From 3b389a5f2a9ede157c58a8f7eaec6e984811aa81 Mon Sep 17 00:00:00 2001 From: Aner Zakobar Date: Tue, 6 Oct 2026 09:40:41 +0300 Subject: [PATCH] pinentry fixees, exwm gated --- .envrc | 2 +- features/encryption/default.nix | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/.envrc b/.envrc index 3550a30..af556f8 100644 --- a/.envrc +++ b/.envrc @@ -1 +1 @@ -use flake +se flake diff --git a/features/encryption/default.nix b/features/encryption/default.nix index 855d021..70d4b9b 100644 --- a/features/encryption/default.nix +++ b/features/encryption/default.nix @@ -36,6 +36,25 @@ allow-loopback-pinentry ''; }; + + # pinentry-emacs only attempts its Emacs-loopback socket when ITS OWN + # process env has INSIDE_EMACS set (see pinentry-emacs.c) -- and that + # process is gpg-agent's child, so it inherits gpg-agent's daemon env, + # not the env of whichever client (git, pass, ...) asked it to sign. + # Without this, any signing request from outside Emacs (e.g. a plain + # terminal, or an agent shelling out to git) always falls through to + # the curses pinentry, which fails outright when there's no real tty. + # + # Only safe to force on when Emacs is structurally guaranteed to be + # up and responsive -- i.e. under EXWM, where Emacs *is* the window + # manager. Elsewhere Emacs may not be running (fine: the loopback + # socket connect fails instantly, same fast fallback as today) or may + # be running but transiently busy (not fine: pinentry then blocks on + # the Assuan handshake for up to its 60s timeout before falling back, + # which is strictly worse than today's instant failure). + systemd.user.services.gpg-agent.Service.Environment = + lib.mkIf config.azos.suites.exwm.enable ["INSIDE_EMACS=1"]; + home.file.".ssh/config".source = ./ssh-config; home.file.".ssh/gpg-as-ssh.pub".source = ./gpg-as-ssh.pub; home.file.".gnupg/sshcontrol".source = ./sshcontrol;