fix(keychain): update Secret Service items in place on Linux to stop duplicate accumulation

On Linux, keychainStore.Save copied the secret's volatile Metadata() into the
searchable Secret Service attributes and relied on CreateItem(ReplaceBehaviorReplace)
to overwrite the prior item. Both gnome-keyring and kwalletd select the replace
target by matching the full supplied attribute set, so any change in the volatile
metadata (e.g. the Docker Hub OAuth credential's rotating JWT claims) defeats the
match and a brand-new item is created on every save -- duplicates pile up without
bound, and each stale item keeps a cleartext copy of the old claims.

Fix Save to update in place: search by the stable identity triple
{service:group, service:name, id} only, then either create when absent or rewrite
the first match's secret/attributes/label in place and collapse any pre-existing
duplicates. The item's object path is preserved, so the secret is never momentarily
absent and no duplicate is minted. The observable store contract is unchanged:
Save still returns nil iff the secret is stored (refreshing attributes/label and
collapsing leftovers are best-effort).

This is backend-agnostic: the attribute-match behaviour is shared by gnome-keyring
and kwalletd, and macOS/Windows key items on a stable identifier so are unaffected.

Add SetItemSecret/SetItemAttributes/SetItemLabel to the vendored secretservice
library (thin org.freedesktop.Secret.Item wrappers) to enable the in-place update.

Refs: docker/secrets-engine-private#446

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Benehiko

store/keychain/internal/go-keychain/secretservice/secretservice.go

@@ -436,6 +436,40 @@ func (s *SecretService) PromptAndWait(prompt dbus.ObjectPath) (paths *dbus.Varia
 	}
 }
 
+// SetItemSecret replaces an existing item's secret value in place via
+// org.freedesktop.Secret.Item.SetSecret. The secret must already be encoded for
+// the session it references (see [Session.NewSecret]). SetSecret takes a single
+// Secret argument (D-Bus signature (oayays)) and returns no values, so there is
+// no prompt path: the item's collection must be unlocked first (use [Unlock]),
+// otherwise the call fails.
+func (s *SecretService) SetItemSecret(item dbus.ObjectPath, secret Secret) error {
+	if err := s.Obj(item).Call("org.freedesktop.Secret.Item.SetSecret", NilFlags, secret).Store(); err != nil {
+		return fmt.Errorf("failed to set item secret: %w", err)
+	}
+	return nil
+}
+
+// SetItemAttributes replaces an existing item's lookup attributes in place by
+// setting the read-write org.freedesktop.Secret.Item.Attributes property
+// (type a{ss}) through org.freedesktop.DBus.Properties.Set. The collection must
+// be unlocked.
+func (s *SecretService) SetItemAttributes(item dbus.ObjectPath, attributes Attributes) error {
+	if err := s.Obj(item).SetProperty("org.freedesktop.Secret.Item.Attributes", dbus.MakeVariant(map[string]string(attributes))); err != nil {
+		return fmt.Errorf("failed to set item attributes: %w", err)
+	}
+	return nil
+}
+
+// SetItemLabel replaces an existing item's displayable label in place by setting
+// the read-write org.freedesktop.Secret.Item.Label property (type s) through
+// org.freedesktop.DBus.Properties.Set. The collection must be unlocked.
+func (s *SecretService) SetItemLabel(item dbus.ObjectPath, label string) error {
+	if err := s.Obj(item).SetProperty("org.freedesktop.Secret.Item.Label", dbus.MakeVariant(label)); err != nil {
+		return fmt.Errorf("failed to set item label: %w", err)
+	}
+	return nil
+}
+
 // NewSecretProperties
 func NewSecretProperties(label string, attributes map[string]string) map[string]dbus.Variant {
 	return map[string]dbus.Variant{

store/keychain/keychain_linux.go

@@ -65,6 +65,9 @@ type secretService interface {
 	DeleteItem(item dbus.ObjectPath) error
 	GetAttributes(item dbus.ObjectPath) (kc.Attributes, error)
 	GetSecret(item dbus.ObjectPath, session kc.Session) ([]byte, error)
+	SetItemSecret(item dbus.ObjectPath, secret kc.Secret) error
+	SetItemAttributes(item dbus.ObjectPath, attributes kc.Attributes) error
+	SetItemLabel(item dbus.ObjectPath, label string) error
 	Close() error
 }
 
@@ -385,13 +388,43 @@ func (k *keychainStore[T]) Save(_ context.Context, id store.ID, secret store.Sec
 	safelySetID(id, attributes)
 
 	label := k.itemLabel(id.String())
-	properties := kc.NewSecretProperties(label, attributes)
 
-	_, err = service.CreateItem(objectPath, properties, sessSecret, kc.ReplaceBehaviorReplace)
+	// Find existing items for this identity by the stable triple only
+	// {service:group, service:name, id}, never the volatile metadata, so a
+	// changed metadata value can never hide a previously-stored item. This is
+	// what makes the in-place update below reliable and stops the duplicate
+	// accumulation described in issue #446.
+	ident := make(map[string]string)
+	safelySetMetadata(k.serviceGroup, k.serviceName, ident)
+	safelySetID(id, ident)
+
+	items, err := service.SearchCollection(objectPath, ident)
 	if err != nil {
 		return err
 	}
 
+	// Nothing stored yet: create a fresh item.
+	if len(items) == 0 {
+		properties := kc.NewSecretProperties(label, attributes)
+		_, err = service.CreateItem(objectPath, properties, sessSecret, kc.ReplaceBehaviorReplace)
+		return err
+	}
+
+	// Update the first match in place. Its object path is preserved, so the
+	// secret is never momentarily absent and no duplicate is minted. Writing the
+	// secret value IS the operation, so only its failure fails Save; refreshing
+	// the attributes and label and collapsing any pre-existing duplicates are
+	// best-effort (the secret is already stored) and must not flip the result.
+	primary := items[0]
+	if err := service.SetItemSecret(primary, sessSecret); err != nil {
+		return err
+	}
+	_ = service.SetItemAttributes(primary, attributes)
+	_ = service.SetItemLabel(primary, label)
+	for _, dup := range items[1:] {
+		_ = service.DeleteItem(dup)
+	}
+
 	return nil
 }