fix(gpg): set no-autostart so agent forwarding survives gpg calls - #789
fix(gpg): set no-autostart so agent forwarding survives gpg calls#789skevetter wants to merge 2 commits into
Conversation
GPG agent forwarding into the container points gpg at the forwarded host socket via a symlink (~/.gnupg/S.gpg-agent). Setup wrote only "use-agent" to gpg.conf, never "no-autostart". Whenever gpg ran while the forwarded socket was momentarily unavailable, it autostarted a local gpg-agent, which replaced the symlink with an empty local socket and permanently broke forwarding for the session — gpg -K showed nothing and signing failed with "No secret key". Write no-autostart (the GnuPG-recommended setting for agent forwarding) so gpg only ever uses the forwarded agent. Verified end to end: with the forwarded socket and no-autostart, gpg -K lists the secret keys and a commit is GPG-signed and verifies.
✅ Deploy Preview for devsydev canceled.
|
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Deploy Preview for images-devsy-sh canceled.
|
|
Superseded by #790, which consolidates all GPG agent-forwarding fixes (no-autostart + supervised self-healing forward). |
1 participant
Summary
GPG agent forwarding into the container never worked reliably:
gpg -Kwas empty and signing failed withNo secret key, even though the host agent held the keys and the socket was forwarded.Root cause
configureGPGAgentpoints the container's gpg at the forwarded host socket via a symlink (~/.gnupg/S.gpg-agent → /tmp/S.gpg-agent → …/S.gpg-agent.extra), butSetupGpgConfonly wroteuse-agenttogpg.conf— neverno-autostart. Whenever gpg ran while the forwarded socket was momentarily unavailable, gpg autostarted a local gpg-agent, which replaced the symlink with an empty local socket. From that point every gpg call hit the empty local agent, permanently breaking forwarding for the session.Fix
Write
no-autostart(GnuPG's recommended setting for agent forwarding) so gpg only ever uses the forwarded agent and never spawns a local one. Directives are written idempotently, and appended safely when the existinggpg.confhas no trailing newline.Validation
Reproduced the fixed state in a live container (forwarded socket +
no-autostart):gpg -Know lists the secret keys.Good signature from "Samuel K <skevetter@pm.me>".Unit tests cover directive presence, idempotency, existing-directive preservation, and the newline-less-file edge case.