lookup_passwords (uri->user, uri->host, NULL, &error);
-	if (passwords != NULL) {
-		ep_keyring_delete_passwords (uri->user, uri->host, uri->protocol, passwords, &error);
-		gnome_keyring_found_list_free (passwords);
-	}
+	secret_password_clear_sync (
+		&e_passwords_schema, NULL, &error,
+		"application", "Evolution",
+		"user", uri->user,
+		"server", uri->host,
+		NULL);
 
 	if (error != NULL)
 		g_propagate_error (&msg->error, error);
@@ -511,7 +306,6 @@ static void
 ep_get_password (EPassMsg *msg)
 {
 	EUri *uri;
-	GList *passwords;
 	gchar *password;
 	GError *error = NULL;
 
@@ -526,73 +320,34 @@ ep_get_password (EPassMsg *msg)
 	if (uri == NULL)
 		goto exit;
 
-	/* Find the first Evolution password that matches the URI. */
-	passwords = ep_keyring_lookup_passwords (uri->user, uri->host, uri->protocol, &error);
-	if (passwords != NULL) {
-		GList *iter = passwords;
-
-		while (iter != NULL) {
-			GnomeKeyringFound *found = iter->data;
-
-			if (default_keyring && strcmp (default_keyring, found->keyring) != 0) {
-				g_message ("Received a password from keyring '%s'. But looking for the password from '%s' keyring\n", found->keyring, default_keyring);
-				iter = g_list_next (iter);
-				continue;
-			}
-
-			if (ep_keyring_validate (uri->user, uri->host, uri->protocol, found->attributes)) {
-				msg->password = g_strdup (found->secret);
-				break;
-			}
-
-			iter = g_list_next (iter);
-		}
-
-		gnome_keyring_found_list_free (passwords);
-	}
+	msg->password = secret_password_lookup_sync (
+		&e_passwords_schema, NULL, &error,
+		"application", "Evolution",
+		"user", uri->user,
+		"server", uri->host,
+		"protocol", uri->protocol,
+		NULL);
 
 	if (msg->password != NULL)
 		goto done;
 
-	/* Clear the previous error, if there was one.  If the error was
-	 * something other than NO_MATCH then it's likely to occur again. */
+	/* Clear the previous error, if there was one.
+	 * It's likely to occur again. */
 	if (error != NULL)
 		g_clear_error (&error);
 
 	/* XXX We didn't always store protocols in the keyring, so for
 	 *     backward-compatibility we also need to lookup passwords
 	 *     by user and host only (no protocol). */
-	passwords = ep_keyring_lookup_passwords (uri->user, uri->host, NULL, &error);
-	if (passwords != NULL) {
-		GList *iter = passwords;
-
-		while (iter != NULL) {
-			GnomeKeyringFound *found = iter->data;
-
-			if (default_keyring && strcmp (default_keyring, found->keyring) != 0) {
-				g_message ("Received a password from keyring '%s'. But looking for the password from '%s' keyring\n", found->keyring, default_keyring);
-				iter = g_list_next (iter);
-				continue;
-			}
-			if (ep_keyring_validate (uri->user, uri->host, NULL, found->attributes)) {
-				msg->password = g_strdup (found->secret);
-				break;
-			}
-
-			iter = g_list_next (iter);
-		}
-
-		gnome_keyring_found_list_free (passwords);
-	}
+	msg->password = secret_password_lookup_sync (
+		&e_passwords_schema, NULL, &error,
+		"application", "Evolution",
+		"user", uri->user,
+		"server", uri->host,
+		NULL);
 
 done:
-	/* Not finding the requested key is acceptable, but we still
-	 * want to leave an informational message on the terminal. */
-	if (g_error_matches (error, EP_KEYRING_ERROR, GNOME_KEYRING_RESULT_NO_MATCH)) {
-		g_message ("%s", error->message);
-		g_error_free (error);
-
-	} else if (error != NULL)
+	if (error != NULL)
 		g_propagate_error (&msg->error, error);
 
 	e_uri_free (uri);
@@ -873,8 +628,6 @@ e_passwords_init (void)
 			(GDestroyNotify) g_free,
 			(GDestroyNotify) g_free);
 		main_thread = g_thread_self ();
-
-		gnome_keyring_get_default_keyring_sync (&default_keyring);
 	}
 
 	G_UNLOCK (passwords);
@@ -920,8 +673,6 @@ e_passwords_shutdown (void)
 		password_cache = NULL;
 	}
 
-	g_free (default_keyring);
-
 	G_UNLOCK (passwords);
 
 	if (password_dialog != NULL)
@@ -953,7 +704,7 @@ e_passwords_set_online (gint state)
 void
 e_passwords_forget_passwords (void)
 {
-	EPassMsg *msg = ep_msg_new (ep_forget_passwords);
+	EPassMsg *msg = ep_msg_new (ep_clear_passwords);
 
 	ep_msg_send (msg);
 	ep_msg_free (msg);
diff --git a/modules/online-accounts/module-online-accounts.c b/modules/online-accounts/module-online-accounts.c
index 27ea615fd..b150c5bd0 100644
--- a/modules/online-accounts/module-online-accounts.c
+++ b/modules/online-accounts/module-online-accounts.c
@@ -21,7 +21,7 @@
 
 #include <config.h>
 #include <goa/goa.h>
-#include <gnome-keyring.h>
+#include <libsecret/secret.h>
 
 #include <libebackend/libebackend.h>
 
@@ -59,11 +59,14 @@ struct _EOnlineAccountsClass {
 #define KEYRING_ITEM_DISPLAY_FORMAT	"Evolution Data Source %s"
 
 #ifdef HAVE_GOA_PASSWORD_BASED
-static GnomeKeyringPasswordSchema schema = {
-	GNOME_KEYRING_ITEM_GENERIC_SECRET,
+/* XXX Probably want to share this with
+ *     evolution-source-registry-migrate-sources.c */
+static SecretSchema schema = {
+	"org.gnome.Evolution.DataSource",
+	SECRET_SCHEMA_DONT_MATCH_NAME,
 	{
 		{ KEYRING_ITEM_ATTRIBUTE_NAME,
-		  GNOME_KEYRING_ATTRIBUTE_TYPE_STRING },
+		  SECRET_SCHEMA_ATTRIBUTE_STRING },
 		{ NULL, 0 }
 	}
 };
@@ -273,7 +276,6 @@ online_accounts_config_password (EOnlineAccounts *extension,
 #ifdef HAVE_GOA_PASSWORD_BASED
 	GoaAccount *goa_account;
 	GoaPasswordBased *goa_password_based;
-	GnomeKeyringResult keyring_result;
 	EAsyncClosure *closure;
 	GAsyncResult *result;
 	const gchar *uid;
@@ -322,24 +324,25 @@ online_accounts_config_password (EOnlineAccounts *extension,
 	uid = e_source_get_uid (source);
 	display_name = g_strdup_printf (KEYRING_ITEM_DISPLAY_FORMAT, uid);
 
-	/* XXX Just call gnome-keyring synchronously.  I know it's
-	 *     evil, but I want to know the password has been stored
-	 *     before returning from this function.  We'll be moving
-	 *     to libsecret soon anyway, which is more GIO-based, so
-	 *     we could then reuse the EAsyncClosure here. */
-	keyring_result = gnome_keyring_store_password_sync (
-		&schema, GNOME_KEYRING_DEFAULT, display_name,
-		password, KEYRING_ITEM_ATTRIBUTE_NAME, uid, NULL);
+	secret_password_store (
+		&schema, SECRET_COLLECTION_DEFAULT,
+		display_name, password, NULL,
+		e_async_closure_callback, closure,
+		KEYRING_ITEM_ATTRIBUTE_NAME, uid,
+		NULL);
+
+	result = e_async_closure_wait (closure);
+
+	secret_password_store_finish (result, &error);
 
 	g_free (display_name);
 
 	/* If we fail to store the password, we'll just end up prompting
 	 * for a password like normal.  Annoying, maybe, but not the end
 	 * of the world.  Still leave a breadcrumb for debugging though. */
-	if (keyring_result != GNOME_KEYRING_RESULT_OK) {
-		const gchar *message;
-		message = gnome_keyring_result_to_message (keyring_result);
-		g_warning ("%s: %s", G_STRFUNC, message);
+	if (error != NULL) {
+		g_warning ("%s: %s", G_STRFUNC, error->message);
+		g_error_free (error);
 	}
 
 exit:
diff --git a/services/evolution-addressbook-factory/Makefile.am b/services/evolution-addressbook-factory/Makefile.am
index dbd9f812b..6a8525a14 100644
--- a/services/evolution-addressbook-factory/Makefile.am
+++ b/services/evolution-addressbook-factory/Makefile.am
@@ -19,7 +19,7 @@ evolution_addressbook_factory_CPPFLAGS = \
 	-I$(top_builddir) \
 	-I$(top_builddir)/addressbook \
 	$(EVOLUTION_ADDRESSBOOK_CFLAGS) \
-	$(GNOME_KEYRING_CFLAGS) \
+	$(LIBSECRET_CFLAGS) \
 	$(FACTORY_GTK_CFLAGS) \
 	$(CAMEL_CFLAGS) \
 	$(SOUP_CFLAGS) \
@@ -37,7 +37,7 @@ evolution_addressbook_factory_LDADD = \
 	$(top_builddir)/libebackend/libebackend-1.2.la \
 	$(top_builddir)/libedataserver/libedataserver-1.2.la \
 	$(EVOLUTION_ADDRESSBOOK_LIBS) \
-	$(GNOME_KEYRING_LIBS) \
+	$(LIBSECRET_LIBS) \
 	$(FACTORY_GTK_LIBS) \
 	$(CAMEL_LIBS) \
 	$(SOUP_LIBS) \
diff --git a/services/evolution-calendar-factory/Makefile.am b/services/evolution-calendar-factory/Makefile.am
index 2840057fc..2bdb1a401 100644
--- a/services/evolution-calendar-factory/Makefile.am
+++ b/services/evolution-calendar-factory/Makefile.am
@@ -19,7 +19,7 @@ evolution_calendar_factory_CPPFLAGS = \
 	-I$(top_builddir) \
 	-I$(top_builddir)/calendar \
 	$(EVOLUTION_CALENDAR_CFLAGS) \
-	$(GNOME_KEYRING_CFLAGS) \
+	$(LIBSECRET_CFLAGS) \
 	$(FACTORY_GTK_CFLAGS) \
 	$(CAMEL_CFLAGS) \
 	$(SOUP_CFLAGS) \
@@ -36,7 +36,7 @@ evolution_calendar_factory_LDADD = \
 	$(top_builddir)/libebackend/libebackend-1.2.la \
 	$(top_builddir)/libedataserver/libedataserver-1.2.la \
 	$(EVOLUTION_CALENDAR_LIBS) \
-	$(GNOME_KEYRING_LIBS) \
+	$(LIBSECRET_LIBS) \
 	$(FACTORY_GTK_LIBS) \
 	$(CAMEL_CFLAGS) \
 	$(SOUP_LIBS) \
diff --git a/services/evolution-source-registry/Makefile.am b/services/evolution-source-registry/Makefile.am
index 4e65ea221..fc23ee6c6 100644
--- a/services/evolution-source-registry/Makefile.am
+++ b/services/evolution-source-registry/Makefile.am
@@ -17,7 +17,7 @@ evolution_source_registry_CPPFLAGS = \
 	-DG_LOG_DOMAIN=\"evolution-source-registry\" \
 	-DLOCALEDIR=\"$(localedir)\" \
 	$(E_DATA_SERVER_CFLAGS) \
-	$(GNOME_KEYRING_CFLAGS) \
+	$(LIBSECRET_CFLAGS) \
 	$(CAMEL_CFLAGS) \
 	$(SOUP_CFLAGS) \
 	$(NULL)
@@ -33,7 +33,7 @@ evolution_source_registry_LDADD = \
 	$(top_builddir)/libedataserver/libedataserver-1.2.la \
 	$(top_builddir)/camel/libcamel-1.2.la \
 	$(E_DATA_SERVER_LIBS) \
-	$(GNOME_KEYRING_LIBS) \
+	$(LIBSECRET_LIBS) \
 	$(CAMEL_LIBS) \
 	$(SOUP_LIBS) \
 	$(NULL)
diff --git a/services/evolution-source-registry/evolution-source-registry-migrate-sources.c b/services/evolution-source-registry/evolution-source-registry-migrate-sources.c
index d906827d3..a4319fc3b 100644
--- a/services/evolution-source-registry/evolution-source-registry-migrate-sources.c
+++ b/services/evolution-source-registry/evolution-source-registry-migrate-sources.c
@@ -21,7 +21,7 @@
 #include <glib/gstdio.h>
 #include <camel/camel.h>
 #include <libsoup/soup.h>
-#include <gnome-keyring.h>
+#include <libsecret/secret.h>
 
 #include <libebackend/libebackend.h>
 
@@ -137,15 +137,29 @@ struct _ParseData {
 	PropertyFunc property_func;
 };
 
-static GnomeKeyringPasswordSchema schema = {
-	GNOME_KEYRING_ITEM_GENERIC_SECRET,
+/* XXX Probably want to share this with module-online-accounts.c */
+static const SecretSchema schema = {
+	"org.gnome.Evolution.DataSource",
+	SECRET_SCHEMA_DONT_MATCH_NAME,
 	{
 		{ KEYRING_ITEM_ATTRIBUTE_NAME,
-		  GNOME_KEYRING_ATTRIBUTE_TYPE_STRING },
+		  SECRET_SCHEMA_ATTRIBUTE_STRING },
 		{ NULL, 0 }
 	}
 };
 
+/* XXX Probably want to share this with e-passwords.c */
+static const SecretSchema e_passwords_schema = {
+	"org.gnome.Evolution.Password",
+	SECRET_SCHEMA_DONT_MATCH_NAME,
+	{
+		{ "application", SECRET_SCHEMA_ATTRIBUTE_STRING, },
+		{ "user", SECRET_SCHEMA_ATTRIBUTE_STRING, },
+		{ "server", SECRET_SCHEMA_ATTRIBUTE_STRING, },
+		{ "protocol", SECRET_SCHEMA_ATTRIBUTE_STRING, },
+	}
+};
+
 /* Forward Declarations */
 void evolution_source_registry_migrate_sources (void);
 
@@ -252,7 +266,7 @@ migrate_keyring_entry (const gchar *uid,
                        const gchar *server,
                        const gchar *protocol)
 {
-	GnomeKeyringAttributeList *attributes;
+	GHashTable *attributes;
 	GList *found_list = NULL;
 	gchar *display_name;
 
@@ -262,37 +276,39 @@ migrate_keyring_entry (const gchar *uid,
 
 	display_name = g_strdup_printf (KEYRING_ITEM_DISPLAY_FORMAT, uid);
 
-	attributes = gnome_keyring_attribute_list_new ();
-
-	gnome_keyring_attribute_list_append_string (
-		attributes, "application", "Evolution");
-	if (user != NULL)
-		gnome_keyring_attribute_list_append_string (
-			attributes, "user", user);
-	if (server != NULL)
-		gnome_keyring_attribute_list_append_string (
-			attributes, "server", server);
-	if (protocol != NULL)
-		gnome_keyring_attribute_list_append_string (
-			attributes, "protocol", protocol);
-
-	gnome_keyring_find_items_sync (
-		GNOME_KEYRING_ITEM_NETWORK_PASSWORD, attributes, &found_list);
+	attributes = secret_attributes_build (
+		&e_passwords_schema,
+		"application", "Evolution",
+		"user", user,
+		"server", server,
+		"protocol", protocol,
+		NULL);
+
+	found_list = secret_service_search_sync (
+		NULL, &e_passwords_schema, attributes,
+		SECRET_SEARCH_ALL |
+		SECRET_SEARCH_UNLOCK |
+		SECRET_SEARCH_LOAD_SECRETS,
+		NULL, NULL);
 
 	/* Pick the first match we find. */
 	if (found_list != NULL) {
-		GnomeKeyringFound *found = found_list->data;
+		SecretItem *item = found_list->data;
+		SecretValue *secret = secret_item_get_secret (item);
 
 		/* Sanity check. */
-		g_return_if_fail (found->secret != NULL);
+		g_return_if_fail (secret != NULL);
+
+		secret_password_store_sync (
+			&schema, SECRET_COLLECTION_DEFAULT, display_name,
+			secret_value_get (secret, NULL), NULL, NULL,
+			KEYRING_ITEM_ATTRIBUTE_NAME, uid, NULL);
 
-		gnome_keyring_store_password_sync (
-			&schema, GNOME_KEYRING_DEFAULT, display_name,
-			found->secret, KEYRING_ITEM_ATTRIBUTE_NAME, uid, NULL);
+		secret_value_unref (secret);
 	}
 
-	gnome_keyring_attribute_list_free (attributes);
-	gnome_keyring_found_list_free (found_list);
+	g_list_free_full (found_list, g_object_unref);
+	g_hash_table_unref (attributes);
 
 	g_free (display_name);
 }
diff --git a/tests/libedataserverui/Makefile.am b/tests/libedataserverui/Makefile.am
index 8b0ed2e38..f22b917ab 100644
--- a/tests/libedataserverui/Makefile.am
+++ b/tests/libedataserverui/Makefile.am
@@ -14,7 +14,7 @@ TEST_EDATASERVERUI_CPPFLAGS=						\
 	-DLOCALEDIR=\""$(localedir)"\"					\
 	-DG_LOG_DOMAIN=\"e-data-server-ui\"				\
 	$(CAMEL_CFLAGS)							\
-	$(GNOME_KEYRING_CFLAGS)						\
+	$(LIBSECRET_CFLAGS)						\
 	$(E_DATA_SERVER_UI_CFLAGS)
 
 TEST_EDATASERVERUI_LDFLAGS =						\
@@ -25,7 +25,7 @@ TEST_EDATASERVERUI_LDFLAGS =						\
 	$(top_builddir)/libedataserver/libedataserver-1.2.la		\
 	$(top_builddir)/libedataserverui/libedataserverui-3.0.la	\
 	$(CAMEL_LIBS)							\
-	$(GNOME_KEYRING_LIBS)						\
+	$(LIBSECRET_LIBS)						\
 	$(E_DATA_SERVER_UI_LIBS)
 
 evolution_source_viewer_CPPFLAGS = $(TEST_EDATASERVERUI_CPPFLAGS)