fix(gpg): agent forwarding

cmd/internal/agentworkspace/setup_gpg.go

@@ -113,7 +113,7 @@ func fetchAndDecodeKeys(ownerTrustB64 string) ([]byte, []byte, error) {
 
 func configureGPGAgent(gpgConf *gpg.GPGConf) error {
 	log.Debugf("Stopping container gpg-agent")
-	if err := gpgConf.StopGpgAgent(); err != nil {
+	if err := gpg.StopGpgAgent(); err != nil {
 		return fmt.Errorf("stop container gpg-agent: %w", err)
 	}
 
@@ -135,7 +135,7 @@ func configureGPGAgent(gpgConf *gpg.GPGConf) error {
 	// Now we again kill the agent and remove the socket to really be sure every
 	// thing is clean
 	log.Debugf("Ensure stopping container gpg-agent")
-	if err := gpgConf.StopGpgAgent(); err != nil {
+	if err := gpg.StopGpgAgent(); err != nil {
 		return fmt.Errorf("ensure stopping container gpg-agent: %w", err)
 	}
 
@@ -145,7 +145,7 @@ func configureGPGAgent(gpgConf *gpg.GPGConf) error {
 	}
 
 	log.Debugf("Setup gpg.conf")
-	if err := gpgConf.SetupGpgConf(); err != nil {
+	if err := gpg.SetupGpgConf(); err != nil {
 		return fmt.Errorf("setup gpg.conf: %w", err)
 	}
 

cmd/workspace/ssh.go

@@ -745,7 +745,10 @@ func (cmd *SSHCmd) setupGPGAgent(
 
 	gitKey := gpg.SigningKey(ctx)
 
-	cmd.ReverseForwardPorts = append(cmd.ReverseForwardPorts, gpgExtraSocketPath)
+	cmd.ReverseForwardPorts = append(
+		cmd.ReverseForwardPorts,
+		gpg.ContainerSocketPath+":"+gpgExtraSocketPath,
+	)
 
 	// Now we forward the agent socket to the remote, and setup remote gpg to use it
 	forwardAgent := []string{
@@ -757,7 +760,7 @@ func (cmd *SSHCmd) setupGPGAgent(
 		names.Flag(names.OwnerTrust),
 		ownerTrustArgument,
 		names.Flag(names.SocketPath),
-		gpgExtraSocketPath,
+		gpg.ContainerSocketPath,
 	}
 
 	if log.DebugEnabled() {

e2e/framework/command.go

@@ -468,34 +468,41 @@ func (f *Framework) SetupGPG(tmpDir string) error {
 	return exec.Command("gpg", "-k").Run()
 }
 
-func (f *Framework) DevsySSHGpgTestKey(ctx context.Context, workspace string) error {
-	pubKeyB, err := exec.Command("sh", "-c", "gpg -k --with-colons 2>/dev/null | grep sec | base64 -w0").
-		Output()
+func ImportGpgKey(privateKeyPath string) error {
+	// #nosec G204 -- test imports a controlled key path
+	out, err := exec.Command("gpg", "--batch", "--import", privateKeyPath).CombinedOutput()
 	if err != nil {
-		return err
+		return fmt.Errorf("import gpg private key: %s: %w", out, err)
+	}
+	if out, err := exec.Command("gpg-connect-agent", "/bye").CombinedOutput(); err != nil {
+		return fmt.Errorf("start gpg-agent: %s: %w", out, err)
 	}
+	return nil
+}
 
-	// First run to trigger the first forwarding
+func (f *Framework) DevsySSHGpgSecretKeyForwarded(
+	ctx context.Context,
+	workspace, expectedFingerprint string,
+) error {
 	stdout, _, err := f.ExecCommandCapture(ctx, []string{
 		cmdWorkspace,
 		cmdSSH,
 		names.Flag(names.AgentForwarding),
 		names.Flag(names.SSHGPGForwarding),
 		flagCommand,
-		"gpg -k --with-colons 2>/dev/null |grep sec |  base64 -w0", workspace,
+		"gpg --list-secret-keys --with-colons 2>/dev/null",
+		workspace,
 	})
 	if err != nil {
-		return err
+		return fmt.Errorf("list secret keys in container: %w", err)
 	}
-
-	if stdout != string(pubKeyB) {
+	if !strings.Contains(stdout, expectedFingerprint) {
 		return fmt.Errorf(
-			"devsy gpg public key forwarding failed, expected %s, got %s",
-			string(pubKeyB),
+			"gpg agent forwarding failed: secret key %s not reachable in container, got: %q",
+			expectedFingerprint,
 			stdout,
 		)
 	}
-
 	return nil
 }
 

e2e/tests/ssh/ssh.go

@@ -22,6 +22,8 @@ import (
 const (
 	osWindows = "windows"
 
+	gpgTestKeyFingerprint = "07F681B9FD6C3411F679BFD1F51769DB572DDD3F"
+
 	envSSHAuthSock = "SSH_AUTH_SOCK"
 
 	sshOptStrictHostKeyCheckingNo = "StrictHostKeyChecking=no"
@@ -120,6 +122,43 @@ var _ = ginkgo.Describe("devsy ssh test suite", ginkgo.Label("ssh"), ginkgo.Orde
 		},
 	)
 
+	ginkgo.It(
+		"should expose the host GPG secret key in the container via agent forwarding",
+		ginkgo.Label("gpg"),
+		ginkgo.SpecTimeout(framework.TimeoutModerate()),
+		func(ctx ginkgo.SpecContext) {
+			if runtime.GOOS == osWindows {
+				ginkgo.Skip("skipping on windows")
+			}
+
+			tempDir, err := framework.CopyToTempDir("tests/ssh/testdata/gpg-forwarding")
+			framework.ExpectNoError(err)
+
+			f := framework.NewDefaultFramework(initialDir + "/bin")
+			_ = f.DevsyProviderAdd(ctx, "docker")
+			err = f.DevsyProviderUse(ctx, "docker")
+			framework.ExpectNoError(err)
+
+			ginkgo.DeferCleanup(func(cleanupCtx context.Context) {
+				_ = f.DevsyWorkspaceDelete(cleanupCtx, tempDir)
+				framework.CleanupTempDir(initialDir, tempDir)
+			})
+
+			ginkgo.GinkgoT().Setenv("GNUPGHOME", ginkgo.GinkgoT().TempDir())
+			framework.ExpectNoError(
+				framework.ImportGpgKey(filepath.Join(tempDir, "gpg-private.key")),
+			)
+
+			err = f.DevsyUp(ctx, tempDir, names.Flag(names.SSHGPGForwarding))
+			framework.ExpectNoError(err)
+
+			sshCtx, cancelSSH := context.WithDeadline(ctx, time.Now().Add(30*time.Second))
+			defer cancelSSH()
+			err = f.DevsySSHGpgSecretKeyForwarded(sshCtx, tempDir, gpgTestKeyFingerprint)
+			framework.ExpectNoError(err)
+		},
+	)
+
 	ginkgo.It(
 		"should set up git SSH signature helper and sign a commit",
 		ginkgo.SpecTimeout(framework.TimeoutLong()),

e2e/tests/ssh/testdata/gpg-forwarding/.devcontainer.json

@@ -1 +1 @@
-{ "image": "ghcr.io/devsy-org/test-images/base:ubuntu" }
+{ "image": "ghcr.io/devsy-org/test-images/base:ubuntu", "remoteUser": "vscode" }

e2e/tests/ssh/testdata/gpg-forwarding/devcontainer.json

@@ -1,4 +1,5 @@
 {
   "name": "Go",
-  "image": "ghcr.io/devsy-org/test-images/go:1"
+  "image": "ghcr.io/devsy-org/test-images/go:1",
+  "remoteUser": "vscode"
 }

pkg/gpg/forward.go

@@ -1,19 +1,26 @@
 package gpg
 
 import (
+	"context"
 	"os"
 	"os/exec"
+	"time"
 
 	client2 "github.com/devsy-org/devsy/pkg/client"
 	"github.com/devsy-org/devsy/pkg/flags/names"
 	"github.com/devsy-org/devsy/pkg/log"
 	devssh "github.com/devsy-org/devsy/pkg/ssh"
 )
 
-// ForwardAgent starts a background SSH connection that forwards the local GPG agent.
-func ForwardAgent(client client2.BaseWorkspaceClient) error {
-	log.Debug("gpg forwarding enabled, performing immediately")
+type backoff struct {
+	min, max time.Duration
+}
+
+var forwardRestartBackoff = backoff{min: time.Second, max: 30 * time.Second}
 
+// ForwardAgent starts a supervised background SSH connection that forwards the
+// local GPG agent, restarting it until ctx is cancelled.
+func ForwardAgent(ctx context.Context, client client2.BaseWorkspaceClient) error {
 	execPath, err := os.Executable()
 	if err != nil {
 		return err
@@ -32,14 +39,37 @@ func ForwardAgent(client client2.BaseWorkspaceClient) error {
 
 	args := buildForwardArgs(remoteUser, client.Context(), client.Workspace())
 
-	go func() {
+	go superviseForward(ctx, execPath, args, forwardRestartBackoff)
+
+	return nil
+}
+
+func superviseForward(ctx context.Context, execPath string, args []string, b backoff) {
+	delay := b.min
+	for {
+		if ctx.Err() != nil {
+			return
+		}
+
+		start := time.Now()
 		//nolint:gosec // execPath comes from os.Executable()
-		if runErr := exec.Command(execPath, args...).Run(); runErr != nil {
-			log.Errorf("failure in forwarding gpg-agent: %v", runErr)
+		runErr := exec.CommandContext(ctx, execPath, args...).Run()
+		if ctx.Err() != nil {
+			return
 		}
-	}()
 
-	return nil
+		if time.Since(start) >= b.max {
+			delay = b.min
+		}
+		log.Errorf("gpg-agent forward exited (%v); restarting in %s", runErr, delay)
+
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(delay):
+		}
+		delay = min(2*delay, b.max)
+	}
 }
 
 func buildForwardArgs(user, context, workspace string) []string {

pkg/gpg/forward_test.go

@@ -1,9 +1,15 @@
 package gpg
 
 import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestBuildForwardArgs(t *testing.T) {
@@ -22,3 +28,46 @@ func TestBuildForwardArgs(t *testing.T) {
 	}
 	assert.Equal(t, expected, got)
 }
+
+func TestSuperviseForward_RestartsUntilCancelled(t *testing.T) {
+	runs := filepath.Join(t.TempDir(), "runs")
+	ctx, cancel := context.WithCancel(context.Background())
+
+	done := make(chan struct{})
+	go func() {
+		superviseForward(ctx, "/bin/sh", []string{"-c", "printf x >> " + runs},
+			backoff{min: 10 * time.Millisecond, max: 20 * time.Millisecond})
+		close(done)
+	}()
+
+	require.Eventually(t, func() bool {
+		data, _ := os.ReadFile(runs) //nolint:gosec // test path is created by the test
+		return strings.Count(string(data), "x") >= 2
+	}, 5*time.Second, 10*time.Millisecond, "forward should be restarted after it exits")
+
+	cancel()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("superviseForward did not stop after ctx cancel")
+	}
+}
+
+func TestSuperviseForward_StopsImmediatelyIfCancelled(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	done := make(chan struct{})
+	go func() {
+		superviseForward(ctx, "/bin/sh", []string{"-c", "exit 0"},
+			backoff{min: 10 * time.Millisecond, max: 20 * time.Millisecond})
+		close(done)
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(time.Second):
+		t.Fatal("superviseForward should return promptly when ctx is already cancelled")
+	}
+}