Dear Maintainer, With a recent update of gcr4 (or libgcr-4-4), my environment variable SSH_AUTH_SOCK has been changed to the gcr-ssh-agent socket. I am using the gpg agent as ssh agent. I had to disable the gcr-ssh-agent.service/socket globally to recover my original environment variable. It is not clear why gcr4 is hijacking my SSH_AUTH_SOCK variable in a non-gnome session (I am using sway). Antoine
Perhaps this was different at the time the bug was reported, but the systemd socket unit is provided by the `gcr4` binary package, and not the `libgcr-4-4` binary package. The gcr4 binary package should only be installed if you want the gcr4 ssh agent, and in that case it is intended that it tries to set itself as the default ssh agent provider.
The main use case for gpg-ssh-agent is to use authentication subkeys in OpenPGP keys as SSH keys, but I do not think gcr-ssh-agent currently supports that functionality. (Perhaps it might do so in a future version?) So it is unfortunate that gcr-ssh-agent.socket hijacks the SSH_AUTH_SOCK environment variable set by gpg-ssh-agent.socket.
gcr4 goes to great length to actually override the SSH_AUTH_SOCK set by gpg-agent-ssh but that's not a useful thing to do. I refer specifically to this change that landed this summer: "Add proposed patch to ensure gcr4 is the default ssh-agent provider" by Alessandro: https://salsa.debian.org/gnome-team/gcr4/-/commit/2f9e7e82f03b985e7ccbb8218ead0a15e0bc5660 --- a/gcr/gcr-ssh-agent.socket.in +++ b/gcr/gcr-ssh-agent.socket.in @@ -1,5 +1,7 @@ [Unit] Description=GCR ssh-agent wrapper +# If gcr is installed, take priority in setting SSH_AUTH_SOCK over gpg-agent +After=gpg-agent-ssh.socket The ssh-agent provided by gpg-agent is disabled by default. The user needs to add enable-ssh-agent in ~/.gnupg/gpg-agent.conf to actually enable it. When the user does this, we ought to try to respect his choice instead of voluntarily override it. My reason to use gpg-agent is because my SSH key is a GPG subkey in a Yubikey. Please let me use it without having to resort to complicated hacks. It took me multiple tries until I figured out how to get this properly disabled. Hint: * "systemctl --user disable gcr-ssh-agent.socket" does not work because it's enabled globally via some links in /etc/systemd/user/grapgraphical-session-pre.target.wants/ * then you figure out that you need the same command under sudo with "--global" instead of "--user", but it still does not work * so I try again with "systemctl --user disable" and it's now accepted but it still doesn't help because /usr/lib/systemd/user/gnome-session@gnome.target.d/gnome.session.conf has Wants=gcr-ssh-agent.socket * finally I figure out that I really need to "systemctl --global mask gcr-ssh-agent.socket" to have something that works to not execute the code that overrides SSH_AUTH_SOCK So my suggestion at this point is to actually do the opposite and use "Before=gpg-agent-ssh.socket" because gpg-agent-ssh.socket is a no-op in the default case, and when it's not a no-op, it's best to respect the user's choice.
FWIW I tried this and it seems to work but only if gcr-ssh-agent.socket is explicitly enabled (as is the case by default). Otherwise it's started as a dependency of gcr-agent.service and again overwrites the operation performed by gpg-agent-ssh.socket. Note that with the suggested "Before" setting I get this ordering (it's in chronological order): nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting dbus.socket - D-Bus User Message Bus Socket... nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on dirmngr.socket - GnuPG network certificate management daemon. nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting gcr-ssh-agent.socket - GCR ssh-agent wrapper... nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gnome-keyring-daemon.socket - GNOME Keyring daemon. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gpg-agent-browser.socket - GnuPG cryptographic agent and passphrase cache (access for web browsers). nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gpg-agent-extra.socket - GnuPG cryptographic agent and passphrase cache (restricted). nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting gpg-agent.socket - GnuPG cryptographic agent and passphrase cache... nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on keyboxd.socket - GnuPG public key management service. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on pipewire-pulse.socket - PipeWire PulseAudio. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on pipewire.socket - PipeWire Multimedia System Sockets. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on pk-debconf-helper.socket - debconf communication socket. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on snapd.session-agent.socket - REST API socket for snapd user session agent. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on speech-dispatcher.socket - Speech Dispatcher Socket. nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting ssh-agent.socket - OpenSSH Agent socket... nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on systemd-ask-password.socket - Query the User Interactively for a Password. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on yubikey-touch-detector.socket - Unix socket activation for YubiKey touch detector service. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on dbus.socket - D-Bus User Message Bus Socket. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gcr-ssh-agent.socket - GCR ssh-agent wrapper. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on ssh-agent.socket - OpenSSH Agent socket. nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gpg-agent.socket - GnuPG cryptographic agent and passphrase cache. nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation)... nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation). nov. 10 16:08:39 fr13-buxy systemd[26418]: Reached target sockets.target - Sockets. It shows that gpg-agent.socket would also overwrite SSH_AUTH_SOCK, so maybe you want to add an extra "After=ssh-agent.socket" since that one is not smarter than the gcr one and overwrites the same variable unconditionally. Cheers,
We believe that the bug you reported is fixed in the latest version of gcr4, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1079246@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated gcr4 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Wed, 03 Dec 2025 17:08:09 -0500 Source: gcr4 Built-For-Profiles: noudeb Architecture: source Version: 4.4.0.1-8 Distribution: unstable Urgency: medium Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org> Changed-By: Jeremy Bícha <jbicha@ubuntu.com> Closes: 1079246 Changes: gcr4 (4.4.0.1-8) unstable; urgency=medium . [ Alessandro Astone ] * Refine priority order with other ssh agents (Closes: #1079246) . [ Jeremy Bícha ] * Remove Suggests: devhelp Checksums-Sha1: 6ed449fda0e6e0a44088d6a70f591bf4407acb77 3162 gcr4_4.4.0.1-8.dsc d9431b96821d03813d6ba98ae8b3b1d037c0a48f 26052 gcr4_4.4.0.1-8.debian.tar.xz 29ee019200b9566b5a3b8ef7cc7cb3a57d9045db 19186 gcr4_4.4.0.1-8_source.buildinfo Checksums-Sha256: 5f54774a60e358755d91d006ca77ff53eb1f099015bfb91e5bfe6a407c4b9986 3162 gcr4_4.4.0.1-8.dsc 86260675ee3d0bd98f8763c6b6ebd3f6d6e65a4852cb6569a0931cc071a615a5 26052 gcr4_4.4.0.1-8.debian.tar.xz b57f51b1c933d8bb896bfad7064f91fe62ac4800aa0c729c4749db2f6e007777 19186 gcr4_4.4.0.1-8_source.buildinfo Files: a6bf621206dba7e1a1b30d4c3eab6642 3162 gnome optional gcr4_4.4.0.1-8.dsc 65f41bd60ec1c05f7711d02a040b8182 26052 gnome optional gcr4_4.4.0.1-8.debian.tar.xz d04fc1b8400aacfdfd54581940b6362f 19186 gnome optional gcr4_4.4.0.1-8_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmkwtQAACgkQ5mx3Wuv+ bH3/CQ//SpC7ZPHFS59mb4r05a9WQBPeWua0K9g7WGDBO/aQQrtbbUFCFjPnTB8U rfhuCNZmjvcx/VYs107feTAlcCMHJCtD2GrOpB5AtUju9EKKcG3GdT5n3ZBNQM5q BhGh3fo5CBMGyDIK1HIDgBVqWXe/hFmWsC5wp0Mth5kGyehY7SsMukyCT8s/MCm4 9+mKXLHcDJAaOlE2dc7XP3kERmuBKiHi30x6p0+QpaamHdtGbmiyBeo40J693pW5 ssIp0dMWcz4l8JzMBEqGAB7MtoaWT6jGR1ae554KmQTEGyDGlWxfcfS1fDYbUaSH SSve1jL5CTbeN3jhTO8WoMa9J7DKoseJMkVB+LumIV5G1w1Xhp6HhQ7zADMW06fp NiLT0VVrykXakYr8/8DJvy9CMLXpMQkx+v87+fz/b0ueh7KacrEySbnPHIS9n8xC zOIkNHOrRk3NwHfNSLgtNI/HQouBM9twlsO/E9koYoc2GmksOhHAbP2RGoGRnLQ0 SS69Cg8lOCWhO2Z1rT0HTQTppiWCbZjrVZeAJfZlBZdqtD4aN0rTnJBmMo4vtuYA 9y2DtGmP5k5B7fitGr8RcAR9ODwUwtCFflzOcyxL3jDdezlDOmc748jG+moBgChj ZsdioGJLJEjECjs/9B6Vq1VULD/FDp9vnCxUVQN5+njIzOc6Elw= =RFL8 -----END PGP SIGNATURE-----
Control: reopen -1 Control: found -1 4.4.0.1-8 thanks Nosireebob. I - once again - got my ssh agent replaced by gcr-ssh-agent which precluded me from using my Yubikey. I am a KDE user. I fully suppport what Raphael Hertzog says, gcr-ssh-agent should not override my local configuration. And it should be easier to disable. Greetings Marc