Dosu Logo
Ask
Documentsbluefin
SSH Authentication Configuration
SSH Authentication Configuration
Type
Topic
Status
Published
Created
Jun 16, 2026
Updated
Jun 16, 2026

SSH Authentication Configuration#

Bluefin previously shipped a system-wide SSH askpass configuration that set SUDO_ASKPASS (and by extension SSH_ASKPASS) to /usr/libexec/openssh/gnome-ssh-askpass via a profile.d script. This binary does not exist on Bluefin systems, causing fatal: cannot exec '/usr/libexec/openssh/gnome-ssh-askpass': No such file or directory errors on every Git or SSH operation that triggered a credential prompt .

The configuration was removed in projectbluefin/common#118 (merged January 4, 2026) .

What Was Removed#

A single profile.d script — system_files/bluefin/etc/profile.d/askpass.sh — was deleted :

#!/usr/bin/bash
SUDO_ASKPASS='/usr/libexec/openssh/gnome-ssh-askpass'
export SUDO_ASKPASS

This script ran in every login shell and unconditionally exported SUDO_ASKPASS to a non-existent path. Because SSH_ASKPASS follows SUDO_ASKPASS in many contexts, it poisoned both variables for all interactive sessions.

Why It Broke Tooling#

VariableEffect when set to missing binary
SUDO_ASKPASSsudo -A fails; error emitted to stderr
SSH_ASKPASSSSH/Git prompts fail instead of falling back to terminal

VS Code's Git integration and dev container tooling both rely on being able to fork SSH or Git processes that prompt for credentials. With SSH_ASKPASS pointing to a missing binary, VS Code silently failed on any operation requiring a passphrase or remote credential — and error output appeared in the terminal rather than VS Code's credential UI .

The systemctl --user show-environment command surfaced the bad variables:

SSH_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass
SUDO_ASKPASS=/usr/libexec/openssh/gnome-ssh-askpass

Current Behavior (Post-Fix)#

Neither SSH_ASKPASS nor SUDO_ASKPASS are set by the system. The rationale from the fix: "This should be done by the user if they want SSH_ASKPASS instead of Bluefin defining it."

This means:

  • Git and SSH operations prompt in the terminal by default (correct behavior for a desktop OS).
  • VS Code's own credential helper (git-credential-libsecret, which is installed as part of the base image) handles secure storage without interference (see base package list).
  • Users who want graphical SSH prompts can set SSH_ASKPASS themselves in ~/.config/environment.d/.

Workaround (If Still Affected)#

If you're on an older image or still see the bad variables in your environment, add to your shell config:

unset SSH_ASKPASS SUDO_ASKPASS

Or set them in ~/.config/environment.d/askpass.conf (systemd user environment) to the correct path for your preferred askpass helper.

  • Upstream issue: ublue-os/bluefin#3975 — original bug report
  • Fix PR: projectbluefin/common#118
  • Git credential storage: git-credential-libsecret is included in the base image for secure GNOME keyring integration
  • VS Code password store: For VS Code GitHub auth, configure code --password-store="gnome-libsecret" if credential prompts are missing