Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix gnome-online-accounts by enabling gnome-keyring and unsetting SSH_AUTH_SOCK #1037

Merged
merged 9 commits into from
Jan 10, 2025
+26 −17
Merged

Fix gnome-online-accounts by enabling gnome-keyring and unsetting SSH_AUTH_SOCK #1037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
964859d
Enable gnome-keyring again
kachick Jan 10, 2025
0241e23
Attempt to skip setting SSH_AUTH_SOCK by gnome-keyring
kachick Jan 10, 2025
6f69d13
Also require mkForce here
kachick Jan 10, 2025
508168d
Drop enable-ssh-agent flag when building gnome-keyring package
kachick Jan 10, 2025
d883790
Skip ubuntuforums.org in link checker
kachick Jan 10, 2025
da54e94
Add more reason in patch
kachick Jan 10, 2025
3059d48
Revert the security.pam.sshAgentAuth
kachick Jan 10, 2025
1ffc083
Remove unexpected blank line
kachick Jan 10, 2025
7e6c5c1
Should now exclude
kachick Jan 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .lycheeignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,6 @@ user:password

# reddit often rejects request from GitHub Actions
www.reddit.com/

# The server is unstable
ubuntuforums.org
2 changes: 1 addition & 1 deletion config/rclone.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Rclone

Rclone enables an OSS vault on several Cloud Storages.\
And it makes it possible to use [Google Drive on Linux](https://abevoelker.github.io/how-long-since-google-said-a-google-drive-linux-client-is-coming/).
And it makes it possible to use [Google Drive on Linux](https://abevoelker.github.io/how-long-since-google-said-a-google-drive-linux-client-is-coming/) without gnome-online-accounts.

## Setup

Expand Down
8 changes: 0 additions & 8 deletions home-manager/desktop.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,12 +26,4 @@
};
};
};

# Extracted from encryption.nix to avoid dbus error in GitHub hosted runner
#
# https://github.com/nix-community/home-manager/blob/release-24.11/modules/services/pass-secret-service.nix
# Make it possible to use libsecret which is required in vscode GitHub authentication(--password-store="gnome-libsecret"), without gnome-keyring(GH-814).
#
# Alternative candidates: https://github.com/grimsteel/pass-secret-service
services.pass-secret-service.enable = true;
}
13 changes: 6 additions & 7 deletions nixos/desktop/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,17 +92,16 @@
evince # document viewer
gnome-calendar
gnome-music # does not support flac by defaults
gnome-online-accounts # See GH-1015
];

# Recommended to be uninstalled by gnupg. I prefer this way, even though disabling gpg-agent ssh integrations.
# I need gnome-keyring to use gnome-online-accounts even though recommended to be uninstalled by gnupg. pass-secret families didn't work on goa. See GH-1034 and GH-1036
# https://wiki.gnupg.org/GnomeKeyring
#
# And enabling this makes $SSH_AUTH_SOCK overriding even through enabled gpg-agent in home-manager
# https://github.com/NixOS/nixpkgs/issues/101616
#
# Using mkforce for https://discourse.nixos.org/t/gpg-smartcard-for-ssh/33689/3
services.gnome.gnome-keyring.enable = lib.mkForce false;
# Require mkforce if you want to disable. See https://discourse.nixos.org/t/gpg-smartcard-for-ssh/33689/3
services.gnome.gnome-keyring.enable = true;
# On the otherhand, I should avoid deprecated gnome-keyring for ssh integrations even if it looks working.
# gnome-keyring enables pam.sshAgentAuth, and it sets the $SSH_AUTH_SOCK, and following modules skips to override this variable. But just disabling security.pam.sshAgentAuth does not resolve it. It should be done in package build phase.
# The workaround might be updated with https://github.com/NixOS/nixpkgs/issues/140824

# Enable touchpad support (enabled default in most desktopManager).
services.libinput = {
Expand Down
17 changes: 16 additions & 1 deletion overlays/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,23 @@
};
})

# Pacthed packages
# Keep minimum patches as possible. Because of they can not use official binary cache. See GH-754

# Patched and override existing name because of it is not cofigurable
(final: prev: {
# https://github.com/NixOS/nixpkgs/blob/nixos-24.11/pkgs/by-name/gn/gnome-keyring/package.nix
# To disable SSH_AUTH_SOCK by gnome-keyring. This is required because of I should avoid GH-714 but realize GH-1015
#
# And it should be override the package it self, the module is not configurable for the package. https://github.com/NixOS/nixpkgs/blob/nixos-24.11/nixos/modules/services/desktops/gnome/gnome-keyring.nix
gnome-keyring = prev.gnome-keyring.overrideAttrs (
finalAttrs: previousAttrs: {
# https://github.com/NixOS/nixpkgs/issues/140824#issuecomment-2573660493
configureFlags = final.lib.lists.remove "--enable-ssh-agent" previousAttrs.configureFlags;
}
);
})
Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After this change

> echo $SSH_AUTH_SOCK
/run/user/1001/ssh-agent

However it takes minutes for build...

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rebuilding my system increased 6 minutes 😢

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another idea is overriding the SSH_AUTH_SOCK with following steps.

Copy link
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

However it might make confusion for many existing code.


# Pacthed packages
(final: prev: {
patched = {
# TODO: Replace to stable since nixos-25.05, stable 24.11 does not include https://github.com/NixOS/nixpkgs/pull/361378
Expand Down
Loading