The 2.4 series of GnuPG introduces keyboxd, but doesn't force migration
to it for existing users.

For new users, however, running without an explicitly set $GNUPGHOME,
/usr/bin/gpg creates ~/.gnupg and populates it with a single file,
common.conf, which contains a single line:

    use-keyboxd

This means that while an existing user of gpg can upgrade to gpg 2.4.x
and see things mostly work, a new user who has avoided installing the
keyboxd package (e.g, by installing "gpg" but not "gnupg") will see the
following kind of misbehavior:


```
0 dkg@bob:~$ gpg --import < /usr/share/keyrings/debian-archive-keyring.gpg
gpg: directory '/home/dkg/.gnupg' created
gpg: error running '/usr/lib/gnupg/keyboxd': probably not installed
gpg: failed to start keyboxd '/usr/lib/gnupg/keyboxd': Configuration error
gpg: can't connect to the keyboxd: Configuration error
gpg: error opening key DB: No Keybox daemon running
gpg: error running '/usr/lib/gnupg/keyboxd': probably not installed
gpg: failed to start keyboxd '/usr/lib/gnupg/keyboxd': Configuration error
gpg: can't connect to the keyboxd: Configuration error
gpg: error opening key DB: No Keybox daemon running
gpg: key DCC9EFBF77E11517: 2 signatures not checked due to missing keys
gpg: error running '/usr/lib/gnupg/keyboxd': probably not installed
gpg: failed to start keyboxd '/usr/lib/gnupg/keyboxd': Configuration error
gpg: can't connect to the keyboxd: Configuration error
gpg: error opening key DB: No Keybox daemon running
gpg: key DCC9EFBF77E11517: public key not found: Input/output error
gpg: error reading '[stdin]': Input/output error
gpg: import from '[stdin]' failed: Input/output error
gpg: Total number processed: 0
2 dkg@bob:~$
```

I'm not sure what the right solution is here; perhaps the simplest thing
would be to just ship the keyboxd binary (and socket activation, etc)
directly in the gpg package, and have that package Provides: keyboxd.

[...]

Hello,

Andreas Klode gave us a heads-up about this in https://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/2024-March/009235.html
| after a report of gnupg 2.4 breaking some tooling in Ubuntu[1], we
| analysed it and found out that if `use-keyboxd` is set, gpg just
| silently ignores any keyring arguments, as it only takes public
| keys stored in keyboxd.
|
| On new installs, aka. if ~/.gnupg does not exist, gnupg automatically
| enables keyboxd by writing `use-keyboxd` to common.conf.
|
| I just patched Ubuntu's GnuPG to not do that, I think this may be
| the right call for Debian as well.
https://git.launchpad.net/ubuntu/+source/gnupg2/tree/debian/patches/no-keyboxd.patch?h=ubuntu/plucky-devel

This was/is for 2.4.4, 2.4.7 does not ignore keyring arguments
*silently*:
(sid)ametzler@argenau:/tmp/GNUPG2$ gpg --keyring /tmp/GNUPG2/blah.gpg --verify
gnupg2_2.4.7.orig.tar.bz2.asc
gpg: Note: Specified keyrings are ignored due to option "use-keyboxd"
[...]

How important/important is the usecase of --keyring without --homedir
and without a custom gpg configuration in ~/.gnupg?

If there is no strong reason to divert from upstream keyboxd preference
we shoud follow it. And if we do your proposal sounds good.

cu Andreas

We believe that the bug you reported is fixed in the latest version of
gnupg2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1095451@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Daniel Kahn Gillmor <dkg@fifthhorseman.net> (supplier of updated gnupg2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 08 Feb 2025 01:26:40 -0500
Source: gnupg2
Architecture: source
Version: 2.4.7-4
Distribution: experimental
Urgency: medium
Maintainer: Debian GnuPG Maintainers <pkg-gnupg-maint@lists.alioth.debian.org>
Changed-By: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Closes: 1095451
Changes:
 gnupg2 (2.4.7-4) experimental; urgency=medium
 .
   [ Daniel Kahn Gillmor ]
   * Note relationship between tpm2daemon and gpg-agent
   * patch 21: use git format-patch style attribution
   * keyboxd.socket: drop FileDescriptorName, not needed
   * override lintian tag spare-manual-page on keyboxd.1
   * drop GSM_SKIP_SSH_AGENT_WORKAROND hack
 .
   [ Andreas Metzler ]
   * block-ptrace-on-secret-daemons accepted into FreePG, rename.
   * Tag patch as forwarded
 .
   [ Daniel Kahn Gillmor ]
   * move keyboxd into the gpg package (Closes: #1095451)
   * Emit only OpenPGP artifacts by default
   * Modernize reasoning for KOO as default keyserver
   * consolidate ssh-agent emulation socket changes in snyc with FreePG proposal
   * Disallow compressed signatures and certificates: point to FreePG proposal
Checksums-Sha1:
 1956b1c0237ee2cdcd4caa5ddb9ba80be8c4dd0b 3377 gnupg2_2.4.7-4.dsc
 e7fe50c4a99883d597004836f6098fcb11753c8e 89824 gnupg2_2.4.7-4.debian.tar.xz
 176c4ba0fb274236ea533b7876791a3906850c62 21419 gnupg2_2.4.7-4_amd64.buildinfo
Checksums-Sha256:
 bce221d9cdc01854cc7d13ec6ba1a712f20c3d44c4d2aebbac6e42a42ebadbec 3377 gnupg2_2.4.7-4.dsc
 6c30c48634bd984b6487322bcdc10446618d1bacb36a7016b96ba874d4734fbf 89824 gnupg2_2.4.7-4.debian.tar.xz
 c96cc27234ef60c99df0a54fc25cf318636b7afa726880d3c07b01e983c6dd06 21419 gnupg2_2.4.7-4_amd64.buildinfo
Files:
 38bc1c8abbed9d63404dc91ca48489de 3377 utils optional gnupg2_2.4.7-4.dsc
 c222b6fd97a6772d01dfedd9e581f7c2 89824 utils optional gnupg2_2.4.7-4.debian.tar.xz
 89a9cdade52c98fd034905d9dbadf862 21419 utils optional gnupg2_2.4.7-4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRjrBGOWy5dZsiKhad4C4VO2cK0lgUCZ6cHjgAKCRB4C4VO2cK0
lrkEAQCz8Yp8pU50ClEFafnQpEQfT8lM2zv8T8tDvxMQV4LOjgEAjwWMTvFeiUBm
5YPX4seQOh4K5VtFB2VkdiQNliH1RwI=
=2lrM
-----END PGP SIGNATURE-----

Control: clone 1095451 -1
Control: retitle -1 With use-keyboxd, gpg ignores all --keyring arguments
Control: reopen -1
Control: found -1 2.4.7-4
Control: forwarded -1 https://dev.gnupg.org/T7265

Thanks for pointing to this previous discussion, Andreas.  I don't think
the underlying issue here is whether the user gets opted into keyboxd by
default or not -- though that certainly aggravates the situation, and
maybe we should adopt JAK's suggestion as a mitigation.

It looks to me like the underlying issue is that gpg 2.4.x will behave
differently for those who use keyboxd than for those who don't,
regardless of who has opted in.

So, for example, a tool that uses --keyring=XXX will behave one way for
a user with use-keyboxd set, and another way entirely (albeit with one
extra line of warning on stderr for 2.4.7+) for a user without
use-keyboxd set.

I've reopened the upstream ticket and i'm pointing to it here, because
this seems like a situation that will give rise to very obscure bugs.

Perhaps we need to offer a patch to GnuPG that:

 - warns about the use of --keyring everywhere, and

 - fails hard (including messages to the status-fd) if --keyring is used
   in conjunction with keyboxd

What do you think?

Sadly, upstream has merely closed the bug report at
https://dev.gnupg.org/T7265 without actually fixing anything.