!lheuhImcToQZYTQTuI:nixos.org

Nix on macOS

1159 Members
“There are still many issues with the Darwin platform but most of it is quite usable.” — http://yves.gnu-darwin.org186 Servers

Load older messages


SenderMessageTime
9 Jan 2026
@alexfmpe:matrix.orgalexfmpeso maybe it's a nix+mac or nix-darwin thing?15:40:01
@ivy:fargone.shIvydiscovered a catastrophic bug in gpg-agent for macos on home-manager16:10:52
@ivy:fargone.shIvygpg-agent has a core problem that goes upstream and means that gpg-agent fundamentally doesnt work on darwin in supervised mode adn the launchd agent is useless16:11:28
@saiko:knifepoint.netKatalin 🔪perhaps MacGPG has patches for this or at least a workaround? that’s what I use and gpg-agent runs automatically there16:16:37
@ivy:fargone.shIvy

one part of it is having a wrapper to get the sockets

// Simple wrapper to activate launchd sockets
// and set them up in the same way systemd would
// so that we can use gpg-agent in --supervised mode

#include <errno.h>
#include <err.h>
#include <unistd.h>
#include <launch.h>
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>

int get_launchd_socket(const char *sockName)
{
  // Get our sockets from launchd
  int *fds = NULL;
  size_t count = 0;
  errno = launch_activate_socket(sockName, &fds, &count);

  if (errno != 0 || fds == NULL || count < 1)
  {
    warn("Error getting socket FD from launchd");
    return 0;
  }

  if (count != 1)
  {
    warnx("Expected one FD from launchd, got %zu. Only using first socket.", count);
  }

  // Unset FD_CLOEXEC bit
  fcntl(fds[0], F_SETFD, fcntl(fds[0], F_GETFD, 0) & ~FD_CLOEXEC);

  if (fds)
  {
    free(fds);
  }

  return 1;
}

int main(int argc, char **argv)
{
  // List of sockets we're going to check for
  const char *sockets[] = {
      "ssh",
      "browser",
      "extra",
      "std"};
  int fds = 0;
  char *fdsString = NULL;
  char *fdNames = NULL;
  char *tmpfdNames = NULL;

  // Activate the sockets and count and store names
  for (int i = 0; i < sizeof(sockets) / sizeof(sockets[0]); i++)
  {
    if (get_launchd_socket(sockets[i]))
    {
      fds++;
      asprintf(&fdNames, (tmpfdNames == NULL ? "%s%s" : "%s:%s"), (tmpfdNames == NULL ? "" : tmpfdNames), sockets[i]);
      if (tmpfdNames)
      {
        free(tmpfdNames);
      }
      tmpfdNames = fdNames;
    }
  }

  // Set the ENV var for our PID
  char *pidString = NULL;
  asprintf(&pidString, "%ld", (long)getpid());
  setenv("LISTEN_PID", pidString, 0);
  free(pidString);

  // Set the number of FDs we've opened
  asprintf(&fdsString, "%d", fds);
  setenv("LISTEN_FDS", fdsString, 0);
  free(fdsString);

  // And their names
  setenv("LISTEN_FDNAMES", (fdNames == NULL ? "" : fdNames), 0);
  free(fdNames);

  // Launch the command we were passed
  ++argv;
  if (*argv)
  {
    execvp(*argv, argv);
    err(1, "Error executing command");
  }
  else
  {
    errx(1, "No command specified");
  }
}

16:16:37
@ivy:fargone.shIvyperhaps it does16:16:46
@ivy:fargone.shIvyit does not16:17:12
@ivy:fargone.shIvyhttps://github.com/search?q=repo%3AGPGTools%2FMacGPG2%20launch_activate_socket&type=code16:17:16
@ivy:fargone.shIvythis function needs to be called to get the sockets16:17:26
@ivy:fargone.shIvybecause otherwise it cant get the sockets from launchd16:18:07
@saiko:knifepoint.netKatalin 🔪right, they have a launch agent for killing gpg-agent when the user logs out instead16:19:08
@saiko:knifepoint.netKatalin 🔪I wonder how they set it up16:19:15
@ivy:fargone.shIvystill doesnt properly manage the sockets tho16:19:35
@ivy:fargone.shIvyutterly a hack16:19:40
@saiko:knifepoint.netKatalin 🔪mhm16:19:50
@ivy:fargone.shIvyadditionally this does nothing https://github.com/nix-community/home-manager/blob/0e4217b2c4827e71e2e612accccb01981c16afda/modules/services/gpg-agent.nix#L451-L45316:21:03
@ivy:fargone.shIvyas the names are far not what gpg actually wants16:21:20
@ivy:fargone.shIvynor does it know how to get them16:21:27
@ivy:fargone.shIvythe only way to get them is through launch_activate_socket16:21:42
@ivy:fargone.shIvy they could be used as the names but then there would have to be major translation to the real names 16:22:20
@ivy:fargone.shIvywhich have to be "ssh", "extra", "browser" and always finally "std"16:22:37
@ivy:fargone.shIvythis commit which added that literally seems to be untested https://github.com/nix-community/home-manager/commit/ef506124579ff6280a43a9596bb2a5049872bf8e as it will not work16:24:04
@ivy:fargone.shIvyadditionally, patching this is hard as it shouldnt actually be used the gpgConf we need to wrap gpg-agent16:26:19
@ivy:fargone.shIvyi personally have it working but it required a lot of changes16:27:49
@ivy:fargone.shIvyincluding this https://github.com/auscyber/dotfiles/blob/e69c5ae454167f21dbaca7eace8e50e69d5d3454/overlays/literal.nix#L33C1-L39C4 https://github.com/auscyber/dotfiles/blob/master/packages/gpg/default.nix16:28:35
@ivy:fargone.shIvy* additionally, patching this is hard as it shouldnt actually be used the gpgPkg we need to wrap gpg-agent16:32:41
@emilazy:matrix.orgemilyyou don't have to use launchd socket activation though?16:50:08
@emilazy:matrix.orgemilyyou can have GnuPG manage the sockets itself IIRC16:50:11
@emilazy:matrix.orgemily(but yeah, socket activation is nicer. I wrote a version of that C program in Rust long ago)16:50:28
10 Jan 2026
@yatekii:matrix.orgNoahis there an easy way to add applications to startup items on macos?11:37:45

There are no newer messages yet.


Back to Room ListRoom Version: 6