From 622531d78d85eb2ed2a66e18fd670e95ceacdf9e Mon Sep 17 00:00:00 2001 From: Michael Czechowski Date: Wed, 20 May 2026 11:39:43 +0200 Subject: [PATCH] fix(devshell): bind ~/.gnupg into bwrap sandbox for signed commits The tmpfs overlay on $HOME hid the host GPG keyring inside the sandbox, so git commits with commit.gpgsign failed with "can't connect to the keyboxd". Bind ~/.gnupg rw, bind the gpg-agent socket dir (XDG_RUNTIME_DIR/gnupg), and propagate GPG_TTY so pinentry-tty works. Co-Authored-By: Claude Opus 4.7 (1M context) --- flake.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/flake.nix b/flake.nix index d9b2e66..e129efb 100644 --- a/flake.nix +++ b/flake.nix @@ -48,6 +48,10 @@ --bind "$HOME/.claude" "$HOME/.claude" --bind "$HOME/.claude.json" "$HOME/.claude.json" + # Writable: GPG keyring + agent socket (commit signing) + --bind "$HOME/.gnupg" "$HOME/.gnupg" + --bind-try "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/gnupg" "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/gnupg" + --ro-bind "$HOME/.gitconfig" "$HOME/.gitconfig" --ro-bind "$HOME/.ssh" "$HOME/.ssh" --setenv GIT_SSH_COMMAND "ssh -F ~/.ssh/config" @@ -61,6 +65,7 @@ --setenv PATH "$PATH" --setenv TERM "''${TERM:-xterm}" --setenv SANDBOX_ACTIVE "1" + --setenv GPG_TTY "''${GPG_TTY:-}" --chdir "$PROJECT_DIR" )