apt-get install debian-wizard https://raphaelhertzog.com Insider infos, master your Debian/Ubuntu distribution Mon, 10 Nov 2025 16:20:52 +0000 en-US hourly 1 https://wordpress.org/?v=6.8.5 How to choose your SSH agent with Wayland and systemd https://raphaelhertzog.com/2025/11/10/how-to-choose-your-ssh-agent-with-wayland-and-systemd/ https://raphaelhertzog.com/2025/11/10/how-to-choose-your-ssh-agent-with-wayland-and-systemd/#comments Mon, 10 Nov 2025 16:20:52 +0000 https://raphaelhertzog.com/?p=4072 If you read the above title, you might wonder how the switch to wayland (yes, the graphical stack replacing the venerable X11) can possibly relate to SSH agents. The answer is easy.

For as long as I can remember, as a long time user of gpg-agent as SSH agent (because my SSH key is a GPG sub-key) I relied on /etc/X11/Xsession.d/90gpg-agent that would configure the SSH_AUTH_SOCK environment variable (pointing to gpg-agent’s socket) provided that I added enable-ssh-support in ~/.gnupg/gpg-agent.conf.

Now when I switched to Wayland, that shell script used in the startup sequence of Xorg was no longer used. During a while I cheated a bit by setting SSH_AUTH_SOCK directly in my ~/.bashrc. But that only works for terminals, and not for other applications that are started by the session manager (which is basically systemd --user).

So how is that supposed to work out of the box nowadays? The SSH agents (as packaged in Debian) have all adopted the same trick, their .socket unit have an ExecStartPost setting which runs systemctl --user set-environment SSH_AUTH_SOCK=some-value. This command dynamically modifies the environment of the running systemd daemon and thus influences the environment for the future units started. Putting this in a socket unit ensures an early run, before most of the applications are started so it’s a good choice. They tend to also explicitly ensure this with a directive like Before=graphical-session-pre.target.

However, in a typical installation you end up with multiple SSH agents (right now I have ssh-agent, gpg-agent, and gcr-ssh-agent), which one is the one that the user ends up using? Well, that is not clearly defined, the one that wins is the one that runs last… because each of them overwrites the value in the systemd environment.

Some of them fight to have that place (cf #1079246 for gcr-ssh-agent) by setting explicit After directives. In the above bug I argue that we should let gpg-agent.socket have the priority since that’s the only one that is not enabled by default and that requires the user to opt-in. However, ultimately there will always be cases where you will want to be explicit about the SSH agent that should win.

You could rely on systemd overrides to add/remove ordering directives but that’s pretty fragile. Instead the right way to deal with this is to “mask” the socket units of the SSH agents that you don’t want. Note that disabling (i.e. systemctl --user disable) either will not work[1] or will not be sufficient[2]. In my case, I wanted to keep gpg-agent.socket so I masked gcr-ssh-agent.socket and ssh-agent.socket:

$ systemctl --user mask ssh-agent.socket gcr-ssh-agent.socket
Created symlink '/home/rhertzog/.config/systemd/user/ssh-agent.socket' → '/dev/null'.
Created symlink '/home/rhertzog/.config/systemd/user/gcr-ssh-agent.socket' → '/dev/null'.

Note that if you want that behaviour to apply to all users of your computer, you can use sudo systemctl --global mask ssh-agent.socket gcr-ssh-agent.socket. Now on next login, you will only get a single ssh agent socket unit that runs and the SSH_AUTH_SOCK value will thus be predictable again!

Hopefully you will find that useful as it’s already the second time that I stumble upon this either for me or for a relative. Next time, I will know where to look it up. 🙂

[1]: If you try to run systemctl --user disable gcr-ssh-agent.socket, you will get a message saying that it will not work because the unit is enabled for all users at the “global” level. You can do it with --global instead of --user but it doesn’t help, cf below.

[2]: Disabling an unit basically means stopping to explicitely schedule its startup as part of a desired target. However, the unit can still be started as a dependency of other units and that’s the case here because a socket unit will typically be pulled in by its corresponding service unit.

]]> https://raphaelhertzog.com/2025/11/10/how-to-choose-your-ssh-agent-with-wayland-and-systemd/feed/ 5 Freexian is looking to expand its team with more Debian contributors https://raphaelhertzog.com/2024/03/29/freexian-is-looking-to-expand-its-team-with-more-debian-contributors/ Fri, 29 Mar 2024 15:13:40 +0000 https://raphaelhertzog.com/?p=4061

It’s been a while that I haven’t posted anything on my blog, the truth is that Freexian has been doing very well in the last years and that I have a hard time to allocate time to write articles or even to contribute to my usual Debian projects… the exception being debusine since that’s part of the Freexian work (have a look at our most recent announce!).

That being said, given Freexian’s growth and in the hope to reduce my workload, we are looking to extend our team with Debian members of more varied backgrounds and skills, so they can help us in areas like sales / marketing / project management. Have a look at our announce on debian-jobs@lists.debian.org.

As a mission-oriented company, we are looking to work with persons already involved in Debian (or persons who were waiting the right opportunity to get involved). All our collaborators can spend 20% of their paid work time on the Debian projects they care about.

]]> Freexian’s report about Debian Long Term Support, July 2022 https://raphaelhertzog.com/2022/08/31/freexians-report-about-debian-long-term-support-july-2022/ Wed, 31 Aug 2022 09:43:50 +0000 https://raphaelhertzog.com/?p=4056
A Debian LTS logo

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

No any major updates on running projects.
Two 1, 2 projects are in the pipeline now.
Tryton project is in a review phase. Gradle projects is still fighting in work.

In July, we put aside 2389 EUR to fund Debian projects.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In July, 14 contributors have been paid to work on Debian LTS, their reports are available:

  • Abhijith PA did 0.00h (out of 14.00h assigned, thus carrying over 14.00h to the next month).
  • Andreas Rönnquist did 0.00h (out of 0.00h assigned and 10.50h from previous period, thus carrying over 10.50h to the next month).
  • Anton Gladky did 23.00h (out of 25.00h assigned, thus carrying over 2.00h to the next month).
  • Ben Hutchings did 3.00h (out of 24.00h assigned, thus carrying over 21.00h to the next month).
  • Dominik George did 0.00h (out of 0.00h assigned and 22.17h from previous period, thus carrying over 22.17h to the next month).
  • Emilio Pozuelo Monfort did 72.00h (out of 35.75h assigned).
  • Enrico Zini did 0.00h (out of 0.00h assigned and 8.00h from previous period, thus carrying over 8.00h to the next month).
  • Markus Koschany did 35.75h (out of 35.75h assigned).
  • Ola Lundqvist did 8.00h (out of 0.00h assigned and 12.00h from previous period, thus carrying over 4.00h to the next month).
  • Roberto C. Sánchez did 14.25h (out of 29.25h assigned and 2.75h from previous period, thus carrying over 17.75h to the next month).
  • Stefano Rivera did 8.00h (out of 6.25h assigned and 20.75h from previous period, thus carrying over 19.00h to the next month).
  • Sylvain Beucler did 3.50h (out of 35.75h assigned, thus carrying over 32.25h to the next month).
  • Thorsten Alteholz did 20.00h (out of 35.75h assigned).
  • Utkarsh Gupta did not report back about their work so we assume they did nothing (out of 35.75 available hours, thus carrying them over to the next month).

Evolution of the situation

In July, we have released 3 DLAs. July was the period, when the Debian Stretch had already ELTS status, but Debian Buster was still in the hands of security team. Many member of LTS used this time to update internal infrastructure, documentation and some internal tickets. Now we are ready to take the next release in our hands: Buster!

Thanks to our sponsors

Sponsors that joined recently are in bold.

]]> Freexian’s report about Debian Long Term Support, June 2022 https://raphaelhertzog.com/2022/07/26/freexians-report-about-debian-long-term-support-june-2022/ Tue, 26 Jul 2022 08:38:30 +0000 https://raphaelhertzog.com/?p=4052
A Debian LTS logo

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

No any major updates on running projects.
Two 1, 2 projects are in the pipeline now.
Tryton project is in a review phase. Gradle projects is still fighting in work.

In June, we put aside 2254 EUR to fund Debian projects.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In June, 15 contributors have been paid to work on Debian LTS, their reports are available:

  • Abhijith PA did 14.00h (out of 14.00h assigned).
  • Andreas Rönnquist did 14.50h (out of 14.50h assigned and 10.50h from previous period, thus carrying over 10.50h to the next month).
  • Anton Gladky did 16.00h (out of 16.00h assigned).
  • Ben Hutchings did 16.00h (out of 0.00h assigned and 16.00h from previous period).
  • Chris Lamb did 18.00h (out of 18.00h assigned).
  • Dominik George did 1.83h (out of 6.00h assigned and 18.00h from previous period, thus carrying over 22.17h to the next month).
  • Emilio Pozuelo Monfort did 30.25h (out of 9.25h assigned and 21.00h from previous period).
  • Enrico Zini did 8.00h (out of 9.50h assigned and 6.50h from previous period, thus carrying over 8.00h to the next month).
  • Markus Koschany did 30.25h (out of 30.25h assigned).
  • Ola Lundqvist did nothing (out of 12.00 available hours, thus carrying them over to the next month).
  • Roberto C. Sánchez did 27.50h (out of 11.75h assigned and 18.50h from previous period, thus carrying over 2.75h to the next month).
  • Stefano Rivera did 8.00h (out of 30.25h assigned, thus carrying over 20.75h to the next month).
  • Sylvain Beucler did 30.25h (out of 13.75h assigned and 16.50h from previous period).
  • Thorsten Alteholz did 30.25h (out of 30.25h assigned).
  • Utkarsh Gupta did not report back about their work so we assume they did nothing (out of 30.25 available hours, thus carrying them over to the next month).

Evolution of the situation

In June we released 27 DLAs.

This is a special month, where we have two releases (stretch and jessie) as ELTS and NO release as LTS. Buster is still handled by the security team and will probably be given in LTS hands at the beginning of the August. During this month we are updating the infrastructure, documentation and improve our internal processes to switch to a new release.
Many developers have just returned back from Debconf22, hold in Prizren, Kosovo! Many (E)LTS members could meet face-to-face and discuss some technical and social topics! Also LTS BoF took place, where the project was introduced (link to video).

Thanks to our sponsors

Sponsors that joined recently are in bold. We are pleased to welcome Alter Way where their support of Debian is publicly acknowledged at the higher level, see this French quote of Alterway’s CEO.

]]> Freexian’s report about Debian Long Term Support, May 2022 https://raphaelhertzog.com/2022/06/23/freexians-report-about-debian-long-term-support-may-2022/ Thu, 23 Jun 2022 12:15:09 +0000 https://raphaelhertzog.com/?p=4046
A Debian LTS logo

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

Two [1, 2] projects are in the pipeline now. Tryton project is in a final phase. Gradle projects is fighting with technical difficulties.

In May, we put aside 2233 EUR to fund Debian projects.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In May, 14 contributors have been paid to work on Debian LTS, their reports are available:

  • Abhijith PA did 14.0h (out of 14h assigned).
  • Andreas Rönnquist did 14.5h (out of 25.0h assigned), thus carrying over 10.5h to June.
  • Anton Gladky did 19h (out of 19h assigned).
  • Ben Hutchings did 8h (out of 11h assigned and 13h from April), thus carrying over 16h to June.
  • Chris Lamb did 18h (out of 18h assigned).
  • Dominik George did 2h (out of 20.0h assigned), thus carrying over 18h to June.
  • Enrico Zini did 9.5h (out of 16.0h assigned), thus carrying over 6.5h to June.
  • Emilio Pozuelo Monfort did 28h (out of 13.75h assigned and 35.25h from April), thus carrying over 21h to June.
  • Markus Koschany did 40h (out of 40h assigned).
  • Roberto C. Sánchez did 13.5h (out of 32h assigned), thus carrying over 18.5h to June.
  • Sylvain Beucler did 23.5h (out of 20h assigned and 20h from April), thus carrying over 16.5h to June.
  • Stefano Rivera did 5h in April and 14h in May (out of 17.5h assigned), thus anticipating 1.5h for June.
  • Thorsten Alteholz did 40h (out of 40h assigned).
  • Utkarsh Gupta did 35h (out of 19h assigned and 30h from April), thus carrying over 14h to June.

Evolution of the situation

In May we released 49 DLAs. The security tracker currently lists 71 packages with a known CVE and the dla-needed.txt file has 65 packages needing an update.

The number of paid contributors increased significantly, we are pleased to welcome our latest team members: Andreas Rönnquist, Dominik George, Enrico Zini and Stefano Rivera.

It is worth pointing out that we are getting close to the end of the LTS period for Debian 9. After June 30th, no new security updates will be made available on security.debian.org. We are preparing to overtake Debian 10 Buster for the next two years and to make this process as smooth as possible.

But Freexian and its team of paid Debian contributors will continue to maintain Debian 9 going forward for the customers of the Extended LTS offer. If you have Debian 9 servers to keep secure, it’s time to subscribe!

You might not have noticed, but Freexian formalized a mission statement where we explain that our purpose is to help improve Debian. For this, we want to fund work time for the Debian developers that recently joined Freexian as collaborators. The Extended LTS and the PHP LTS offers are built following a model that will help us to achieve this if we manage to have enough customers for those offers. So consider subscribing: you help your organization but you also help Debian!

Thanks to our sponsors

Sponsors that joined recently are in bold.

]]> Freexian’s report about Debian Long Term Support, April 2022 https://raphaelhertzog.com/2022/06/03/freexians-report-about-debian-long-term-support-april-2022/ Fri, 03 Jun 2022 16:42:59 +0000 https://raphaelhertzog.com/?p=4041
A Debian LTS logo

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

Two projects are currently in the pipeline: Gradle enterprise and Tryton update. Progress is quite slow on the Gradle one, there are technical difficulties. The tryton one was stalled because the developer had not enough time but seems to progress smoothly in the last weeks.

In April, we put aside 2635 EUR to fund Debian projects.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In April, 11 contributors have been paid to work on Debian LTS, their reports are available:

Evolution of the situation

In April we released 21 DLAs and we were glad to welcome a new customer with Alter Way.

The security tracker currently lists 72 packages with a known CVE and the dla-needed.txt file has 71 packages needing an update.

It is worth pointing out that we are getting close to the end of the LTS period for Debian 9. After June 30th, no new security updates will be made available on security.debian.org.

But Freexian and its team of paid Debian contributors will continue to maintain Debian 9 going forward for the customers of the Extended LTS offer. If you have Debian 9 servers to keep secure, it’s time to subscribe!

You might not have noticed, but Freexian formalized a mission statement where we explain that our purpose is to help improve Debian. For this, we want to fund work time for the Debian developers that recently joined Freexian as collaborators. The Extended LTS and the PHP LTS offers are built following a model that will help us to achieve this if we manage to have enough customers for those offers. So consider subscribing: you help your organization but you also help Debian!

Thanks to our sponsors

Sponsors that joined recently are in bold.

]]> Debian 9 soon out of (free) security support https://raphaelhertzog.com/2022/05/11/debian-9-soon-out-of-free-security-support/ https://raphaelhertzog.com/2022/05/11/debian-9-soon-out-of-free-security-support/#comments Wed, 11 May 2022 13:13:03 +0000 https://raphaelhertzog.com/?p=4035 Organizations that are still running Debian 9 servers should be aware that the security support of the Debian LTS team will end on June 30th 2022.

If upgrading to a newer Debian release is not an option for them, then they should consider subscribing to Freexian’s Extended LTS to get security support for the packages that they are using on their servers.

It’s worth pointing out that we made some important changes to Freexian’s Extended LTS offering :

  • we are now willing to support each Debian release for up to 10 years (so 5 years of ELTS support after the 5 initial years), provided that we have customers willing to pay the required amount.
  • we have changed our pricing scheme so that we can announce up-front the (increasing) cost over the 5 years of ELTS
  • we have dropped the requirement to subscribe to the Debian LTS sponsorship, though it’s still a good idea to contribute to the funding of that project to ensure that one’s packages are properly monitored/maintained during the LTS period

This means that we have again extended the life of Debian 8 Jessie, this time until June 30th 2025. And that Debian 9 Stretch – that will start its “extended” life on July 1st 2022 – can be maintained up to June 30th 2027.

Organizations using Debian 10 should consider sponsoring the Debian LTS team since security support for that Debian release will soon transition from the regular security team to the LTS team.

]]> https://raphaelhertzog.com/2022/05/11/debian-9-soon-out-of-free-security-support/feed/ 2 Freexian’s report about Debian Long Term Support, March 2022 https://raphaelhertzog.com/2022/04/28/freexians-report-about-debian-long-term-support-march-2022/ Thu, 28 Apr 2022 10:47:34 +0000 https://raphaelhertzog.com/?p=4031
A Debian LTS logo

Every month we review the work funded by Freexian’s Debian LTS offering. Please find the report for March below.

Debian project funding

  • There was no new activity in Debian project funding in the two existing projects. However, there was a survey run with hundreds of Debian Developers and Debian contributors. The survey results are being collated and we will use the anonymized data to further develop the Freexian project funding initiative.
  • We are preparing to more broadly announce additional support for Debian 8 Jessie and Debian 9 Stretch. Now, Debian 8 can be supported until June 2025 and Debian 9 until June 2027. More information on ELTS support is available.
  • In March € 2250 was put aside to fund Debian projects.

Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In March, 11 contributors were paid to work on Debian LTS, their reports are available below. If you’re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah or Raphaël if you are if you are interested in participating.

Evolution of the situation

In March we released 42 DLAs.

The security tracker currently lists 81 packages with a known CVE and the dla-needed.txt file has 52 packages needing an update.

We’re glad to welcome a few new sponsors such as Électricité de France (Gold sponsor), Telecats BV and Soliton Systems.

Thanks to our sponsors

Sponsors that joined recently are in bold.

]]> Join Freexian to help improve Debian https://raphaelhertzog.com/2022/03/29/join-freexian-to-help-improve-debian/ Tue, 29 Mar 2022 10:29:15 +0000 https://raphaelhertzog.com/?p=4026 Freexian has set itself new ambitious goals in support of Debian and we would like to expand our team to help us reach those goals. We have drafted a mission statement to clarify our purpose and our values, and we hope to be able to attract talented software developers, entrepreneurs and Debian experts from our community.

Freexian’s mission is to help Debian evolve to be the leading Linux distribution and a model to follow in the free software world.

We want to achieve that by enabling passionate contributors to spend most of their time working on Debian and free software, combining lucrative work in support of enterprise customers, core contributions to Debian’s processes, and personal goals.

Extract from Freexian’s mission statement

If Debian is an important part of your life, if improving Debian is something that you enjoy doing, if you have enough skills and Debian expertise to match some of the roles that we have described on our Join us page, then we would love to hear from you at gerants@freexian.com, so we can figure out a way to work together.

]]> Freexian’s report about Debian Long Term Support, February 2022 https://raphaelhertzog.com/2022/03/17/freexians-report-about-debian-long-term-support-february-2022/ Thu, 17 Mar 2022 11:32:29 +0000 https://raphaelhertzog.com/?p=4021
A Debian LTS logo

Every month we review the work funded by Freexian’s Debian LTS offering. Please find the report for February below.

Debian project funding

  • In February Raphaël and the LTS worked on a survey of Debian developers meant to solicit ideas for improvements in the Debian project at large. You can see the results of the initial discussion here in the list of ideas of which there are already over 30.
  • The full survey is due to be emailed to Debian Developers shortly.
  • In February € 2250 was put aside to fund Debian projects.

Debian LTS contributors

In February, 12 contributors were paid to work on Debian LTS, their reports are available below. If you’re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah or Raphaël if you are if you are interested in participating.

Evolution of the situation

In February we released 24 DLAs.

The security tracker currently lists 61 packages with a known CVE and the dla-needed.txt file has 26 packages needing an update.

You can find out more about the Debian LTS project via the following video:

Thanks to our sponsors

Sponsors that joined recently are in bold.

]]>