On Linux, org.freedesktop.secrets is how desktop applications store passwords: anything using libsecret or secret-tool talks to it. In practice that means GNOME Keyring, whether or not you run GNOME, and whether or not your secrets actually live there. Mine don't; they're in Bitwarden. I wanted the Secret Service on my machine to read from there, transparently, without every app needing to know.
So rosec is a multi-provider Secret Service daemon. It implements the freedesktop spec, so any libsecret-aware tool keeps working unchanged, but behind the bus it reads from a provider you choose. It launches with Bitwarden, both Password Manager and Secrets Manager, surfaced as one collection on the bus.
Once every secret lives somewhere the daemon can reach, more falls out of it than password lookups: an SSH agent that needs no ssh-add, two-factor codes you can cat. Both got built out in the weeks after launch, so they each get their own post; the foundation underneath them is just this, one spec-compliant Secret Service, reading from a provider you choose.
yay -S rosec-bin
rosec enable # installs the D-Bus activation, masks gnome-keyring-daemon
secret-tool lookup label "GitHub" # → reads from Bitwarden via rosec
The point of the design is the provider boundary; Bitwarden is just the first one. A local encrypted vault, KeePassXC files and a read-only GNOME Keyring for migration are what comes next, each as its own backend on the same bus. (I'll post as those land.)
This is squarely a scratch-my-own-itch project sitting on a sensitive part of the stack, so give the threat model your own scrutiny before you trust it with anything that matters; it's young. Repo and docs are on GitHub.