Tatsh / sbclaude / 31996004249

100%

push

github

container: bridge the gpg-agent socket where gpg will look

--gpg stopped being able to sign, with "Inappropriate ioctl for device"
from a pinentry that has no TTY to prompt on. Nothing in GnuPG changed;
the premise the bridging relied on did.

_gpg_args overlays the host agent socket at <GNUPGHOME>/S.gpg-agent, and
its comment says why: "the container's gpg, lacking a usable
/run/user/<uid>, looks for it at <GNUPGHOME>/S.gpg-agent". That word
"usable" is the whole thing. The directory has existed for a while --
--ssh forwards SSH_AUTH_SOCK, which on a systemd host lives right there
-- but Docker creates it root:root 0755, and gpg rejects a runtime
directory it does not own, so it fell back to the home and the overlay
was found.

Then --wayland taught the entrypoint to chown it to the user and chmod it
0700, because a compositor client refuses an XDG_RUNTIME_DIR that is not.
That made it usable, so gpg started resolving its socket directory to
/run/user/<uid>/gnupg, where nothing was mounted. gpg does not report a
missing agent: it starts one of its own inside the box, and that agent
can only reach pinentry-curses.

Overlay the socket at both paths rather than work out which one applies.
Which it is depends on flags parsed elsewhere and on a chown that happens
later in the entrypoint, so the condition is not reliably knowable at the
point the arguments are built; the unused mount costs nothing, and
guessing wrong costs signing entirely. Chown the gnupg directory in the
entrypoint too, for the same reason its parent is chowned: Docker creates
it root-owned and GnuPG requires the socket directory to belong to the
user.

Verified on a running box by symlinking /run/user/<uid>/gnupg/S.gpg-agent
to the bridged socket, which made "gpg --clearsign" succeed immediately
and let three signed commits through. The argument construction is unit
tested at both paths; the end-to-end path wants a fresh box to confirm.

Signed-off-by: Andrew Udvare <audvare@gmail.com>

91 of 91 branches covered (100.0%)

Branch coverage included in aggregate %.

7 of 7 new or added lines in 1 file covered. (100.0%)

668 of 668 relevant lines covered (100.0%)

5.0 hits per line