zsh: gpg forward socket must be same user

[dotfiles.git] / etc / zsh / .zprofile

diff --git a/etc/zsh/.zprofile b/etc/zsh/.zprofile
index 5ead916d8ec93559a6fda4947c36f1fea262f19b..c66bfb567044654cffa0659689d241e69f43f011 100644 (file)
--- a/etc/zsh/.zprofile
+++ b/etc/zsh/.zprofile
@@ -81,34 +81,36 @@ if [[ ! -v _sev_setup_gpg_forward && -v commands[gpg] ]] {
     export _sev_gpg_forward_dir=$XDG_RUNTIME_DIR/gnupg/.ssh_forward
     _sev_zcleanup gpg-forward
 
     export _sev_gpg_forward_dir=$XDG_RUNTIME_DIR/gnupg/.ssh_forward
     _sev_zcleanup gpg-forward
 

-    # find our forwarded socket
-    s=($_GNUPG_SOCK_DEST_BASE*(N=oc[1]))
-    if [[ -n $s && -v SSH_CLIENT ]] {
-        # create new forward dir
-        export _sev_setup_gpg_forward=
-        h=$_sev_gpg_forward_dir/$$
-        mkdir -pm700 $h
-        for x (gpg{,-agent}.conf sshcontrol random_seed
-               pubring.kbx{,~} trustdb.gpg private-keys-v1.d crls.d) {
-            ln -s ${GNUPGHOME:-~/.gnupg}/$x $h
-        }
-        export GNUPGHOME=$h
-        unset h
-        for x in $(gpgconf --list-dirs | grep 'agent-.*-\?socket:'); do
-            x=$(_gpg_socketpath ${x/#agent-*socket:})
-            if [[ ! -v primary ]] {
-                # move forwarded socket to first valid agent socket path
-                # XXX: if tmp is on different filesystem this may not work
-                mv $s $x
-                primary=$x
-            } else {
-                # make links to forwarded socket for any others
-                ln -s $primary $x
+    # check for a forwarded socket
+    if [[ -v SSH_CLIENT ]] {
+        s=($_GNUPG_SOCK_DEST_BASE*(N=u[$LOGNAME]oc[1]))
+        if [[ -n $s ]] {
+            # create new forward dir
+            export _sev_setup_gpg_forward=
+            h=$_sev_gpg_forward_dir/$$
+            mkdir -pm700 $h
+            for x (gpg{,-agent}.conf sshcontrol random_seed
+                   pubring.kbx{,~} trustdb.gpg private-keys-v1.d crls.d) {
+                ln -s ${GNUPGHOME:-~/.gnupg}/$x $h
+            }
+            export GNUPGHOME=$h
+            unset h
+            for x ($(gpgconf --list-dirs | grep 'agent-.*-\?socket:')) {
+                x=$(_gpg_socketpath ${x/#agent-*socket:})
+                if [[ ! -v primary ]] {
+                    # move forwarded socket to first valid agent socket path
+                    # XXX: if tmp is on different filesystem this may not work
+                    mv $s $x
+                    primary=$x
+                } else {
+                    # make links to forwarded socket for any others
+                    ln -s $primary $x
+                }

             }
             }

-        done
-        unset x primary
+            unset x primary
+        }
+        unset s

     }
     }

-    unset s

 
     # what we will forward if we start a new ssh connection
     # NOTE: do this after setting up GNUPGHOME to pick up new socket path;
 
     # what we will forward if we start a new ssh connection
     # NOTE: do this after setting up GNUPGHOME to pick up new socket path;


@@ -188,6 +190,7 @@ if [[ ! -v _sev_setup_ssh ]] {
             #      subshells can't be used to capture output and print.
             c='TMPDIR=$_sev_tmp ${okc}ssh-agent'
             if [[ -o interactive ]] {
             #      subshells can't be used to capture output and print.
             c='TMPDIR=$_sev_tmp ${okc}ssh-agent'
             if [[ -o interactive ]] {

+                [[ -n $okc ]] && echo -n 'OKC-'

                 eval $(eval $=c)
                 print -nP '%f'
             } else {
                 eval $(eval $=c)
                 print -nP '%f'
             } else {


@@ -220,5 +223,8 @@ if [[ ! -v _sev_setup_ssh ]] {
 }
 unfunction _gpg_socketpath
 
 }
 unfunction _gpg_socketpath
 

+### plugins
+load-plugins zprofile
+

 ### load site-specific
 load-site-dotfile zprofile
 ### load site-specific
 load-site-dotfile zprofile