Repository navigation
fix: restart sandbox when gpg-agent restarts after macOS sleep/reboot - #34
Merged
Merged
Conversation
- Replace gpg-agent --daemon with gpgconf --launch gpg-agent for correct macOS agent startup (avoids spawning a conflicting second instance) - Include socket inode in config fingerprint so that when the host gpg-agent restarts (new socket inode, same path), the config hash changes and the sandbox is transparently restarted with the fresh socket mounted
malaporte
marked this pull request as ready for review
April 15, 2026 08:05
|
🎉 This PR is included in version 0.21.1 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GPG commit signing inside the sandbox would occasionally fail with
No agent runningafter the hostgpg-agentrestarted (e.g. after macOS sleep/wake, screen lock, or reboot). This fixes two related bugs inresolveGpgSocketInfo.Changes
Fix auto-start command: Replace
gpg-agent --daemonwithgpgconf --launch gpg-agentwhen the agent socket is missing at sandbox start time. On macOS the agent is managed by launchd; usinggpg-agent --daemondirectly can spawn a conflicting second instance or fail silently.gpgconf --launchis the correct cross-platform way to ensure the agent is running.Fix stale socket detection: Include the socket inode in the config fingerprint (
agent-extra-socket:/path/to/socket:<inode>). Previously only the path was included, so whengpg-agentrestarted and recreated the socket at the same path (new inode), the fingerprint was unchanged and the sandbox kept the old dead bind-mount. Now a restarted agent produces a different fingerprint, triggering a transparent sandbox restart with the fresh socket.Testing
Tested end-to-end on macOS/Docker Desktop:
gpg-agent(gpgconf --kill gpg-agent) to simulate a sleep/wake cycle.pippin -c 'echo test | gpg --clearsign'— observed:pippin: started gpg-agent(auto-start viagpgconf --launch)pippin: sandbox configuration changed, restarting...(inode change detected)Reviewer Notes
The inode-based fingerprint means every
gpg-agentrestart will trigger a sandbox restart. This is intentional and correct — the old container has a dead socket bind-mount and must be replaced. The restart is transparent to the user (same behaviour as a config change).