twpayne
commented
1 year ago I think what is happening here is:
- 1Password uses polkit.
- polkit does a bunch of checks on the client (the 1Password CLI,
op, in this case) to determine whether it is allowed to connect to the server (the 1Password app, in this case). - The configuration of polkit on Pop_OS! prevents
opfrom connecting to the 1Password server whenopis executed by chezmoi.
The evidence I have to support this belief is;
- chezmoi's 1Password integration works on many other distributions.
- The error message from
opwhen run by chezmoi includesconnecting to desktop app: read: connection resetimplying that the connection is made and then immediately dropped.
I use 1Password myself for my own secrets, and chezmoi works fine on Ubuntu 22.04 and Ubuntu 22.10. I vaguely recall seeing the same issue as you see when I briefly experimented with Pop_OS!. I did not investigate further at the time however.
I think you need to configure polkit on your machine to allow chezmoi to connect to 1Password. For reference, here is the content of /usr/share/polkit-1/actions/com.1password.1Password.policy on my Ubuntu 22.10 machine where chezmoi is allowed to talk to 1Password:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policyconfig PUBLIC
"-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
"http://www.freedesktop.org/standards/PolicyKit/1.0/policyconfig.dtd">
<policyconfig>
<action id="com.1password.1Password.unlock">
<description>Unlock 1Password</description>
<message>Authenticate to unlock 1Password</message>
<defaults>
<allow_any>auth_self</allow_any>
<allow_inactive>auth_self</allow_inactive>
<allow_active>auth_self</allow_active>
</defaults>
</action>
<action id="com.1password.1Password.authorizeCLI">
<description>Authorize CLI</description>
<message>1Password CLI is trying to access your 1Password account.</message>
<defaults>
<allow_any>auth_self</allow_any>
<allow_inactive>auth_self</allow_inactive>
<allow_active>auth_self</allow_active>
</defaults>
<annotate key="org.freedesktop.policykit.owner">unix-user:twp </annotate>
</action>
<action id="com.1password.1Password.authorizeSshAgent">
<description>Authorize SSH Agent</description>
<message>1Password SSH Agent is trying to access your 1Password account.</message>
<defaults>
<allow_any>auth_self</allow_any>
<allow_inactive>auth_self</allow_inactive>
<allow_active>auth_self</allow_active>
</defaults>
<annotate key="org.freedesktop.policykit.owner">unix-user:twp </annotate>
</action>
</policyconfig>Note that my username is twp. You will need to replace twp with dan in the above.
Hope this helps as a starting point. This is a 1Password/Pop_OS! issue, not a chezmoi issue.
dmlo
Describe the bug
Chezmoi template command
onepasswordReadcannot connect to 1password's CLI interface on Pop_OS! 22.04:To reproduce
opcommandchezmoi execute-template '{{ onepasswordRead "op://private/<snip>/username" }}'Expected behavior
Chezmoi should connect to 1password's CLI command
opand retrieve the requested token.Output of command with the
--verboseflagOutput of
chezmoi doctorAdditional context
Debug output:
Executing
op signin --rawexecutes correctly (no output).Thank you for your time.