GPG Sign Commit when running in DevContainer

[swiffer]

• VSCode Version: 1.34.0-insider
• Local OS Version: Win 10 1903 64bit
• Remote OS Version: 4.9.125-linuxkit [python:3.6 base image]
• Remote Extension/Connection Type: Docker

Steps to Reproduce:

1. Configure git to gpg sign commits [global .gitconfig locally]

[commit]
	gpgsign = true

2. Start project in dev container, try to commit

root@953bed01abcd:/workspaces/my-project# git commit -m dockerize
error: gpg failed to sign the data
fatal: failed to write commit object

Does this issue occur when you try this locally?: No
Does this issue occur when you try this locally and all extensions are disabled?: No

[jrobsonchase]

I've managed to get this to work by using -v to map my local gpg agent socket into the container, likewise with the ssh agent:

"-v", "${env:HOME}/.gnupg/pubring.kbx:/root/.gnupg/pubring.kbx",
"-v", "${env:HOME}/.gnupg/trustdb.gpg:/root/.gnupg/trustdb.gpg",
// You'll probably have to change this to point to your gpg-agent socket.
// Not sure where Mac/Windows put it.
"-v", "${env:XDG_RUNTIME_DIR}/gnupg/S.gpg-agent:/root/.gnupg/S.gpg-agent",
"-v", "${env:SSH_AUTH_SOCK}:${env:SSH_AUTH_SOCK}",
"-e", "SSH_AUTH_SOCK=${env:SSH_AUTH_SOCK}"

Not ideal, but it's a decent workaround and allows for signing commits in the container and fetching dependencies in private git repositories via ssh.

[smiller171]

@jrobsonchase unfortunately there are numerous problems with this if you're running on a Mac or Windows host.

I think it makes sense to allow git operations to run locally when using remote containers to avoid this issue, possibly hidden behind a flag.

[heberleh]

I have similar or same problem. I am using git on code-insiders bash with WSL as remote. What is strange is that sometimes it is working, and it stops working, or it is not working and then after some minutes it works.

I noticed that restarting code-insiders seems to make it work, but not always. I have no idea how to solve, I have tried the normal solutions for the messages "error: gpg failed to sign the data
fatal: failed to write commit object" that I found on the web. Nothing seems to work permanently.

[silenceisgolden]

Same issue if using Ubuntu WSL. I found a workaround using this repository but there is not a published, peer-reviewed package since the issue is fairly new.

https://github.com/diablodale/pinentry-wsl-ps1

[jletey]

I'm not quite sure if this is the right place to ask this, but what's the best way to use your GPG key from your computer on your Raspberry Pi to sign commits. Do you transfer the key? Do you create a new one?

[LaysDragon]

I've managed to get this to work by using -v to map my local gpg agent socket into the container, likewise with the ssh agent:

"-v", "${env:HOME}/.gnupg/pubring.kbx:/root/.gnupg/pubring.kbx",
"-v", "${env:HOME}/.gnupg/trustdb.gpg:/root/.gnupg/trustdb.gpg",
// You'll probably have to change this to point to your gpg-agent socket.
// Not sure where Mac/Windows put it.
"-v", "${env:XDG_RUNTIME_DIR}/gnupg/S.gpg-agent:/root/.gnupg/S.gpg-agent",
"-v", "${env:SSH_AUTH_SOCK}:${env:SSH_AUTH_SOCK}",
"-e", "SSH_AUTH_SOCK=${env:SSH_AUTH_SOCK}"

Not ideal, but it's a decent workaround and allows for signing commits in the container and fetching dependencies in private git repositories via ssh.

For windows host, according to https://zhuanlan.zhihu.com/p/31802760 (Chinese)
Gpg4win implement a tcp socket to simulation the behavior of Unix Socket.
We can use socat to forward the tcp connection to unix socket.
Based on this tutorial, I tried to make scripts and config for Dev Container Version and it working.

{
	"name":"...",
	"dockerFile":"...", 
	"appPort": ["..."],
	"runArgs": [
		"-v", "${env:APPDATA}/gnupg/pubring.kbx:/home/vscode/.gnupg/pubring.kbx",
		"-v", "${env:APPDATA}/gnupg/trustdb.gpg:/home/vscode/.gnupg/trustdb.gpg",
		"-v", "${env:APPDATA}/gnupg/S.gpg-agent.extra:/home/vscode/.gnupg-localhost/S.gpg-agent.extra:ro"
	]

}

Then add script into .bashrc to launch the forwarding socat in background.

export GPG_TTY=$(tty)
if [ -f "$HOME/.gnupg-localhost/S.gpg-agent.extra" ] && [ ! -S "$HOME/.gnupg/S.gpg-agent" ];then
	GPG_AGENT="$HOME/.gnupg-localhost/S.gpg-agent.extra"
	PREPEND_FILE="/tmp/gpg_agent_prepend"
	WINDOWS_GPG_AGENT_PORT=$(head -n1 "$GPG_AGENT")
	tail -n+2 "$GPG_AGENT" > "$PREPEND_FILE"
	mkdir -p "$HOME/.gnupg/"
	socat "UNIX-LISTEN:$HOME/.gnupg/S.gpg-agent,fork" "SYSTEM:cat \"$PREPEND_FILE\" - <&3 | socat STDIO \"TCP\:host.docker.internal\:$WINDOWS_GPG_AGENT_PORT\" >&4,fdin=3,fdout=4" &
fi

For me I launch a script in postCreateCommand to insert it automatic.

# https://github.com/keybase/keybase-issues/issues/2798 fix gpg Inappropriate ioctl for device problem
echo "export GPG_TTY=\$(tty)" >> ~/.bashrc
cat >> ~/.bashrc <<EOL
if [ -f "\$HOME/.gnupg-localhost/S.gpg-agent.extra" ] && [ ! -S "\$HOME/.gnupg/S.gpg-agent" ];then
	GPG_AGENT="\$HOME/.gnupg-localhost/S.gpg-agent.extra"
	PREPEND_FILE="/tmp/gpg_agent_prepend"
	WINDOWS_GPG_AGENT_PORT=\$(head -n1 "\$GPG_AGENT")
	tail -n+2 "\$GPG_AGENT" > "\$PREPEND_FILE"
	mkdir -p "\$HOME/.gnupg/"
	socat "UNIX-LISTEN:\$HOME/.gnupg/S.gpg-agent,fork" "SYSTEM:cat \"\$PREPEND_FILE\" - <&3 | socat STDIO \"TCP\:host.docker.internal\:\$WINDOWS_GPG_AGENT_PORT\" >&4,fdin=3,fdout=4" &
fi
EOL

But I don't why nohup & won't working properly in .bashrc,while I press multitime ctrl+c or simply exit the terminal .the socat background process will exit too. But if I run it manually it won't behavior like this. I need to find a better way to let a socat run in background while container startup.

vscode@2274dfd714b1:/$ 
vscode@2274dfd714b1:/$ 
vscode@2274dfd714b1:/$ 
vscode@2274dfd714b1:/$ ^C
vscode@2274dfd714b1:/$ ^C
[1]+  Exit 130                nohup socat "UNIX-LISTEN:$HOME/.gnupg/S.gpg-agent,fork" "SYSTEM:cat \"$PREPEND_FILE\" - <&3 | socat STDIO \"TCP\:host.docker.internal\:$WINDOWS_GPG_AGENT_PORT\" >&4,fdin=3,fdout=4"  (wd: /workspaces/virtual-patient-room-amazing)
(wd now: /)
vscode@2274dfd714b1:/$ ^C
vscode@2274dfd714b1:/$ 

[vovimayhem]

I'm really interested on any updates on this.

Does anyone has been successful in signing Git commits within the dev container?