Control: tags 841909 + moreinfo Hi Craig-- On Mon 2016-10-24 07:13:25 -0400, Craig Small wrote: > Since the latest upgrade, I am unable to sign anything using a ssh > shell. > > $ gpg --sign gpg.txt > File 'gpg.txt.gpg' exists. Overwrite? (y/N) y > gpg: signing failed: Configuration error > gpg: signing failed: Configuration error > > There is a work-around > ssh to the remote system > killall gpg-agent > unset DBUS_SESSION_BUS_ADDRESS > gpg will now work. > > I am unsure why this environment variable causes the problem. It has > something to do with the gpg-agent not gpg itself. > > I tried it with two ssh sessions, one running gpg and one running gpg > agent. If the agent had that variable unset, it worked even if the > window running gpg itself had it set. The other way around it failed > meaning gpg-agent and not gpg itself has the problem with the > environment. > > This is gpg-agent with the environment vatiable set. > > gpg-agent --verbose --homedir /home/csmall/.gnupg --use-standard-socket > --daemon /bin/bash > gpg-agent[28745]: WARNING: "--use-standard-socket" is an obsolete option - it > has no effect > gpg-agent[28745]: listening on socket '/run/user/1000/gnupg/S.gpg-agent' > gpg-agent[28745]: listening on socket '/run/user/1000/gnupg/S.gpg-agent.rstrd' > gpg-agent[28745]: listening on socket '/run/user/1000/gnupg/S.gpg-agent.brwsr' > gpg-agent[28745]: listening on socket '/run/user/1000/gnupg/S.gpg-agent.ssh' > gpg-agent[28746]: gpg-agent (GnuPG) 2.1.15 started > $ gpg-agent[28746]: handler 0x7f347273d700 for fd 8 started > gpg-agent[28746]: starting a new PIN Entry > gpg-agent[28746]: failed to unprotect the secret key: Configuration error > gpg-agent[28746]: failed to read the secret key > gpg-agent[28746]: command 'PKSIGN' failed: Configuration error <Pinentry> > gpg-agent[28746]: handler 0x7f347273d700 for fd 8 terminated > gpg-agent[28746]: handler 0x7f3471f3c700 for fd 9 started > gpg-agent[28746]: handler 0x7f3471f3c700 for fd 9 terminated
It sounds to me like what you're seeing is pinentry-gnome3, which knows
to fall back to curses if DBUS_SESSION_BUS_ADDRESS is unset, but which
fails when run with an active DBUS session but no way to prompt the
user.
I'd like to confirm this, though: what version(s) of pinentry do you
have installed on the system in question? what is the default pinentry?
dpkg -l 'pinentry-*'
readlink -f $(which pinentry)
additionally, you could try adding debug-pinentry to the gpg-agent
config, to see if there's any additional information provided.
If my guess is correct and you're using pinentry-gnome3 but the system
doesn't have gcr running or available, you might try the attached patch
to pinentry-gnome3. i proposed the it to upstream but there's been some
pushback. If you could confirm that it works for you in this context
that'd be good to know.
Alternately, try specifying pinentry-curses as your preferred pinentry
on the remote machine, either via pinentry-program (in gpg-agent.conf)
or via "update-alternatives --config pinentry", or by just purging all
the graphical pinentries and leaving only pinentry-curses (if your
machine never has a graphical environment available).
let me know what you find!
--dkg
From: Daniel Kahn Gillmor <[email protected]> Date: Fri, 9 Sep 2016 10:18:25 +0200 Subject: pinentry-gnome3: fall back to curses if gcr prompt creation fails * gnome3/pinentry-gnome3.c (create_prompt): if gcr_prompt_prompt_open fails, fall back to using curses for this phase. (gnome3_cmd_handler): pass through responses from curses, if used. In some cases, the user is running in a session that has an active D-Bus session, but that session is not attached to a graphical desktop environment (e.g. sshing into a machine whose login stack initializes a D-Bus session). In that case, gcr can be reached over dbus, but it will complain that it does not know how to prompt the user. In this case, pinentry-gnome3 should fall back to curses for prompting the user. Signed-off-by: Daniel Kahn Gillmor <[email protected]> --- gnome3/pinentry-gnome3.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/gnome3/pinentry-gnome3.c b/gnome3/pinentry-gnome3.c index d6d7d16..703aa3b 100644 --- a/gnome3/pinentry-gnome3.c +++ b/gnome3/pinentry-gnome3.c @@ -69,12 +69,20 @@ pinentry_utf8_validate (gchar *text) return result; } +struct curses_ret +{ + int curses_used; + int curses_returned; +}; + static GcrPrompt * -create_prompt (pinentry_t pe, int confirm) +create_prompt (pinentry_t pe, int confirm, struct curses_ret *c) { GcrPrompt *prompt; GError *error = NULL; char *msg; + if (c) + c->curses_used = 0; /* Create the prompt. */ prompt = GCR_PROMPT (gcr_system_prompt_open (-1, NULL, &error)); @@ -86,6 +94,10 @@ create_prompt (pinentry_t pe, int confirm) pe->specific_err_info = strdup (error->message); pe->specific_err = gpg_error (GPG_ERR_CONFIGURATION); g_error_free (error); + if (c) { + c->curses_used = 1; + c->curses_returned = curses_cmd_handler (pe); + } return NULL; } @@ -172,16 +184,20 @@ gnome3_cmd_handler (pinentry_t pe) GcrPrompt *prompt = NULL; GError *error = NULL; int ret = -1; + struct curses_ret c; + c.curses_used = 0; if (pe->pin) /* Passphrase mode. */ { const char *password; - prompt = create_prompt (pe, 0); + prompt = create_prompt (pe, 0, &c); if (! prompt) /* Something went wrong. */ { + if (c.curses_used) + return c.curses_returned; pe->canceled = 1; return -1; } @@ -221,10 +237,12 @@ gnome3_cmd_handler (pinentry_t pe) { GcrPromptReply reply; - prompt = create_prompt (pe, 1); + prompt = create_prompt (pe, 1, &c); if (! prompt) /* Something went wrong. */ { + if (c.curses_used) + return c.curses_returned; pe->canceled = 1; return -1; }
signature.asc
Description: PGP signature
