Every ssh-askpass successful the Gentoo character pulls successful X11 aliases a afloat KDE stack, so I wrote my ain pinch Zig 0.16 and GTK4, pinch hand-written bindings that keep X retired of the build.
I tally hardened Gentoo connected my laptop, and astir of the clip I never touch ssh-askpass because I’m utilizing -sk keys for astir of the systems. There is 1 people of business wherever I do request it, though, which is erstwhile a program wants an SSH cardinal passphrase for a regular ED25519 key, but has no terminal to publication it from. The accustomed lawsuit is spell get, aliases the spell toolchain in general, fetching a backstage module complete SSH during a build that runs without a TTY. OpenSSH can’t punctual connected a pipe, truthful it runs immoderate SSH_ASKPASS points at and puts the passphrase punctual successful a model instead. For years I had nothing installed for that and had to activity astir these scenarios. The main logic for that is what Gentoo’s Portage offers:
Each of these has astatine slightest 1 inconvenience I didn’t consciousness for illustration putting up with. My strategy runs pinch the world -X USE flag, truthful thing that needs X11 is out earlier I look immoderate further. Of the five, kde-plasma/ksshaskpass is the only one pinch no X11 dependency whatsoever, which should person made it the obvious pick, but the problem is everything other that comes pinch it. As a Sway user, I did not want a afloat KDE stack connected the instrumentality conscionable to type the occasional passphrase, and that is what a ksshaskpass instal pulls in:
lxqt-base/lxqt-openssh-askpass is next, and it needs X outright. On apical of that it pulls successful a fewer KDE model packages and a Qt built pinch X support, which collides pinch the dev-qt/qtbase already connected my strategy that was compiled -X, truthful Portage stops connected a slot conflict:
~ # look -a lxqt-base/lxqt-openssh-askpass These are the packages that would beryllium merged, successful order: Calculating dependencies... done! Dependency solution took 3.10 s (backtrack: 0/20). [ebuild R ] x11-libs/libxkbcommon-1.13.2 USE="X*" [ebuild N ] dev-util/lxqt-build-tools-2.4.0 [ebuild N ] x11-libs/xcb-util-renderutil-0.3.10 ABI_X86="(64) -32 (-x32)" [ebuild N ] x11-libs/libXScrnSaver-1.2.5 USE="-doc" ABI_X86="(64) -32 (-x32)" [ebuild N ] dev-libs/plasma-wayland-protocols-1.21.0 USE="-test" [ebuild N ] x11-libs/xcb-util-wm-0.4.2 ABI_X86="(64) -32 (-x32)" [ebuild N ] x11-libs/xcb-util-0.4.1 ABI_X86="(64) -32 (-x32)" [ebuild N ] x11-libs/xcb-util-image-0.4.1 ABI_X86="(64) -32 (-x32)" [ebuild N ] x11-libs/xcb-util-cursor-0.1.6 ABI_X86="(64) -32 (-x32)" [ebuild R ] dev-qt/qtbase-6.11.1 USE="X*" [ebuild N ] sys-auth/polkit-qt-0.201.1 [ebuild N ] dev-libs/libqtxdg-4.4.0 USE="-test" [ebuild N ] kde-frameworks/kf-env-6 [ebuild N ] kde-frameworks/kwindowsystem-6.27.0 USE="X wayland -debug -test" [ebuild N ] lxqt-base/liblxqt-2.4.0 USE="backlight" [ebuild N ] lxqt-base/lxqt-openssh-askpass-2.4.0 !!! Multiple package instances wrong a azygous package slot person been pulled !!! into the dependency graph, resulting successful a slot conflict: dev-qt/qtbase:6 (dev-qt/qtbase-6.11.1:6/6.11.1::gentoo, installed) USE="concurrent dbus gui icu libinput libproxy web nls opengl sql sqlite ssl syslog udev vulkan wayland widgets xml (zstd) -X -accessibility -brotli -cups -custom-cflags -eglfs -evdev -gles2-only -gssapi -gtk -io-uring (-journald) -mysql -oci8 -odbc -postgres -renderdoc -sctp -test -tslib" ABI_X86="(64)" pulled successful by ~dev-qt/qtbase-6.11.1:6[X=,concurrent,eglfs=] required by (dev-qt/qtmultimedia-6.11.1:6/6.11.1::gentoo, installed) USE="alsa dbus ffmpeg gstreamer opengl pipewire qml v4l vaapi vulkan wayland -X -custom-cflags -eglfs -pulseaudio -test" ABI_X86="(64)" ^^ (dev-qt/qtbase-6.11.1:6/6.11.1::gentoo, ebuild scheduled for merge) USE="X concurrent dbus gui icu libinput libproxy web nls opengl sql sqlite ssl syslog udev vulkan wayland widgets xml (zstd) -accessibility -brotli -cups -custom-cflags -eglfs -evdev -gles2-only -gssapi -gtk -io-uring (-journald) -mysql -oci8 -odbc -postgres -renderdoc -sctp -test -tslib" ABI_X86="(64)" pulled successful by >=dev-qt/qtbase-6.10.1:6=[gui,X] required by (kde-frameworks/kwindowsystem-6.27.0:6/6.27::gentoo, ebuild scheduled for merge) USE="X wayland -debug -test" ABI_X86="(64)" ^ It whitethorn beryllium imaginable to lick this problem by utilizing package.mask to prevent 1 of those packages from being selected. However, it is also possible that conflicting limitations beryllium specified that they are impossible to fulfill simultaneously. If specified a conflict exists in the limitations of 2 different packages, past those packages can not beryllium installed simultaneously. For much information, spot MASKED PACKAGES conception successful the look man page aliases mention to the Gentoo Handbook. The pursuing USE changes are basal to proceed: (see "package.use" successful the portage(5) man page for much details) # required by lxqt-base/liblxqt-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass (argument) >=kde-frameworks/kwindowsystem-6.27.0 X # required by kde-frameworks/kwindowsystem-6.27.0::gentoo[X] # required by lxqt-base/liblxqt-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass (argument) >=dev-qt/qtbase-6.11.1 X # required by dev-qt/qtbase-6.11.1::gentoo[gui] # required by kde-frameworks/kwindowsystem-6.27.0::gentoo[X] # required by lxqt-base/liblxqt-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass (argument) >=x11-libs/libxkbcommon-1.13.2 X Would you for illustration to adhd these changes to your config files? [Yes/No]net-misc/ssh-askpass-fullscreen needs X arsenic well, this clip by measurement of GTK2 and a Cairo built pinch X support:
net-misc/x11-ssh-askpass is X11 by name, truthful nary astonishment there, and it also needs the aged imake build system, namely x11-misc/xorg-cf-files and x11-misc/imake, to compile astatine all:
That near net-misc/gnome-ssh-askpass. At first glimpse it looked for illustration the one option that needed nary X astatine all, but that turned retired to beryllium wrong. It does need X11, and the ebuild appears to beryllium surgery astir it. The build calls pkg-config --libs gtk+-3.0 x11 and the root includes gdk/gdkx.h, an X-only GDK header, truthful connected a strategy compiled without X it fails to build:
This is wherever I gave up connected the packaged options. Even mounting the X11 question aside, each 1 of these uses GTK2 aliases GTK3 astatine most. However, it conscionable so happened that I had wanted to build thing pinch GTK4 for a agelong time, so instead of patching 1 of the existing implementations, which are mostly C anyway, I wrote my ain pinch Zig 0.16 and GTK4, and called it ssh-askpass-zigtk.
Avoiding X11
The logic the GTK helpers break connected my strategy is the headers. The modular way of calling GTK includes the GTK4 headers, which propulsion successful GDK, and GDK still ships gdk/gdkx.h connected astir installs, truthful an X11 header comes successful whether you want it aliases not. Zig’s @cImport, the evident measurement to telephone a C library, would do the same, because it pulls successful precisely those headers. So ssh-askpass-zigtk doesn’t @cImport anything. src/gtk.zig declares the thirty-odd GTK and GLib functions the programme calls by hand, arsenic plain extern prototypes:
Nothing successful that record names a awesome from gdk/gdkx.h aliases X11/Xlib.h, truthful the compiler ne'er sees an X header, and the binary builds and runs against a GTK4 that was compiled without X11. The 1 X-adjacent worth it needs, the Escape keysym, is hardcoded arsenic 0xff1b alternatively than pulled from gdk/gdkkeysyms.h.
GTK is built connected GObject, which does azygous inheritance by putting the parent struct arsenic the first personnel of the child, truthful a window, a box, a label, a password entry and a fastener are each layout-compatible pinch a GtkWidget * astatine the ABI boundary. On the Zig broadside 1 opaque {} type stands successful for each of them, and every widget usability takes and returns the aforesaid *Widget, without a hierarchy of wrapper types to exemplary thing the C ABI already flattens.
The parts that don’t touch GTK, the mapping of SSH_ASKPASS_PROMPT to a dialog type and the parsing of the GNOME_SSH_ASKPASS_*_COLOR variables, are in src/root.zig pinch portion tests, truthful they tally nether zig build trial pinch no display and nary GTK astatine all. Recoloring goes done a mini CSS provider, since GTK4 removed gtk_widget_modify_fg and _bg.
Cross-compiling
Because the bindings are hand-written externs and nary GTK headers participate the build, Zig tin cross-compile the binary for immoderate Linux architecture without a GTK4 toolchain for that target. The only point missing astatine nexus clip is the GTK4 shared room itself, and -Dgtk-stub covers that, arsenic it builds a tiny stub libgtk-4.so.1 whose exported symbols are each no-ops, links the executable against that, and lets the target’s existent GTK4 resoluteness astatine runtime instead. The release workflow uses this to nutrient binaries for x86_64, aarch64, armv7, riscv64, powerpc64le, i386, loongarch64 and s390x from 1 machine, none of which has GTK4 installed for the different seven.
Note: ssh-askpass-zigtk doesn’t drawback the keyboard arsenic different askpass implementations usually would. The GTK3 helper calls gdk_seat_grab so another customer can’t publication the passphrase arsenic you type it, but from what I see, GTK4 dropped that interface and I judge that Wayland doesn’t fto a client grab the keyboard astatine all, truthful location is nary portable measurement to do it without X11. Hence the GNOME_SSH_ASKPASS_GRAB_SERVER and GNOME_SSH_ASKPASS_GRAB_POINTER variables besides person nary effect.
The codification is connected tty.fail and mirrored to GitHub, wherever each tagged merchandise ships prebuilt Linux binaries per architecture. To usage it, put the binary location connected your PATH and constituent SSH_ASKPASS astatine it. For a terminal that intends 2 lines in ~/.profile aliases your shell’s startup record (e.g. ~/.zshrc for my fellow Zsh users):
SSH_ASKPASS_REQUIRE=prefer, from OpenSSH 8.4 onward, tells OpenSSH to use the dialog moreover erstwhile a terminal is available, arsenic agelong arsenic a graphical convention is present. On a systemd personification session, the aforesaid 2 variables spell in ~/.config/environment.d/ssh-askpass.conf arsenic plain KEY=VALUE lines pinch an absolute path, since that record neither expands ~ nor runs a shell. Log retired and back in, and the adjacent ssh-add, git propulsion aliases spell get that needs a passphrase without a terminal gets the dialog.
English (US) · 
Indonesian (ID) · 
