From 270ffa8208761c24a09477d858142bf3aa99ac15 Mon Sep 17 00:00:00 2001 From: Daniel Fainberg Date: Wed, 8 Jul 2026 10:21:14 +0200 Subject: [PATCH] fix(ssh): give ssh-agent askpass env for verify-required sk keys The agent, not the client, collects the FIDO PIN when signing with an agent-held verify-required `sk-ssh-ed25519` key. Its systemd user service started with a minimal env lacking `SSH_ASKPASS`, so those signatures failed as "incorrect passphrase supplied to decrypt private key". Set `SSH_ASKPASS` and `SSH_ASKPASS_REQUIRE=force` on the unit so the agent can pop pinentry. Co-Authored-By: Claude Opus 4.8 --- modules/home.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/modules/home.nix b/modules/home.nix index 3ad82d2..7c5e4e9 100644 --- a/modules/home.nix +++ b/modules/home.nix @@ -548,6 +548,17 @@ in # gpg's ssh support is off, so this is the only agent. Keys are added on # demand — nothing here presumes a particular ssh config. services.ssh-agent.enable = true; + # The agent, not the ssh client, collects the FIDO PIN when signing with a + # verify-required sk-ed25519 key it holds — so the *agent's* environment needs + # the askpass helper. The systemd user service starts with a minimal env that + # lacks it, so such signatures fail with the misleading "incorrect passphrase + # supplied to decrypt private key". REQUIRE=force drives the prompt with no + # DISPLAY (a daemon has none); sshAskpass exits 0 for the touch step, so only + # the PIN pops a dialog. + systemd.user.services.ssh-agent.Service.Environment = [ + "SSH_ASKPASS=${sshAskpass}" + "SSH_ASKPASS_REQUIRE=force" + ]; services.mako = { enable = true;