fix: start GnuPG launchd jobs left pending by bootstrap - #29
Merged
Conversation
A hand-edited gpg-agent.conf or common.conf may end without a trailing newline, and `echo >>` then glued the new option onto the last line (`max-cache-ttl-ssh 28800enable-ssh-support` in #28), where the `grep "^option"` guards never matched it again. Add the missing newline before appending and write the line with `print -r --` so zsh does not interpret backslashes or a leading dash.
On a machine whose gui launchd domain was in on-demand-only mode, `launchctl bootstrap` registered both jobs but left their `RunAtLoad` spawn pending as speculative, so neither daemon ever ran and the socket wait failed (#28). Kickstart each job unless `launchctl print` already reports a run: a second parent would exit 2 on the held socket and leave that exit code in the diagnostics the failure message points at. Keep `--daemon` with `AbandonProcessGroup` instead of the `--no-detach` plus `KeepAlive` form proposed in #28: in GnuPG 2.5 `--no-detach` only keeps the console and the launched process still forks, so launchd would respawn a parent that exits 2 on the held socket. The changed contents rerun this `run_once` script on every existing machine at the next `chezmoi apply`, which restarts gpg-agent and keyboxd and needs the YubiKey present.
liby
force-pushed
the
bugfix/28-kickstart-gnupg-launchd-jobs
branch
from
September 3, 2026 05:51
49ce8c4 to
9de638f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #28.
On a machine whose gui launchd domain is in on-demand-only mode,
launchctl bootstrapregisters the gpg-agent and keyboxd jobs but leaves theirRunAtLoadspawn pending as speculative, so the bootstrap script's socket wait failed. Apple's DTS describes that mode in LaunchAgent priority: while login app restore or Setup Assistant is still running, the gui domain accepts only on-demand starts and pends every other spawn until that phase ends, so achezmoi initrun in that window hits it. The script now kickstarts each job unlesslaunchctl printalready reports a run, and appends conf options on their own line even when a hand-edited file lacks a trailing newline.The
--no-detachplusKeepAliveform suggested in the issue is not adopted: in GnuPG 2.5.22--no-detachonly keeps the console and the launched process still forks, soKeepAlivewould respawn a parent that exits 2 on the held socket.gpgconf --killreturns after the daemon exited, so no extra wait was added.Because the script contents changed, the next
chezmoi applyon every existing machine reruns it: gpg-agent and keyboxd restart and the YubiKey must be present.The on-demand-only mode could not be reproduced locally. The kickstart branch was exercised with a throwaway launchd label whose job had
RunAtLoadfalse; on a normal gui domain,launchctl bootstrapreturns withruns = 1already recorded, so the guard skips kickstart there. Verification on the reporter's machine is requested in the issue.