matir/skel
1
0
Fork 0
mirror of https://github.com/Matir/skel.git synced 2026-07-24 13:16:56 -07:00
Code Issues Packages Projects Releases Wiki Activity

Improve SSH_AUTH_SOCK handling.

Browse Source
This commit is contained in:
David Tomaschik
2026-07-07 14:28:37 -07:00
parent 6caee04853
commit a390d0a4d4
1 changed files with 140 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
dotfiles/shenv
View File

@@ -97,10 +97,12 @@ export LVM_SUPPRESS_FD_WARNINGS=1
export EARTHLY_SSH_AUTH_SOCK=""
# Handle SSH_AUTH_SOCK for tmux consistency
_SSH_AUTH_LINK="${HOME}/.ssh/ssh_auth_sock"
case "$-" in
*i*)
_SSH_AUTH_LINK="${HOME}/.ssh/ssh_auth_sock"
# Helper to check if a path is our link or points to it
_is_link_path() {
# Helper to check if a path is our link or points to it
_is_link_path() {
[ -z "$1" ] && return 1
_target="${_SSH_AUTH_LINK:-${HOME}/.ssh/ssh_auth_sock}"
[ "$1" = "${_target}" ] && { unset -v _target; return 0; }
@@ -113,12 +115,21 @@ _is_link_path() {
fi
unset -v _target
return 1
}
}
# Helper to check if an SSH socket is valid and useful via ssh-add return codes
_is_valid_ssh_sock() {
# Helper to check if an SSH socket is valid and useful
_is_valid_ssh_sock() {
[ -z "$1" ] && return 1
[ -S "$1" ] || return 1
if command -v nc >/dev/null 2>&1; then
# Use nc to quickly check if the socket is listening.
# We use -N to shutdown the socket after EOF on stdin (for OpenBSD netcat compatibility).
if echo '' | nc -w 1 -N -U "$1" >/dev/null 2>&1; then
return 0
fi
fi
if command -v ssh-add >/dev/null 2>&1; then
SSH_AUTH_SOCK="$1" ssh-add -l >/dev/null 2>&1
case "$?" in
@@ -126,11 +137,15 @@ _is_valid_ssh_sock() {
*) return 1 ;;
esac
fi
return 0
}
# Function to get the path to the socket for the local ssh-agent
get_local_ssh_agent_sock() {
if command -v nc >/dev/null 2>&1; then
return 1
fi
return 0
}
# Function to get the path to the socket for the local ssh-agent
get_local_ssh_agent_sock() {
_found=""
if [ "$(uname)" = "Darwin" ]; then
_found=$(launchctl getenv SSH_AUTH_SOCK 2>/dev/null)
@@ -180,10 +195,10 @@ get_local_ssh_agent_sock() {
unset -v _found _u _p _search _d
return 1
}
}
# Function to reset SSH_AUTH_SOCK to the local ssh-agent
reset_ssh_socket() {
# Function to reset SSH_AUTH_SOCK to the local ssh-agent
reset_ssh_socket() {
_rss_sock=$(get_local_ssh_agent_sock)
if [ -n "${_rss_sock}" ]; then
_rss_link="${HOME}/.ssh/ssh_auth_sock"
@@ -201,26 +216,26 @@ reset_ssh_socket() {
unset -v _rss_sock
return 1
fi
}
}
_CANDIDATE=""
_CANDIDATE=""
# 1. If current environment has a valid socket that is NOT our link, it's a prime candidate
# (e.g. fresh SSH login: sshd sets SSH_AUTH_SOCK to the raw forwarded socket before ssh/rc
# rewrites it to the stable symlink; the shell inherits the original raw path).
if ! _is_link_path "${SSH_AUTH_SOCK:-}" && _is_valid_ssh_sock "${SSH_AUTH_SOCK:-}"; then
# 1. If current environment has a valid socket that is NOT our link, it's a prime candidate
# (e.g. fresh SSH login: sshd sets SSH_AUTH_SOCK to the raw forwarded socket before ssh/rc
# rewrites it to the stable symlink; the shell inherits the original raw path).
if ! _is_link_path "${SSH_AUTH_SOCK:-}" && _is_valid_ssh_sock "${SSH_AUTH_SOCK:-}"; then
_CANDIDATE="${SSH_AUTH_SOCK}"
fi
fi
# 2. Only look for a system agent if the stable link is already broken. If the link is
# valid (e.g. a tmux pane where SSH_AUTH_SOCK points to our symlink which ssh/rc just
# updated to the forwarded socket), leave it alone — don't clobber it with a local agent.
if [ -z "${_CANDIDATE}" ] && ! _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
# 2. Only look for a system agent if the stable link is already broken. If the link is
# valid (e.g. a tmux pane where SSH_AUTH_SOCK points to our symlink which ssh/rc just
# updated to the forwarded socket), leave it alone — don't clobber it with a local agent.
if [ -z "${_CANDIDATE}" ] && ! _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
_CANDIDATE=$(get_local_ssh_agent_sock)
fi
fi
# 3. Sync the stable link if we found a valid "real" socket.
if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_sock "${_CANDIDATE}"; then
# 3. Sync the stable link if we found a valid "real" socket.
if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_sock "${_CANDIDATE}"; then
mkdir -p "$(dirname "${_SSH_AUTH_LINK}")"
ln -sf "${_CANDIDATE}" "${_SSH_AUTH_LINK}"
export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
@@ -228,12 +243,14 @@ if [ -n "${_CANDIDATE}" ] && ! _is_link_path "${_CANDIDATE}" && _is_valid_ssh_so
if command -v systemctl >/dev/null 2>&1; then
systemctl --user set-environment SSH_AUTH_SOCK="${_SSH_AUTH_LINK}" 2>/dev/null
fi
elif _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
elif _is_valid_ssh_sock "${_SSH_AUTH_LINK}"; then
# If we found nothing better but the link is valid, use it.
export SSH_AUTH_SOCK="${_SSH_AUTH_LINK}"
fi
fi
unset _SSH_AUTH_LINK _CANDIDATE
unset _SSH_AUTH_LINK _CANDIDATE
;;
esac
# Setup XDG-like dirs on MacOS
# Based on https://leebyron.com/til/mac-xdg/