#1079246 gcr4: Environment variable SSH_AUTH_SOCK is hijacked by gcr-ssh-agent

Package:
gcr4
Source:
gcr4
Description:
GNOME crypto services (daemon and tools)
Submitter:
Antoine
Date:
2026-01-09 12:29:03 UTC
Severity:
normal
#1079246#5
Date:
2024-08-21 20:21:38 UTC
From:
To:
Dear Maintainer,

With a recent update of gcr4 (or libgcr-4-4), my environment variable
SSH_AUTH_SOCK has been changed to the gcr-ssh-agent socket. I am using
the gpg agent as ssh agent.

I had to disable the gcr-ssh-agent.service/socket globally to recover
my original environment variable.

It is not clear why gcr4 is hijacking my SSH_AUTH_SOCK variable in a
non-gnome session (I am using sway).

Antoine

#1079246#10
Date:
2025-05-26 12:07:09 UTC
From:
To:
Perhaps this was different at the time the bug was reported, but the
systemd socket unit is provided by the `gcr4` binary package, and not
the `libgcr-4-4` binary package.

The gcr4 binary package should only be installed if you want the gcr4
ssh agent, and in that case it is intended that it tries to set itself
as the default ssh agent provider.

#1079246#15
Date:
2025-09-09 15:51:54 UTC
From:
To:
The main use case for gpg-ssh-agent is to use authentication subkeys in
OpenPGP keys as SSH keys, but I do not think gcr-ssh-agent currently
supports that functionality.  (Perhaps it might do so in a future
version?)  So it is unfortunate that gcr-ssh-agent.socket hijacks the
SSH_AUTH_SOCK environment variable set by gpg-ssh-agent.socket.

#1079246#20
Date:
2025-11-10 13:48:01 UTC
From:
To:
gcr4 goes to great length to actually override the SSH_AUTH_SOCK set by
gpg-agent-ssh but that's not a useful thing to do.

I refer specifically to this change that landed this summer:
"Add proposed patch to ensure gcr4 is the default ssh-agent provider" by
Alessandro:
https://salsa.debian.org/gnome-team/gcr4/-/commit/2f9e7e82f03b985e7ccbb8218ead0a15e0bc5660
--- a/gcr/gcr-ssh-agent.socket.in
+++ b/gcr/gcr-ssh-agent.socket.in
@@ -1,5 +1,7 @@
 [Unit]
 Description=GCR ssh-agent wrapper
+# If gcr is installed, take priority in setting SSH_AUTH_SOCK over gpg-agent
+After=gpg-agent-ssh.socket


The ssh-agent provided by gpg-agent is disabled by default. The user needs
to add enable-ssh-agent in ~/.gnupg/gpg-agent.conf to actually enable it. When
the user does this, we ought to try to respect his choice instead of
voluntarily override it.

My reason to use gpg-agent is because my SSH key is a GPG subkey in a Yubikey.

Please let me use it without having to resort to complicated hacks. It
took me multiple tries until I figured out how to get this properly
disabled. Hint:
* "systemctl --user disable gcr-ssh-agent.socket" does not work because
  it's enabled globally via some links in
  /etc/systemd/user/grapgraphical-session-pre.target.wants/
* then you figure out that you need the same command under sudo with "--global"
  instead of "--user", but it still does not work
* so I try again with "systemctl --user disable" and it's now accepted but
  it still doesn't help because
  /usr/lib/systemd/user/gnome-session@gnome.target.d/gnome.session.conf
  has Wants=gcr-ssh-agent.socket
* finally I figure out that I really need to "systemctl --global
  mask gcr-ssh-agent.socket" to have something that works to not execute
  the code that overrides SSH_AUTH_SOCK

So my suggestion at this point is to actually do the opposite and use
"Before=gpg-agent-ssh.socket" because gpg-agent-ssh.socket is a no-op in
the default case, and when it's not a no-op, it's best to respect the
user's choice.

#1079246#27
Date:
2025-11-10 15:18:49 UTC
From:
To:
FWIW I tried this and it seems to work but only if gcr-ssh-agent.socket is
explicitly enabled (as is the case by default). Otherwise it's started as
a dependency of gcr-agent.service and again overwrites the operation
performed by gpg-agent-ssh.socket.

Note that with the suggested "Before" setting I get this ordering (it's in
chronological order):

nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting dbus.socket - D-Bus User Message Bus Socket...
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on dirmngr.socket - GnuPG network certificate management daemon.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting gcr-ssh-agent.socket - GCR ssh-agent wrapper...
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gnome-keyring-daemon.socket - GNOME Keyring daemon.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gpg-agent-browser.socket - GnuPG cryptographic agent and passphrase cache (access for web browsers).
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gpg-agent-extra.socket - GnuPG cryptographic agent and passphrase cache (restricted).
nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting gpg-agent.socket - GnuPG cryptographic agent and passphrase cache...
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on keyboxd.socket - GnuPG public key management service.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on pipewire-pulse.socket - PipeWire PulseAudio.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on pipewire.socket - PipeWire Multimedia System Sockets.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on pk-debconf-helper.socket - debconf communication socket.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on snapd.session-agent.socket - REST API socket for snapd user session agent.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on speech-dispatcher.socket - Speech Dispatcher Socket.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting ssh-agent.socket - OpenSSH Agent socket...
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on systemd-ask-password.socket - Query the User Interactively for a Password.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on yubikey-touch-detector.socket - Unix socket activation for YubiKey touch detector service.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on dbus.socket - D-Bus User Message Bus Socket.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gcr-ssh-agent.socket - GCR ssh-agent wrapper.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on ssh-agent.socket - OpenSSH Agent socket.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gpg-agent.socket - GnuPG cryptographic agent and passphrase cache.
nov. 10 16:08:39 fr13-buxy systemd[26418]: Starting gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation)...
nov. 10 16:08:39 fr13-buxy systemd[26418]: Listening on gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation).
nov. 10 16:08:39 fr13-buxy systemd[26418]: Reached target sockets.target - Sockets.

It shows that gpg-agent.socket would also overwrite SSH_AUTH_SOCK, so
maybe you want to add an extra "After=ssh-agent.socket" since that one
is not smarter than the gcr one and overwrites the same variable
unconditionally.

Cheers,

#1079246#32
Date:
2025-12-03 22:20:08 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
gcr4, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1079246@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated gcr4 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 03 Dec 2025 17:08:09 -0500
Source: gcr4
Built-For-Profiles: noudeb
Architecture: source
Version: 4.4.0.1-8
Distribution: unstable
Urgency: medium
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 1079246
Changes:
 gcr4 (4.4.0.1-8) unstable; urgency=medium
 .
   [ Alessandro Astone ]
   * Refine priority order with other ssh agents (Closes: #1079246)
 .
   [ Jeremy Bícha ]
   * Remove Suggests: devhelp
Checksums-Sha1:
 6ed449fda0e6e0a44088d6a70f591bf4407acb77 3162 gcr4_4.4.0.1-8.dsc
 d9431b96821d03813d6ba98ae8b3b1d037c0a48f 26052 gcr4_4.4.0.1-8.debian.tar.xz
 29ee019200b9566b5a3b8ef7cc7cb3a57d9045db 19186 gcr4_4.4.0.1-8_source.buildinfo
Checksums-Sha256:
 5f54774a60e358755d91d006ca77ff53eb1f099015bfb91e5bfe6a407c4b9986 3162 gcr4_4.4.0.1-8.dsc
 86260675ee3d0bd98f8763c6b6ebd3f6d6e65a4852cb6569a0931cc071a615a5 26052 gcr4_4.4.0.1-8.debian.tar.xz
 b57f51b1c933d8bb896bfad7064f91fe62ac4800aa0c729c4749db2f6e007777 19186 gcr4_4.4.0.1-8_source.buildinfo
Files:
 a6bf621206dba7e1a1b30d4c3eab6642 3162 gnome optional gcr4_4.4.0.1-8.dsc
 65f41bd60ec1c05f7711d02a040b8182 26052 gnome optional gcr4_4.4.0.1-8.debian.tar.xz
 d04fc1b8400aacfdfd54581940b6362f 19186 gnome optional gcr4_4.4.0.1-8_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmkwtQAACgkQ5mx3Wuv+
bH3/CQ//SpC7ZPHFS59mb4r05a9WQBPeWua0K9g7WGDBO/aQQrtbbUFCFjPnTB8U
rfhuCNZmjvcx/VYs107feTAlcCMHJCtD2GrOpB5AtUju9EKKcG3GdT5n3ZBNQM5q
BhGh3fo5CBMGyDIK1HIDgBVqWXe/hFmWsC5wp0Mth5kGyehY7SsMukyCT8s/MCm4
9+mKXLHcDJAaOlE2dc7XP3kERmuBKiHi30x6p0+QpaamHdtGbmiyBeo40J693pW5
ssIp0dMWcz4l8JzMBEqGAB7MtoaWT6jGR1ae554KmQTEGyDGlWxfcfS1fDYbUaSH
SSve1jL5CTbeN3jhTO8WoMa9J7DKoseJMkVB+LumIV5G1w1Xhp6HhQ7zADMW06fp
NiLT0VVrykXakYr8/8DJvy9CMLXpMQkx+v87+fz/b0ueh7KacrEySbnPHIS9n8xC
zOIkNHOrRk3NwHfNSLgtNI/HQouBM9twlsO/E9koYoc2GmksOhHAbP2RGoGRnLQ0
SS69Cg8lOCWhO2Z1rT0HTQTppiWCbZjrVZeAJfZlBZdqtD4aN0rTnJBmMo4vtuYA
9y2DtGmP5k5B7fitGr8RcAR9ODwUwtCFflzOcyxL3jDdezlDOmc748jG+moBgChj
ZsdioGJLJEjECjs/9B6Vq1VULD/FDp9vnCxUVQN5+njIzOc6Elw=
=RFL8
-----END PGP SIGNATURE-----

#1079246#37
Date:
2026-01-09 12:26:24 UTC
From:
To:
Control: reopen -1
Control: found -1 4.4.0.1-8
thanks

Nosireebob.

I - once again - got my ssh agent replaced by gcr-ssh-agent which
precluded me from using my Yubikey. I am a KDE user.

I fully suppport what Raphael Hertzog says, gcr-ssh-agent should not
override my local configuration. And it should be easier to disable.

Greetings
Marc