When the system is unlocked using a fingerprint and no LUKS password is entered after initramfs (for example, with the default LUKS/GRUB full-disk encryption setup, where the password is entered in GRUB and cannot be passed to later boot stages, or when LUKS is unlocked automatically using TPM2), the user is still required to enter a password to unlock Keyring.
Common alternatives include using a Unified Kernel Image (UKI), which allows the password to be entered after initramfs, or removing password protection from the keyring entirely.
However, there is another secure approach.
This solution is based on: https://github.com/Tunahanyrd/tpm-keyring-unlock/tree/main#
EDIT:The original project was deleted. Here is a fork:
GitHub - mtriam/tpm-keyring-unlock: Passwordless GNOME Keyring unlock using a TPM2-sealed secret · GitHub
BINPATH=~/.local/bin # adjust as needed
mkdir -p "$BINPATH"
sudo pacman -Syu go tpm2-tools git # install dependencies
git clone https://github.com/mtriam/tpm-keyring-unlock
cd tpm-keyring-unlock
sed -i 's|/org/freedesktop/secrets/collection/Default_5fkeyring|/org/freedesktop/secrets/collection/login|g' main.go # use the login keyring instead of the default keyring path
CGO_ENABLED=0 go build -buildvcs=false -trimpath -ldflags="-s -w" -o tpm-keyring-unlock . # build the binary
sha256sum tpm-keyring-unlock > tpm-keyring-unlock.sha256
cp tpm-keyring-unlock $BINPATH
sudo usermod -aG tss $USER # reboot required for group membership changes to take effect
After reboot
BINPATH=~/.local/bin
$BINPATH/tpm-keyring-unlock doctor # verify the configuration
$BINPATH/tpm-keyring-unlock enroll # enroll a TPM2-protected key
$BINPATH/tpm-keyring-unlock install # install service
To remove
$BINPATH/tpm-keyring-unlock uninstall
$BINPATH/tpm-keyring-unlock purge
rm "$BINPATH/tpm-keyring-unlock"
#sudo gpasswd -d $USER tss
To unlock LUKS with TPM2 (https://discuss.cachyos.org/t/tpm2-luks-auto-unlock-on-boot-systemd-only)
sudo systemd-cryptenroll --wipe-slot tpm2 --tpm2-device auto --tpm2-pcrs="1+7" /dev/nvme0n1pX # adjust partition and PCRs as necessary
Good luck!