aner/azos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix GPG smartcard pinentry routing to Emacs; bump azos-core

Browse Source 
The gpg-agent systemd Environment=INSIDE_EMACS=1 hack never worked:
gpg-agent calls gnupg_unsetenv("INSIDE_EMACS") on itself at startup by
design, expecting the variable per-connection from the client instead.
Move it to home.sessionVariables so git/gpg invocations themselves carry
it and forward it to gpg-agent via "OPTION putenv=...", which is what
actually routes a pinentry request to Emacs instead of failing on
curses with no tty.

Bump azos-core for the project-brain-aligned todo/workplate/work-history
skills and the global org-roam Read/Edit permission rules.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Aner Zakobar
2026-10-06 10:26:29 +03:00
parent cdb8e15060
commit 2f4f4257a3
2 changed files with 25 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
features/encryption/default.nix
+24 -16
View File
@@ -37,23 +37,31 @@
'';
};
# pinentry-emacs only attempts its Emacs-loopback socket when ITS OWN
# process env has INSIDE_EMACS set (see pinentry-emacs.c) -- and that
# process is gpg-agent's child, so it inherits gpg-agent's daemon env,
# not the env of whichever client (git, pass, ...) asked it to sign.
# Without this, any signing request from outside Emacs (e.g. a plain
# terminal, or an agent shelling out to git) always falls through to
# the curses pinentry, which fails outright when there's no real tty.
# pinentry-emacs needs INSIDE_EMACS set, but NOT on gpg-agent itself:
# gpg-agent calls gnupg_unsetenv("INSIDE_EMACS") on its own process at
# startup (agent/gpg-agent.c, both supervised and daemon mode) -- by
# design, it expects this to arrive per-connection from the CLIENT,
# not statically from its own daemon environment. Each gpg/git
# invocation reads INSIDE_EMACS from its own env and forwards it to
# gpg-agent via "OPTION putenv=INSIDE_EMACS=..." (common/asshelp.c:
# send_pinentry_environment); gpg-agent stores that per-session and
# copies it into the forked pinentry's actual env for that one
# request (agent/call-pinentry.c:atfork_core). So the var has to be
# set on whatever shell/process runs git or gpg -- a prior attempt
# at this set it on gpg-agent.service's systemd Environment instead,
# which gpg-agent silently discards before it can ever be read.
#
# Only safe to force on when Emacs is structurally guaranteed to be
# up and responsive -- i.e. under EXWM, where Emacs *is* the window
# manager. Elsewhere Emacs may not be running (fine: the loopback
# socket connect fails instantly, same fast fallback as today) or may
# be running but transiently busy (not fine: pinentry then blocks on
# the Assuan handshake for up to its 60s timeout before falling back,
# which is strictly worse than today's instant failure).
systemd.user.services.gpg-agent.Service.Environment =
lib.mkIf config.azos.suites.exwm.enable ["INSIDE_EMACS=1"];
# Only safe to set globally when Emacs is structurally guaranteed to
# be up and responsive -- i.e. under EXWM, where Emacs *is* the
# window manager. Elsewhere Emacs may not be running (fine: the
# loopback socket connect fails instantly, same fast fallback as
# today) or may be running but transiently busy (not fine: pinentry
# then blocks on the Assuan handshake for up to its 60s timeout
# before falling back, which is strictly worse than today's instant
# failure).
home.sessionVariables = lib.mkIf config.azos.suites.exwm.enable {
INSIDE_EMACS = "t";
};
home.file.".ssh/config".source = ./ssh-config;
home.file.".ssh/gpg-as-ssh.pub".source = ./gpg-as-ssh.pub;