Installer blocks on bundled GnuPG keyboxd.exe during upgrade

[TCOTC]

Existing issues matching what you're seeing

• I searched for open or closed issues matching this problem.

The closest existing reports are:

• Terminal can't be closed when bundled gpg invokes #5968 (bundled gpg starts keyboxd.exe, which remains attached to the console)
• error writing public keyring '[keyboxd]' #5105 (keyboxd keybox database lock/timeout)
• install.iss: when silent, do not prompt for process closure build-extra#517 (installer process-closure handling in silent mode)
• [IMPROVEMENT] Improve Git upgrade failure handling when Git processes are running Devolutions/UniGetUI#5031 (Git upgrade fails because of running Git processes)

None of them specifically covers the Git for Windows installer being blocked by the bundled GnuPG keyboxd.exe process. Since git-for-windows/build-extra has issues disabled, I am reporting this here.

Git for Windows version

The issue was observed while upgrading from 2.55.0.windows.3 to 2.55.0.windows.5.

$ git --version --build-options
git version 2.55.0.windows.5
cpu: x86_64
built from commit: 32c4f7689275d233577576630e1ac5b7eb354eb0
sizeof-long: 4
sizeof-size_t: 8
shell-path: D:/git-sdk-64-build-installers/usr/bin/sh
rust: disabled
feature: fsmonitor--daemon
gettext: enabled
libcurl: 8.21.0
OpenSSL: OpenSSL 3.5.7 9 Jun 2026
zlib: 1.3.2
SHA-1: SHA1_DC
SHA-256: SHA256_BLK
default-ref-format: files
default-hash: sha1

Windows version

• Windows 11
• x86_64 (64-bit)

Additional Windows version information

> cmd.exe /c ver
Microsoft Windows [Version 10.0.26200.9457]

Options set during installation

Editor Option: VisualStudioCode
Custom Editor Path:
Default Branch Option: main
Path Option: Cmd
SSH Option: OpenSSH
Tortoise Option: false
CURL Option: OpenSSL
CRLF Option: CRLFAlways
Bash Terminal Option: MinTTY
Git Pull Behavior Option: Merge
Use Credential Manager: Enabled
Performance Tweaks FSCache: Enabled
Enable Symlinks: Enabled
Enable FSMonitor: Disabled

Other interesting things

The installer blocks on the bundled GnuPG keyboxd.exe process:

Git 2.55.0.5 Setup

The following process(es) use Git for Windows:

  keyboxd.exe (PID ...)

Please terminate those processes and retry.
Alternatively, cancel to abandon setup altogether.

Local details:

• Bundled GnuPG: gpg (GnuPG) 2.4.9

• %USERPROFILE%\.gnupg\common.conf contains:

  use-keyboxd
  

• keyboxd.exe is running from the Git for Windows installation:

  C:\Program Files\Git\usr\lib\gnupg\keyboxd.exe --homedir /cygdrive/c/Users/<user>/.gnupg --daemon
  

• The global Git configuration does not enable commit or tag signing. This means keyboxd is not necessarily started by git commit -S; it can be started by any GPG operation and then remain resident.

The installer was started with silent options, but the process-closure prompt was still displayed:

Start-Process `
  -FilePath 'Git-2.55.0.5-64-bit.exe' `
  -ArgumentList '/VERYSILENT','/NORESTART','/DIR=C:\Program Files\Git','/LOG=C:\Temp\git-install.log' `
  -Wait `
  -PassThru

Terminating only keyboxd.exe and retrying allowed the same upgrade to complete successfully with exit code 0.

Terminal/shell

PowerShell (Windows PowerShell 5.1); the installer was started directly, and the same problem is expected with other silent/automation paths.

Commands that trigger the issue

# Ensure that the Git-bundled GnuPG daemon is running.
& 'C:\Program Files\Git\usr\bin\gpgconf.exe' --launch keyboxd

Get-CimInstance Win32_Process -Filter "Name='keyboxd.exe'" |
  Select-Object ProcessId, ExecutablePath, CommandLine

# Then run the Git for Windows 2.55.0.windows.5 installer.
# In my case, the installer blocked and displayed the process-closure prompt.

Expected behaviour

The Git for Windows installer should handle its bundled GnuPG daemons safely before replacing files.

Possible approaches:

• Detect and terminate Git-bundled GnuPG helper processes such as keyboxd.exe, gpg-agent.exe, and dirmngr.exe before file replacement.
• Or explicitly document that these daemons must be stopped before upgrading and provide a supported automation switch.
• At minimum, silent installs should fail with a clear, actionable error instead of blocking on a dialog or defaulting to cancel through /SUPPRESSMSGBOXES.

This is similar in nature to the existing request to stop ssh-agent.exe during upgrades:

• Feature request: silently stops ssh-agent.exe when upgrading #4172

Actual behaviour

• The installer detects keyboxd.exe as a process using Git for Windows.
• It blocks and asks the user to terminate the process manually.
• /VERYSILENT did not suppress the process-closure prompt in my reproduction.
• Killing keyboxd.exe and retrying the installer made the upgrade succeed.

Repository

N/A