From 3ceeb190f89f5fca3b266e1a10dbf28fe4af38f4 Mon Sep 17 00:00:00 2001
From: Tristan Watson <tristan@triwats.com>
Date: Fri, 7 Aug 2026 16:23:17 +0100
Subject: [PATCH 1/2] fix(gpg): Point pinentry-program at a real binary, split
 conf per-platform

pinentry-program had been corrupted to point at the config file itself:

    pinentry-program /Users/triwats/src/dotfiles/gpg-agent.conf

That is not an executable, so gpg-agent cannot spawn a pinentry at all:

    $ printf 'BYE\n' | .../gpg-agent.conf
    permission denied

With commit.gpgsign=true and enable-ssh-support, that breaks commit signing
and gpg-agent-backed SSH the moment the passphrase cache expires or the
agent restarts. It survived unnoticed only because the running agent still
held the pre-corruption config in memory.

Fixed by restoring a real pinentry path. Because the correct path is
platform-specific, and gpg-agent.conf has no `include` directive while
pinentry-program requires a literal absolute path (no ~ or $HOME
expansion), a single shared file cannot work across both platforms. So:

  gpg-agent.conf -> gpg-agent-linux.conf   /usr/bin/pinentry-gnome3
                    gpg-agent-macos.conf   /opt/homebrew/bin/pinentry-mac

The two files are otherwise byte-identical; the rename is a pure rename
(the linux variant matches the previous committed content exactly).

install.conf.yaml selects between them with dotbot's `if:` on uname. They
are separate `link:` blocks on purpose: both map the same destination,
which would collide as a duplicate YAML key inside a single block.

Verified: ./install links the macos variant and skips the linux one on
this machine; the linked pinentry completes an Assuan handshake.

Note for Intel Macs: Homebrew's prefix is /usr/local, not /opt/homebrew,
so gpg-agent-macos.conf will need adjusting there.
---
 gpg-agent.conf => gpg-agent-linux.conf |  0
 gpg-agent-macos.conf                   |  8 ++++++++
 install.conf.yaml                      | 22 +++++++++++++++++-----
 3 files changed, 25 insertions(+), 5 deletions(-)
 rename gpg-agent.conf => gpg-agent-linux.conf (100%)
 create mode 100644 gpg-agent-macos.conf

diff --git a/gpg-agent.conf b/gpg-agent-linux.conf
similarity index 100%
rename from gpg-agent.conf
rename to gpg-agent-linux.conf
diff --git a/gpg-agent-macos.conf b/gpg-agent-macos.conf
new file mode 100644
index 0000000..3925b8f
--- /dev/null
+++ b/gpg-agent-macos.conf
@@ -0,0 +1,8 @@
+pinentry-program /opt/homebrew/bin/pinentry-mac
+enable-ssh-support
+default-cache-ttl-ssh 28800
+max-cache-ttl-ssh 43200
+debug-level advanced
+log-file /var/log/gpg-agent.log
+default-cache-ttl 600
+max-cache-ttl 7200
diff --git a/install.conf.yaml b/install.conf.yaml
index 9c80699..421e3c1 100644
--- a/install.conf.yaml
+++ b/install.conf.yaml
@@ -6,14 +6,26 @@
       path: gitconfig
     ~/.vimrc: vimrc
     ~/.zshrc: zshrc
-    ~/.gnupg/gpg-agent.conf:
-      force: true
-      create: true
-      path: gpg-agent.conf
     ~/.config/sway/config:
       force: true
       create: true
       path: sway-config
-    
 
+# gpg-agent.conf has no `include` directive, and pinentry-program requires a
+# literal absolute path (no ~ or $HOME expansion), so a single shared file
+# cannot work across platforms. Two variants, selected by uname.
+# These are separate `link:` blocks on purpose: both map the same destination,
+# which would collide as a duplicate key inside one block.
+- link:
+    ~/.gnupg/gpg-agent.conf:
+      if: '[ "$(uname -s)" = "Darwin" ]'
+      force: true
+      create: true
+      path: gpg-agent-macos.conf
 
+- link:
+    ~/.gnupg/gpg-agent.conf:
+      if: '[ "$(uname -s)" != "Darwin" ]'
+      force: true
+      create: true
+      path: gpg-agent-linux.conf

From c1d0ed864e3f84bdec8e3014f24d82b99132165a Mon Sep 17 00:00:00 2001
From: Tristan Watson <tristan@triwats.com>
Date: Fri, 7 Aug 2026 16:25:41 +0100
Subject: [PATCH 2/2] refactor(install): Minimize install.conf.yaml diff to
 avoid clashing with #1

The previous revision rewrote install.conf.yaml wholesale, including its
trailing whitespace. #1 inserts its link entry directly above that same
trailing whitespace, so the two branches overlapped there and
`git merge-tree` reported a conflict in this file.

Rebuilt from master byte-for-byte, changing only two well-separated
hunks: remove the old gpg-agent.conf entry, and append the conditional
blocks after the existing tail. No functional change.
---
 install.conf.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/install.conf.yaml b/install.conf.yaml
index 421e3c1..5a8798d 100644
--- a/install.conf.yaml
+++ b/install.conf.yaml
@@ -10,6 +10,8 @@
       force: true
       create: true
       path: sway-config
+    
+
 
 # gpg-agent.conf has no `include` directive, and pinentry-program requires a
 # literal absolute path (no ~ or $HOME expansion), so a single shared file