How does gitsign-credentials-cache with systemd user units work?

[britter]

Hi,

I've set up gitsign with gitsign-credentials-cache on Fedora via Home Manager. When I try to make a commit, the commit commands hangs for a long while. The systemd log for cache unit show the following:

May 05 09:27:05 fedora gitsign-credential-cache[2553]: error getting code from local server: timeout
May 05 09:27:05 fedora gitsign-credential-cache[2553]: Go to the following link in a browser:
May 05 09:27:05 fedora gitsign-credential-cache[2553]:          <redacted>
May 05 09:27:05 fedora gitsign-credential-cache[2553]: Enter verification code:
May 05 09:27:05 fedora gitsign-credential-cache[2553]: error getting signer: oauth2: "invalid_request" "Required param: code."
May 05 09:27:07 fedora gitsign-credential-cache[2553]: Store fedora@/home/my-user/path/to/repository

After that the git command stops hanging and opens the browser. It logs the following:

error getting cached creds: error getting new identity: oauth2: "invalid_request" "Required param: code."
Your browser will now be opened to:
<redacted>
tlog entry created with index: 206779317
[main f99fba9] Test signing
 1 file changed, 1 insertion(+)

When I do another commit right after that, reusing the cached credentials works. The systemd user unit logs

May 05 09:30:18 fedora gitsign-credential-cache[2553]: Get fedora@/home/my-user/path/to/repository
May 05 09:30:18 fedora gitsign-credential-cache[2553]: found cred!

But it only lasts for a while and then when I make a commit it starts all over again with git commit hanging.

I think there's some important piece missing. To me it looks like the systemd unit is unable to make the browser pop up. So it just hangs an nothing happens. Eventually it times out and then gitsign running in the foreground I'm trying to make the commit takes over opening the browser, which seems to work.

Appreciate any pointers!

[wlynch]

I'm not very familiar with systemd so I might not be able to help with specific questions there, but your hypothesis sounds right to me.

The credential cache works by delegating the credential flow to the cache binary (including the interactive login flow) which stores the cert in memory for its lifetime (10 mins) for signing operations.
What looks like is happening is the cache binary is trying to get a cert, doesn't have a valid token so it's sending you through the auth flow. It can't detect/open a browser session so it's falling back to the device code flow which is likely what's causing it to look like its hanging because it's waiting for the response from the device flow in the background. When you go through the interactive flow in the foreground, the cert gets caches so it's good for the 10 min window until it expires.

[britter]

Okay, I learned some more about what is happening. I don't think this is related to gitsign or the systemd unit definitions shared by they project. Instead this seems to be an issue with my setup. I'm using Home Manager on Fedora to generate the systemd unit files and it seems that the user units started by Home Manager do not see the DISPLAY and DBUS_SESSION_BUS_ADDRESS environment variables. When I run

systemctl --user import-environment DISPLAY DBUS_SESSION_BUS_ADDRESS
systemctl --user restart gitsign-credential-cache.service

Then everything works fine. I think I need to find a way to have Home manager do this. I also asked about this in Home Manager's Matrix channel: https://matrix.to/#/!YllBCgVdcoakoavZvX:rycee.net/$dTwsWx0plzIu2UogPU7wE7BapR1Dz51niFZnW7QEkZ0?via=nixos.org&via=matrix.org&via=tchncs.de

they need to be set in the systemd user activation environment; this can be done by 'dbus-update-activation-environment --systemd DISPLAY DBUS_SESSION_BUS_ADDRESS', though this should already be handled by your X session manager

Currently I don't know where exactly would be the right place in my home manager configuration to do this. If I find out, I'll come back and comment again.