test(keychain): reproduce GNOME Keyring crashes under concurrent access

[ilopezluna]

Reproduce the GNOME Keyring crash reported in docker/sbx-releases#663 using concurrent Save → Get → Delete operations against the checked-out keychain store. This is a manual diagnostic tool for evaluating docker#668 and docker#648, not a fix or an automatically scheduled regression test.

Run from the repository root with Docker and Make:

make keychain-gnome-repro
# Sequential control:
make keychain-gnome-repro KEYCHAIN_REPRO_ARGS='-workers 1 -iterations 4000'

The disposable Ubuntu 24.04 container has its own session bus and passwordless keyring, uses synthetic credentials, and runs without networking or host mounts. It prints package versions, completed cycles, the keyring exit status and daemon logs. A five-minute timeout bounds the run. A reproduced crash returns nonzero; a successful run does not establish that the race is fixed.

Evidence and validation

• Initial reproduction against Sandboxes' vendored store v0.4.0: eight concurrent workers crashed GNOME Keyring after 534 and 3,086 completed cycles. A sequential control completed 4,000 cycles.
• Packaged reproducer against upstream d1a970618263e4690e5ed39f44150a9a7a847274: crash after 488 completed cycles, probe_exit=1 keyring_exit=133. Sequential control completed 4,000 cycles successfully.
• Environment: Ubuntu 24.04 ARM64, gnome-keyring 46.1-2ubuntu0.2, GLib 2.80.0-6ubuntu3.9.
• No request cancellations or artificial session timeouts are injected. Workers finish in-flight operations before reporting failure.
• go vet, golangci-lint v2.14.0, formatting, shell syntax and host-execution guard checked. The final runtime-directory initialization change was reviewed after the live runs.

Crash signature:

gkd_secret_service_get_pkcs11_session: assertion 'client' failed
aes_negotiate: assertion 'session' failed
gkd_secret_service_publish_dispatch: assertion 'client' failed
g_variant_new: expected GVariant of type 'v' but received value has type '(null)'

The client receives failed to open secretservice session: Message recipient disconnected from message bus without replying, matching the Compose E2E failure. That job ran on AMD64 and lacks keyring crash logs, so its exact crash mechanism remains unconfirmed. PR docker#668 has not been tested with this reproducer.

This draft targets a snapshot of upstream main in this fork (codex/keyring-reproducer-base) so the diff contains only the reproducer and the fork's main branch remains unchanged.

AI assistance: Codex performed the investigation, implemented the reproducer, ran the validation, and drafted this description at the fork owner's request.

NONE