Don't export SSH_AUTH_SOCK

[sebastianrasor]

4598b7c introduces new behavior to export SSH_AUTH_SOCK variable by default. This interferes with user freedom to configure their own environment, and breaks functionality for configurations like Home Manager, like seen here:
https://github.com/nix-community/home-manager/blob/12fa8548feefa9a10266ba65152fd1a787cdde8f/modules/services/gpg-agent.nix#L369-L374

Can we please remove this functionality, or add a way to remove it?

[caniko]

The choice seems understandable in the short term! gnome-keyring is probably the default in Pop-OS.

I hope you can find a solution to reverting back to freedom!

[mmstick]

You could submit a pull request to make it configurable, but it should be working out of the box with gnome-keyring for everyone packaging it.

[sebastianrasor]

I'm not super familiar with how these systems interact, but is hard coding SSH_AUTH_SOCK a requirement for making gnome-keyring work out of the box?

gnome-session introduced similar behavior here: GNOME/gnome-session@a8896cc

It was then removed here: GNOME/gnome-session@818266a

[sebastianrasor]

Looking into it a bit more, gnome-keyring already has its own method for setting the SSH_AUTH_SOCK variable:
https://gitlab.gnome.org/GNOME/gnome-keyring/-/blob/ea3530d0a37aff0177ea38259e681d7d3c790210/daemon/ssh-agent/gkd-ssh-agent-service.c#L394

I think the line to hard-code SSH_AUTH_SOCK should be removed, and if COSMIC wants to support gnome-keyring's SSH agent, support should be added to listen for gnome-keyring's request to modify the environment. This should theoretically allow users to compile their system's gnome-keyring without an SSH agent and not have their SSH_AUTH_SOCK set by/for gnome-keyring.

In a more general scope, why does the session need to Start gnome keyring components if the daemon is active? Does gnome-keyring not have its own default components which will be running if the daemon is active? If COSMIC wants (or needs, I'm honestly not sure how required this is) to take on the responsibility of launching gnome keyring components, I think that process should be much more configurable.

[Because789]

Yes, this is an issue! It makes it more difficult to pick a different ssh agent (like OpenSSH's ssh-agent), and on top of that, gnome-keyring-daemon --start --components=pkcs11,secrets,ssh doesn't even work for newer versions of gnome-keyring:

"The SSH functionality is disabled by default in gnome-keyring-daemon builds since version 1:46. It has been moved into /usr/lib/gcr-ssh-agent" (https://wiki.archlinux.org/title/GNOME/Keyring#SSH_keys).

I'm on CachyOS (gnome-keyring v48) with Cosmic beta 1 and I had a hard time to automatically add my ssh keys on start up. I ended up with this quick and dirty solution:

1. Enabel ssh-agent: systemctl --user enable ssh-agent.service

2. Add to shell config (in my case ~/.zshrc):

# Fix for  COSMIC: overwrite SSH-agent socket
export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-agent.socket"

# Add keys to agent
ssh-add -l >/dev/null 2>&1 || ssh-add -q

[MordragT]

I also just encountered this issue, the SSH_AUTH_SOCK is set to /run/user/1000/keyring/ssh, but it should be /run/user/1000/gcr/ssh, currently on nixos-unstable (beta.2)

[MabaKalox]

As local fix: Removing export SSH_AUTH_SOCK="/run/user/$(id -u)/keyring/ssh from /usr/bin/start-cosmic helps.

[manuel-plavsic]

I also just encountered this issue, the SSH_AUTH_SOCK is set to /run/user/1000/keyring/ssh, but it should be /run/user/1000/gcr/ssh, currently on nixos-unstable (beta.2)

@MordragT did you find a workaround on NixOS so that the value /run/user/1000/gcr/ssh is set on login without Cosmic overriding it?

Edit:

I did not manage to change the envar. However, I came up with a different workaround: creating a hard link at /run/user/$UID/keyring/ssh and keeping SSH_AUTH_SOCK set to /run/user/1000/keyring/ssh. I am sharing it here, as it could help others.

    systemd.user.services.link-gcr-ssh = {
      description = "Link GCR SSH agent socket into keyring path";
      wantedBy = [ "default.target" ];
      serviceConfig = {
        Type = "oneshot";
        # Wait for the GCR SSH socket at /run/user/$UID/gcr/ssh to appear, checking every 0.25 seconds,
        # up to a maximum of 5000 attempts (~20 minutes), then create a hard link at /run/user/$UID/keyring/ssh.
        # If the socket never appears, the script exits gracefully.
        ExecStart = pkgs.writeShellScript "link-gcr-ssh" ''
          for i in $(seq 1 5000); do
            if [ -S /run/user/$UID/gcr/ssh ]; then
              break
            fi
            sleep 0.25
          done

          if [ ! -S /run/user/$UID/gcr/ssh ]; then
            echo "GCR socket not found after waiting, skipping link"
            exit 0
          fi

          mkdir -p /run/user/$UID/keyring
          ln -f /run/user/$UID/gcr/ssh /run/user/$UID/keyring/ssh
        '';
      };
    };

Notes:

• This only works with NixOS. It needs to be adapted for other distros.
• /run/user/$UID/gcr/ssh does not appear immediately, that is why there is a loop.

[sebastianrasor]

@manuel-plavsic My workaround was to just disable gnome-keyring until this is fixed: sebastianrasor/nix-config@c2079af

Obviously this isn't a great solution if you rely on gnome-keyring functionality.

[MaxBullett]

I've encountered problems with the same root issue. Took me a while to track down that cosmic-session was responsible. Seems like an odd decision to handle gnome-keyring usage in that way. Checking the parent directory to link the expected ssh child directory alongside the gcr change is some bad luck too I suppose.
For those encountering this issue using nix that wish to continue relying on gcr, this patch overlay seems to have done the trick for my setup:

      # Patch cosmic-session to use correct gcr-ssh-agent socket path
      # Upstream issue: https://github.com/pop-os/cosmic-session/issues/148
      nixpkgs.overlays = [
        (final: prev: {
          cosmic-session = prev.cosmic-session.overrideAttrs (oldAttrs: {
            postPatch = (oldAttrs.postPatch or "") + ''
              substituteInPlace data/start-cosmic \
                --replace-fail '/keyring/ssh' '/gcr/ssh'
            '';
          });
        })
      ];