GoKawiilEvery ssh-askpass in the Gentoo tree pulls in X11 or a full KDE stack, so I wrote my own with Zig 0.16 and GTK4, with hand-written bindings that keep X out of the build.
I run hardened Gentoo on my laptop, and most of the time I never touch ssh-askpass because I’m using -sk keys for most of the systems. There is one class of situation where I do need it, though, which is when a program wants an SSH key passphrase for a regular ED25519 key, but has no terminal to read it from. The usual case is go get , or the go toolchain in general, fetching a private module over SSH during a build that runs without a TTY. OpenSSH can’t prompt on a pipe, so it runs whatever SSH_ASKPASS points at and puts the passphrase prompt in a window instead. For years I had nothing installed for that and had to work around these scenarios. The main reason for that is what Gentoo’s Portage offers:
~ emerge -s ssh-askpass [ Results for search key : ssh-askpass ] Searching... * kde-plasma/ksshaskpass Latest version available: 6.6.6 Latest version installed: [ Not Installed ] Size of files: 32 KiB Homepage: https://kde.org/plasma-desktop https://invent.kde.org/plasma/ksshaskpass Description: Implementation of ssh-askpass with KDE Wallet integration License: GPL-2 * lxqt-base/lxqt-openssh-askpass Latest version available: 2.4.0 Latest version installed: [ Not Installed ] Size of files: 19 KiB Homepage: https://lxqt-project.org/ https://github.com/lxqt/lxqt-openssh-askpass/ Description: LXQt OpenSSH user password prompt tool License: LGPL-2.1 LGPL-2.1+ * net-misc/gnome-ssh-askpass Latest version available: 10.0_p1 Latest version installed: [ Not Installed ] Size of files: 1,927 KiB Homepage: https://www.openssh.com/ Description: GTK-based passphrase dialog for use with OpenSSH License: BSD GPL-2 * net-misc/ssh-askpass-fullscreen Latest version available: 1.2 Latest version installed: [ Not Installed ] Size of files: 81 KiB Homepage: https://github.com/atj/ssh-askpass-fullscreen Description: A small SSH Askpass replacement written with GTK2 License: GPL-2+ * net-misc/x11-ssh-askpass Latest version available: 1.2.4.1-r2 Latest version installed: [ Not Installed ] Size of files: 30 KiB Homepage: https://github.com/sigmavirus24/x11-ssh-askpass Description: X11-based passphrase dialog for use with OpenSSH License: HPND [ Applications found : 5 ]
Each of these has at least one inconvenience I didn’t feel like putting up with. My system runs with the global -X USE flag, so anything that needs X11 is out before I look any further. Of the five, kde-plasma/ksshaskpass is the only one with no X11 dependency whatsoever, which should have made it the obvious pick, but the trouble is everything else that comes with it. As a Sway user, I did not want a full KDE stack on the machine just to type the occasional passphrase, and that is what a ksshaskpass install pulls in:
~ # emerge -a kde-plasma/ksshaskpass These are the packages that would be merged, in order: Calculating dependencies... done ! Dependency resolution took 1.18 s ( backtrack: 0/20 ) . [ ebuild N ] kde-frameworks/kf-env-6 [ ebuild N ] dev-libs/plasma-wayland-protocols-1.21.0 USE = "-test" [ ebuild N ] dev-libs/qtkeychain-0.16.0 USE = "-keyring -test" [ ebuild N ] kde-frameworks/ksecretd-services-6.27.0 USE = "(-systemd)" [ ebuild N ] kde-frameworks/breeze-icons-6.27.0 USE = "-test" [ ebuild N ] kde-frameworks/ki18n-6.27.0 USE = "-debug -test" PYTHON_SINGLE_TARGET = "python3_14 -python3_12 -python3_13" [ ebuild N ] kde-frameworks/kconfig-6.27.0 USE = "dbus -debug -qml -test" [ ebuild N ] kde-frameworks/kcoreaddons-6.27.0 USE = "dbus -debug -test" [ ebuild N ] kde-frameworks/kwidgetsaddons-6.27.0 USE = "-debug -designer -test" [ ebuild N ] kde-frameworks/kdbusaddons-6.27.0 USE = "-X -debug -test" [ ebuild N ] kde-frameworks/kwindowsystem-6.27.0 USE = "wayland -X -debug -test" [ ebuild N ] app-crypt/qca-2.3.10-r1 USE = "ssl -botan -debug -doc -examples -gcrypt -gpg -logger -nss -pkcs11 -sasl -softstore -test" [ ebuild N ] kde-frameworks/karchive-6.27.0 USE = "crypt zstd -debug -test" [ ebuild N ] kde-frameworks/kguiaddons-6.27.0 USE = "dbus wayland -X -debug -test" [ ebuild N ] kde-frameworks/kdoctools-6.27.0 USE = "nls -debug -test" [ ebuild N ] kde-frameworks/kcolorscheme-6.27.0 USE = "-debug" [ ebuild N ] kde-frameworks/kcrash-6.27.0 USE = "-X -debug -test" [ ebuild N ] kde-frameworks/knotifications-6.27.0 USE = "-debug" [ ebuild N ] kde-frameworks/kservice-6.27.0 USE = "man -debug -test" [ ebuild N ] kde-frameworks/kwallet-6.27.0 USE = "-debug -minimal -test" [ ebuild N ] kde-frameworks/kwallet-runtime-6.27.0 USE = "(keyring) (legacy-kwallet) man -X -debug -gpg -test" [ ebuild N ] kde-plasma/ksshaskpass-6.6.6 USE = "-debug" Would you like to merge these packages? [ Yes/No ]
lxqt-base/lxqt-openssh-askpass is next, and it needs X outright. On top of that it pulls in a few KDE framework packages and a Qt built with X support, which collides with the dev-qt/qtbase already on my system that was compiled -X , so Portage stops on a slot conflict:
~ # emerge -a lxqt-base/lxqt-openssh-askpass These are the packages that would be merged, in order: Calculating dependencies... done! Dependency resolution took 3.10 s (backtrack: 0/20). [ebuild R ] x11-libs/libxkbcommon-1.13.2 USE="X*" [ebuild N ] dev-util/lxqt-build-tools-2.4.0 [ebuild N ] x11-libs/xcb-util-renderutil-0.3.10 ABI_X86="(64) -32 (-x32)" [ebuild N ] x11-libs/libXScrnSaver-1.2.5 USE="-doc" ABI_X86="(64) -32 (-x32)" [ebuild N ] dev-libs/plasma-wayland-protocols-1.21.0 USE="-test" [ebuild N ] x11-libs/xcb-util-wm-0.4.2 ABI_X86="(64) -32 (-x32)" [ebuild N ] x11-libs/xcb-util-0.4.1 ABI_X86="(64) -32 (-x32)" [ebuild N ] x11-libs/xcb-util-image-0.4.1 ABI_X86="(64) -32 (-x32)" [ebuild N ] x11-libs/xcb-util-cursor-0.1.6 ABI_X86="(64) -32 (-x32)" [ebuild R ] dev-qt/qtbase-6.11.1 USE="X*" [ebuild N ] sys-auth/polkit-qt-0.201.1 [ebuild N ] dev-libs/libqtxdg-4.4.0 USE="-test" [ebuild N ] kde-frameworks/kf-env-6 [ebuild N ] kde-frameworks/kwindowsystem-6.27.0 USE="X wayland -debug -test" [ebuild N ] lxqt-base/liblxqt-2.4.0 USE="backlight" [ebuild N ] lxqt-base/lxqt-openssh-askpass-2.4.0 !!! Multiple package instances within a single package slot have been pulled !!! into the dependency graph, resulting in a slot conflict: dev-qt/qtbase:6 (dev-qt/qtbase-6.11.1:6/6.11.1::gentoo, installed) USE="concurrent dbus gui icu libinput libproxy network nls opengl sql sqlite ssl syslog udev vulkan wayland widgets xml (zstd) -X -accessibility -brotli -cups -custom-cflags -eglfs -evdev -gles2-only -gssapi -gtk -io-uring (-journald) -mysql -oci8 -odbc -postgres -renderdoc -sctp -test -tslib" ABI_X86="(64)" pulled in by ~dev-qt/qtbase-6.11.1:6[X=,concurrent,eglfs=] required by (dev-qt/qtmultimedia-6.11.1:6/6.11.1::gentoo, installed) USE="alsa dbus ffmpeg gstreamer opengl pipewire qml v4l vaapi vulkan wayland -X -custom-cflags -eglfs -pulseaudio -test" ABI_X86="(64)" ^^ (dev-qt/qtbase-6.11.1:6/6.11.1::gentoo, ebuild scheduled for merge) USE="X concurrent dbus gui icu libinput libproxy network nls opengl sql sqlite ssl syslog udev vulkan wayland widgets xml (zstd) -accessibility -brotli -cups -custom-cflags -eglfs -evdev -gles2-only -gssapi -gtk -io-uring (-journald) -mysql -oci8 -odbc -postgres -renderdoc -sctp -test -tslib" ABI_X86="(64)" pulled in by >=dev-qt/qtbase-6.10.1:6=[gui,X] required by (kde-frameworks/kwindowsystem-6.27.0:6/6.27::gentoo, ebuild scheduled for merge) USE="X wayland -debug -test" ABI_X86="(64)" ^ It may be possible to solve this problem by using package.mask to prevent one of those packages from being selected. However, it is also possible that conflicting dependencies exist such that they are impossible to satisfy simultaneously. If such a conflict exists in the dependencies of two different packages, then those packages can not be installed simultaneously. For more information, see MASKED PACKAGES section in the emerge man page or refer to the Gentoo Handbook. The following USE changes are necessary to proceed: (see "package.use" in the portage(5) man page for more details) # required by lxqt-base/liblxqt-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass (argument) >=kde-frameworks/kwindowsystem-6.27.0 X # required by kde-frameworks/kwindowsystem-6.27.0::gentoo[X] # required by lxqt-base/liblxqt-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass (argument) >=dev-qt/qtbase-6.11.1 X # required by dev-qt/qtbase-6.11.1::gentoo[gui] # required by kde-frameworks/kwindowsystem-6.27.0::gentoo[X] # required by lxqt-base/liblxqt-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass-2.4.0::gentoo # required by lxqt-base/lxqt-openssh-askpass (argument) >=x11-libs/libxkbcommon-1.13.2 X Would you like to add these changes to your config files? [Yes/No]
net-misc/ssh-askpass-fullscreen needs X as well, this time by way of GTK2 and a Cairo built with X support:
~ # emerge -a net-misc/ssh-askpass-fullscreen These are the packages that would be merged, in order: Calculating dependencies... done ! Dependency resolution took 2.98 s ( backtrack: 0/20 ) . [ ebuild R ] x11-libs/cairo-1.18.4-r1 USE = "X*" [ ebuild N ] x11-libs/libXcomposite-0.4.7 USE = "-doc" ABI_X86 = "(64) -32 (-x32)" [ ebuild N ] x11-libs/libXcursor-1.2.3 USE = "-doc" ABI_X86 = "(64) -32 (-x32)" [ ebuild N ] x11-libs/libXdamage-1.1.7 ABI_X86 = "(64) -32 (-x32)" [ ebuild N ] x11-libs/libXi-1.8.3 USE = "-doc" ABI_X86 = "(64) -32 (-x32)" [ ebuild N ] x11-themes/gnome-themes-standard-3.28-r1 [ ebuild NS ] x11-libs/gtk+-2.24.33-r3 [ 3.24.52 ] [ ebuild N ] x11-themes/gtk-engines-adwaita-3.28-r1 ABI_X86 = "(64) -32 (-x32)" [ ebuild N ] net-misc/ssh-askpass-fullscreen-1.2 The following USE changes are necessary to proceed: ( see "package.use" in the portage ( 5 ) man page for more details ) # required by x11-libs/gtk+-2.24.33-r3::gentoo # required by x11-themes/gtk-engines-adwaita-3.28-r1::gentoo > = x11-libs/cairo-1.18.4-r1 X Would you like to add these changes to your config files? [ Yes/No ]
net-misc/x11-ssh-askpass is X11 by name, so no surprise there, and it also needs the old imake build system, namely x11-misc/xorg-cf-files and x11-misc/imake , to compile at all:
... continue reading