#577737 gpg command won't use agent if the agent is configured to use pinentry-qt4

Package:
pinentry-qt4
Source:
pinentry
Submitter:
"Boyd Stephen Smith Jr."
Date:
2019-11-15 14:33:03 UTC
Severity:
important
#577737#5
Date:
2010-04-14 02:44:29 UTC
From:
To:
*** Please type your report below this line ***

After installing pinentry-qt4 package, and removing the other pinentry
packages, making sure my alternatives were correct, and editing my
.gnupg/gpg-agent.conf file, I am unable to sign email in KMail, edit encrypted
files using vim, or simply sign a file using the gpg command.

bss@monster:~% aptitude search pinentry
v   pinentry                        -
p   pinentry-curses                 - curses-based PIN or pass-phrase entry dial
i A pinentry-doc                    - documentation for pinentry packages
p   pinentry-gtk                    - GTK+-based PIN or pass-phrase entry dialog
p   pinentry-gtk2                   - GTK+-2-based PIN or pass-phrase entry dial
p   pinentry-qt                     - Qt-3-based PIN or pass-phrase entry dialog
i   pinentry-qt4                    - Qt-4-based PIN or pass-phrase entry dialog
v   pinentry-x11                    -
bss@monster:~% grep pin .gnupg/gpg-agent.conf
pinentry-program /usr/bin/pinentry-qt4
bss@monster:~% ls -l /usr/bin/pine*
lrwxrwxrwx 1 root root     26 2010-04-09 14:00 /usr/bin/pinentry ->
/etc/alternatives/pinentry
-rwxr-xr-x 1 root root 153360 2010-03-18 17:30 /usr/bin/pinentry-qt4
lrwxrwxrwx 1 root root     30 2010-04-09 14:00 /usr/bin/pinentry-x11 ->
/etc/alternatives/pinentry-x11
bss@monster:~% ls -l /etc/alternatives/pine*
lrwxrwxrwx 1 root root 21 2010-04-09 14:00 /etc/alternatives/pinentry ->
/usr/bin/pinentry-qt4
lrwxrwxrwx 1 root root 37 2010-04-09 14:00 /etc/alternatives/pinentry.1.gz ->
/usr/share/man/man1/pinentry-qt4.1.gz
lrwxrwxrwx 1 root root 21 2010-04-09 14:00 /etc/alternatives/pinentry-x11 ->
/usr/bin/pinentry-qt4
lrwxrwxrwx 1 root root 37 2010-04-09 14:00 /etc/alternatives/pinentry-x11.1.gz ->
/usr/share/man/man1/pinentry-qt4.1.gz
bss@monster:~% gpg -s Casecade.deck

You need a passphrase to unlock the secret key for
user: "Boyd Stephen Smith Jr. <bss@iguanasuicide.net>"
1024-bit DSA key, ID B1B54059, created 2007-02-06

gpg: problem with the agent - disabling agent use
bss@monster:~%

KMail pops up a "Bad Passphrase" error dialog without ever prompting me for a
passphrase.

vim also fails to decrypt a file when I attempt to edit it, but it does ask for
a passphrase:
bss@monster:~% vim credentials.gpg
The GPG_TTY is not set!
"credentials.gpg" [noeol][converted] 9L, 2011C
You need a passphrase to unlock the secret key for
user: "Boyd Stephen Smith Jr. <bss@iguanasuicide.net>"
4096-bit ELG-E key, ID 9EB2BCC2, created 2007-02-06 (main key ID B1B54059)


shell returned 2
9 lines filtered
Message could not be decrypted! (Press ENTER)

#577737#10
Date:
2010-08-01 08:33:45 UTC
From:
To:
	Hello, Boyd.  I see that you're not showing your full gpg-agent.conf.
Could it be possible that you're having a lc_message parameter in it?

	I've been debugging for hours this, and finally came up with the following
discovery:

gpg-agent.conf:

no-grab
pinentry-program /usr/bin/pinentry-qt4
default-cache-ttl 7200
#lc-messages "es_ES.UTF-8"
lc-ctype "es_ES.UTF-8"

	Works!  See?

ender@polgara:~/debian/random_package$ debsign
 signfile ../random_package-1.dsc David Martínez Moreno <ender@debian.org>

You need a passphrase to unlock the secret key for
user: "David Martínez Moreno <ender@debian.org>"
1024-bit DSA key, ID 0D62001B, created 2001-03-12

gpg: cancelled by user


	But if I uncomment 'lc_message' parameter:

no-grab
pinentry-program /usr/bin/pinentry-qt4
default-cache-ttl 7200
lc-messages "es_ES.UTF-8"
lc-ctype "es_ES.UTF-8"

	And rerun the agent, it fails when connecting:

ender@polgara:~/debian/random_package$ debsign
 signfile ../random_package-1.dsc David Martínez Moreno <ender@debian.org>

You need a passphrase to unlock the secret key for
user: "David Martínez Moreno <ender@debian.org>"
1024-bit DSA key, ID 0D62001B, created 2001-03-12

gpg: problem with the agent - disabling agent use <<<<<<<<<<<<<<<  See?
Enter passphrase:
gpg: Interrupt caught ... exiting
debsign: gpg error occurred!  Aborting....


	Just as a note, this is also broken for me with pinentry-qt.

	Best regards,


		Ender.

#577737#15
Date:
2014-02-20 21:57:15 UTC
From:
To:
I also get this bug - today I finally researched into and set up
Enigmail and gpg, yet it failed to generate a revocation certificate
and later send an encrypted/signed mail - bad passphrase or key
couldnt be found.

After some research I was lucky to find out about the pinentry
programs - currently the following are available here:

=================================================================

  Selection    Path                     Priority   Status
------------------------------------------------------------
* 0            /usr/bin/pinentry-qt4     95        auto mode
  1            /usr/bin/pinentry-gtk-2   85        manual mode
  2            /usr/bin/pinentry-qt4     95        manual mode

=================================================================

pinentry-qt4 fails completely to prompt me for a password, but when I
change to pinentry-gtk-2, things work fine.

My gpg-agent.conf is very boring:

===============================================================

###+++--- GPGConf ---+++###
default-cache-ttl 300
max-cache-ttl 3000
###+++--- GPGConf ---+++### Thu 20 Feb 2014 21:06:05 GMT
# GPGConf edited this configuration file.
# It will disable options before this marked block, but it will
# never change anything below these lines.

===============================================================

So I dont think it is a locale issue here (en_GB.utf8 for reference).

A normal user would not have known what to do with no passphrase
prompts appearing so this is a serious problem.
Debian Release: jessie/sid
  990 testing         security.debian.org
  990 testing         ftp.uk.debian.org
  500 unstable        ignorantguru.github.com
  500 unstable        ftp.uk.debian.org
  500 quodlibet-unstable www.student.tugraz.at
    1 experimental    ftp.uk.debian.org
--- Package information. ---
Depends                   (Version) | Installed
===================================-+-===================
libc6                     (>= 2.14) |
libgcc1                (>= 1:4.1.1) |
libncursesw5      (>= 5.6+20070908) |
libqtcore4       (>= 4:4.7.0~beta1) |
libqtgui4              (>= 4:4.5.3) |
libstdc++6               (>= 4.1.1) |
libtinfo5                           |


Package's Recommends field is empty.

Suggests          (Version) | Installed
===========================-+-===========
pinentry-doc                |
-- 
Libre software on Github: https://github.com/OmegaPhil
FSF member #9442

#577737#20
Date:
2014-06-12 01:25:38 UTC
From:
To:
I can't reproduce this, and I can't explain it.

A couple of things to try:

Try running pinentry-qt4 independently of gpg.  Just start it and enter
GETPIN at the prompt, and see if a window appears.

Also check your login setup to make sure that the environment variables
GPG_TTY and/or GPG_AGENT_INFO are set correctly.  Although that wouldn't
explain why pinentry-gtk-2 works.  There could be other environment
variables or settings that affect Qt but not Gtk.  Testing the programs
separately, as described above, might clarify that.

#577737#25
Date:
2014-06-12 16:05:00 UTC
From:
To:
When I run pinentry-qt4 separately, I get a dialog, entering 'lol'
produces:

===================================================================

OK Your orders please
GETPIN
Bus::open: Can not get ibus-daemon's address.
IBusInputContext::createInputContext: no connection to ibus-daemon
D lol
OK

===================================================================

On the bash shell I'm looking at, GPG_TTY is unset, GPG_AGENT_INFO is
set to /tmp/gpg-GZ1n2z/S.gpg-agent:27908:1 - gpg-agent is running with
that process ID.

For reference I use XFCE4, not KDE.

Enigmail still breaks completely when /usr/bin/pinentry-qt4 'auto
mode'/'manual mode' is set.

During desktop startup, the only gpg error I can see is (which is
hopefully trivial):

=======================================================================

xfce4-session-Message: ssh-agent is already running; starting
gpg-agent without ssh support

=======================================================================

Thanks

#577737#30
Date:
2016-10-12 07:31:47 UTC
From:
To:
Control: tags 577737 + moreinfo unreproducible

i haven't been able to reproduce this reported problem with pinentry-qt4
or its current equivalent pinentry-qt.  Is this still a problem with
0.9.7-6 in debian unstable or 0.9.7-5 in debian testing?  Is there a
straightforward way to reproduce the problem?  Is it an issue with
DBUS_SESSION_BUS_ADDRESS perhaps?

#577737#35
Date:
2016-10-12 07:31:47 UTC
From:
To:
Control: tags 577737 + moreinfo unreproducible

i haven't been able to reproduce this reported problem with pinentry-qt4
or its current equivalent pinentry-qt.  Is this still a problem with
0.9.7-6 in debian unstable or 0.9.7-5 in debian testing?  Is there a
straightforward way to reproduce the problem?  Is it an issue with
DBUS_SESSION_BUS_ADDRESS perhaps?

#577737#40
Date:
2016-10-12 17:02:56 UTC
From:
To:

Since that point, I have uninstalled pinentry-qt4 and have happily been
using pinentry-gtk-2.

Installing pinentry-qt (0.9.7-5) and switching to it via alternatives
results in the following error dialog coming up 4 times in succession
from Enigmail:

=====================================================================

GnuPG cannot query your passphrase via pinentry.

This is a system setup or configuration error that prevents Enigmail
from working properly and cannot be fixed automatically.

We strongly recommend that you consult our support web site at
https://enigmail.net/faq.

=====================================================================

The real error comes out in ~/.xsession-errors:

=====================================================================

gpg-agent[7019]: can't connect to the PIN entry module
'/usr/bin/pinentry': End of file
gpg-agent[7019]: failed to unprotect the secret key: No pinentry
gpg-agent[7019]: failed to read the secret key
gpg-agent[7019]: command 'PKDECRYPT' failed: No pinentry

=====================================================================

Manually calling pintentry seems to work:

=====================================================================

OK Pleased to meet you
GETPIN

D lol
OK

=====================================================================

So its still effectively useless.

#577737#43
Date:
2016-10-12 17:02:56 UTC
From:
To:

Since that point, I have uninstalled pinentry-qt4 and have happily been
using pinentry-gtk-2.

Installing pinentry-qt (0.9.7-5) and switching to it via alternatives
results in the following error dialog coming up 4 times in succession
from Enigmail:

=====================================================================

GnuPG cannot query your passphrase via pinentry.

This is a system setup or configuration error that prevents Enigmail
from working properly and cannot be fixed automatically.

We strongly recommend that you consult our support web site at
https://enigmail.net/faq.

=====================================================================

The real error comes out in ~/.xsession-errors:

=====================================================================

gpg-agent[7019]: can't connect to the PIN entry module
'/usr/bin/pinentry': End of file
gpg-agent[7019]: failed to unprotect the secret key: No pinentry
gpg-agent[7019]: failed to read the secret key
gpg-agent[7019]: command 'PKDECRYPT' failed: No pinentry

=====================================================================

Manually calling pintentry seems to work:

=====================================================================

OK Pleased to meet you
GETPIN

D lol
OK

=====================================================================

So its still effectively useless.

#577737#48
Date:
2016-10-12 17:06:29 UTC
From:
To:

Note that I'm no longer running Debian Testing but Devuan Testing,
however the pinentry package is unchanged.

#577737#53
Date:
2016-10-12 21:04:22 UTC
From:
To:
I'm still baffled. i followed exactly the steps that you did and the QT
prompt shows up for me :(

What version of enigmail are you running?  where did you get it from?

can you turn on debug-pinentry in your dirmngr.conf and see what it says?

#577737#56
Date:
2016-10-12 21:04:22 UTC
From:
To:
I'm still baffled. i followed exactly the steps that you did and the QT
prompt shows up for me :(

What version of enigmail are you running?  where did you get it from?

can you turn on debug-pinentry in your dirmngr.conf and see what it says?

#577737#61
Date:
2016-10-13 18:09:16 UTC
From:
To:

Enigmail is v1.9.5 via Get Addons (rather than the Debian package).

I started playing with dirmngr.conf but then I realised you meant
gpg-agent.conf ;). As soon as I did a killall to have gpg-agent load the
new configuration and try again, it worked - I know that gpg2 stuff has
updated recently, and my uptime is ~11d, so perhaps the update scripts
don't kill off gpg-agent when theres some incompatible change?

Thanks

#577737#66
Date:
2016-10-13 23:28:42 UTC
From:
To:
thanks, yes, you are correct :)

That's right, the package upgrade scripts make no attempt to restart
long-running user processes, for reasons i suspect you can imagine :)

Can you review /var/log/dpkg.log to see what versions of gpg-agent you
might have been running initially?  I'm glad it's working for you now,
anyway, though i'm still in the dark as to why it wasn't working for you
before.

#577737#71
Date:
2016-10-14 20:56:37 UTC
From:
To:

Latest mentions of gnupg-agent:

=================================================

/var/log/dpkg.log:2016-10-02 08:11:27 upgrade gnupg-agent:amd64 2.1.11-7
2.1.15-3
/var/log/dpkg.log:2016-10-02 08:11:27 status half-configured
gnupg-agent:amd64 2.1.11-7
/var/log/dpkg.log:2016-10-02 08:11:27 status unpacked gnupg-agent:amd64
2.1.11-7
/var/log/dpkg.log:2016-10-02 08:11:27 status half-installed
gnupg-agent:amd64 2.1.11-7
/var/log/dpkg.log:2016-10-02 08:11:27 status half-installed
gnupg-agent:amd64 2.1.11-7
/var/log/dpkg.log:2016-10-02 08:11:27 status unpacked gnupg-agent:amd64
2.1.15-3
/var/log/dpkg.log:2016-10-02 08:11:27 status unpacked gnupg-agent:amd64
2.1.15-3
/var/log/dpkg.log:2016-10-02 08:12:41 configure gnupg-agent:amd64
2.1.15-3 <none>
/var/log/dpkg.log:2016-10-02 08:12:41 status unpacked gnupg-agent:amd64
2.1.15-3
/var/log/dpkg.log:2016-10-02 08:12:41 status unpacked gnupg-agent:amd64
2.1.15-3
/var/log/dpkg.log:2016-10-02 08:12:41 status half-configured
gnupg-agent:amd64 2.1.15-3
/var/log/dpkg.log:2016-10-02 08:12:41 status installed gnupg-agent:amd64
2.1.15-3

=================================================

2.1.11-7 is mentioned as an upgrade on 25.04.16.

#577737#76
Date:
2016-10-15 00:45:15 UTC
From:
To:
You wrote ~11d on the 13th.  This upgrade is from the 2nd, ~11d before
the report.  Can you tell me whether this upgrade happend before or
after the boot that led you into the 11d uptime?  If it happened after
then yes, you were most likely running the older gpg-agent without
restarting it, which would explain the failures you saw.

fwiw, gpg should provide warning messages to stderr if it discovers it's
talking to an older agent, but if you only accessed it through enigmail
maybe those warning messages weren't propagated through to where you
could easily see them.

#577737#81
Date:
2016-10-15 11:29:33 UTC
From:
To:

No, 'old gpg-agent was running' doesn't seem to be the right explanation
for this. The upgrade happened at 2016-10-02 08:11:27, however October
the 2nd looks like monthly reboot day, since there was a reboot from a
v4.5 kernel into v4.6 at 19:35:49, and then v4.7 at 19:40:19 (I'm
running v4.7.5-1 atm).

I'd like to say that any complaints from gpg-agent would cause that
Enigmail dialog to pop up, e.g. the 4 repeats of the dialog originally
suggestively match the 4 lines reported to .xsession-errors.

#577737#86
Date:
2016-12-23 07:15:00 UTC
From:
To:
Dear Customer,

This is to confirm that your item has been shipped at December 20.

Postal label is enclosed to this e-mail. Please check the attachment!

With thanks and appreciation,
Fred Rich,
USPS Chief Station Manager.

#577737#91
Date:
2019-11-15 14:15:53 UTC
From:
To:
Thanks.