[BUG] The default read-only mounting mode is too strict; even chained files cannot be created.
Open 💬 1 comment Opened Aug 5, 2026 by LIghtJUNction
During the review process, the git show --show-signature command was executed, which utilized GnuPG. However, the sandbox configured ~/.gnupg as read-only.
GnuPG 2.4’s keyboxd requires the creation of lock files, resulting in an error:
Read-only file system
Unable to connect to the KeyBoxd service.
No Keybox daemon is running.
Unable to verify signature: No public key available.
The last line of text can be misleading. It actually indicates that “the public key database cannot be opened”, rather than saying that “there are no public keys on the machine”.
1 Comment
I implemented a candidate fix for this issue in my fork:
--tmp-overlayfor~/.gnupg, allowing GnuPG keyboxd to create lock state without writing to the host.4c9440e8dMy account cannot create the upstream PR because it has read-only permissions on
openai/codex. Please review the fork PR or cherry-pick the commit.just fmtand a manual bwrap/GPG probe passed; scoped Rust tests were blocked before compilation by anaws-configcrates.io download timeout.