Remco SmitsandEric Holk
ea68882d4b
Closes https://github.com/zed-industries/zed/issues/61806 Follow-up to #58791 and #61265. # Objective Since Zed started injecting its own gpg wrapper for commit signing, the wrapper's "silent first attempt" used `--pinentry-mode error`, which forbids gpg-agent from launching *any* pinentry. That was meant to avoid the `gpg: signing failed: Inappropriate ioctl for device` failure from TTY-based pinentries, but it also blocked **GUI** pinentries like pinentry-mac, which need no TTY and can supply the passphrase silently from the macOS Keychain. For users with that setup (and gpg-agent's in-memory cache disabled via `default-cache-ttl 0`), the first attempt always failed and Zed's passphrase modal appeared on **every commit**, even though terminal git signed silently. This also makes the setting proposed in #61533 unnecessary: instead of asking users to choose between Zed's prompt and the system pinentry, the wrapper now tries the system pinentry automatically and only falls back to Zed's askpass modal when gpg genuinely cannot obtain the passphrase on its own. ## Solution Restructure the wrapper script to sign in three stages, most silent first, so every pinentry configuration self-selects the right behavior without any detection or settings: 1. **`--pinentry-mode error`**: succeeds only via gpg-agent's passphrase cache or an unprotected key; guaranteed to never prompt anywhere. This keeps the #61265 behavior byte-identical. 2. **Default pinentry mode**: lets the configured pinentry run, exactly like terminal git. GUI pinentries (e.g. pinentry-mac reading the macOS Keychain) need no TTY and sign silently or show their native dialog; TTY pinentries fail fast with `Inappropriate ioctl for device` because git spawns gpg without a TTY. 3. **Loopback mode**: asks for the passphrase via Zed's askpass modal and hands it to gpg on fd 3, for setups where gpg cannot prompt at all (e.g. when gpg-agent's `pinentry-program` is not configured). ## Testing Initial steps: 1. Run `security delete-generic-password -s GnuPG` to remove the GnuPG keychain entry, forcing you to re-enter your passphrase (start from the initial state of issue) 2. (**optional for a few test cases**) Configure your `~/.gnupg/gpg-agent.conf` with `pinentry-program /opt/homebrew/bin/pinentry-mac` 3. Run `gpgconf --kill gpg-agent` to force reset/kill the gpg agent cache Cases to test: 1. Have no existing gpg key and you can still commit without needing to enter a passphrase 2. Have a gpg key configured in git but no `~/.gnupg/gpg-agent.conf` config that configures the `pinentry-program` This should still request your passphrase via Zed's askpass modal, even though no `pinentry-program` is configured and committing via the terminal throws an error `gpg: signing failed: Inappropriate ioctl for device` 3. Have a gpg key configured in git and a `~/.gnupg/gpg-agent.conf` config that configures the `pinentry-program`, and cancel the native pinentry program → Zed should fall back to requesting your passphrase via the askpass modal 4. Have a gpg key configured in git and a `~/.gnupg/gpg-agent.conf` config that configures the `pinentry-program`, and fill in your passphrase via the native pinentry program with storing your passphrase in the keychain **disabled** 5. Have a gpg key configured in git and a `~/.gnupg/gpg-agent.conf` config that configures the `pinentry-program`, and fill in your passphrase via the native pinentry program with storing your passphrase in the keychain **enabled** → subsequent commits sign silently, matching terminal git ## Self-Review Checklist: - [x] I've reviewed my own diff for quality, security, and reliability - [x] Unsafe blocks (if any) have justifying comments - [x] The content adheres to Zed's UI standards ([UX/UI](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist) and [icon](https://github.com/zed-industries/zed/blob/main/crates/icons/README.md) guidelines) - [ ] Tests cover the new/changed behavior - [x] Performance impact has been considered and is acceptable ## Showcase **After: (Testing that the system pinentry program is used and works without needing to reenter your passphrase everytime only when you remove it from your keychain)** https://github.com/user-attachments/assets/0c8cdd11-957d-443a-ab10-1579bbf3b49e --- Release Notes: - Git: Fixed the GPG passphrase modal appearing on every commit for users whose configured pinentry (e.g. pinentry-mac with the macOS Keychain) can supply the passphrase without Zed's help. Zed now only prompts when gpg cannot obtain the passphrase on its own. --------- Co-authored-by: Eric Holk <eric@zed.dev>
Zed
Welcome to Zed, a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter.
Installation
On macOS, Linux, and Windows you can download Zed directly or install Zed via your local package manager (macOS/Linux/Windows).
Other platforms are not yet available:
- Web (tracking discussion)
Developing Zed
Contributing
See CONTRIBUTING.md for ways you can contribute to Zed.
Also... we're hiring! Check out our jobs page for open roles.
Licensing
Zed source code is licensed primarily under GPL-3.0-or-later, with Apache-2.0 components where marked.
License information for third party dependencies must be correctly provided for CI to pass.
We use cargo-about to automatically comply with open source licenses. If CI is failing, check the following:
- Is it showing a
no license specifiederror for a crate you've created? If so, addpublish = falseunder[package]in your crate's Cargo.toml. - Is the error
failed to satisfy license requirementsfor a dependency? If so, first determine what license the project has and whether this system is sufficient to comply with this license's requirements. If you're unsure, ask a lawyer. Once you've verified that this system is acceptable add the license's SPDX identifier to theacceptedarray inscript/licenses/zed-licenses.toml. - Is
cargo-aboutunable to find the license for a dependency? If so, add a clarification field at the end ofscript/licenses/zed-licenses.toml, as specified in the cargo-about book.
Sponsorship
Zed is developed by Zed Industries, Inc., a for-profit company.
If you’d like to financially support the project, you can do so via GitHub Sponsors. Sponsorships go directly to Zed Industries and are used as general company revenue. There are no perks or entitlements associated with sponsorship.