I've got gpg 2.1 installed, from debian experimental.  I haven't
tested the below with other versions of gpg.

from the "Preferences for current account" dialog, I chose "Plugins" >
GPG, and then clicked on "Generate a new key pair".

Claws prompted me (twice) for a new passphrase, and then invoked gpg,
which started to generate a key.  however, gpg itself went ahead and
prompted me via pinentry for a passphrase during key generation.

because i'm using the gpg-agent, claws doesn't have to touch my
passphrase at all.  This is a good thing!  but claws prompted me for
my passphrase anyway.  This would be pretty confusing to a new user,
being asked to enter their passphrase 4 times during key generation.

Hi Daniel,

When you say "because i'm using the gpg-agent […]" does it mean that:

 a) you're simply using it, and expect Claws Mail to be able to found that
    fact by itself and do not ask for passwords

 b) you have also checked "Use gpg-agent to manage passwords" option in
    Claws Mail's preferences Plugins/GPG panel but is still asking for
    passwords

best regards,

Hi Ricardo--

Thanks for the quick response!

I guess i mean (a), because i don't see the option you describe.

In the Claws Mail preferences dialog box's GPG pane, i see only the
following:

On Fri, 23 Jan 2015 10:11:31 -0500 Daniel Kahn Gillmor <dkg@fifthhorseman.net> wrote:

Hi, you're welcome! :)

That's per-account GPG preferences. I was referring to the global GPG
plugin configuration :) see attached screenshot.

Mine is disabled because I don't have it running.

If you have agent running and the check is still disabled this is
because GPG_AGENT_INFO environment variable was not set by the agent
(see claws-mail manpage).

Has the gpg-agent experimental version you have changed that much?

regards,

ah, ok, thanks.  i don't think i knew about the difference -- i'm not a
regular claws-mail user.

Mine is disabled too, but i do have it available :)

right, in my test account, i didn't have $GPG_AGENT_INFO set because i
wasn't using a full X11 session startup, and because the newer gpg-agent

Yes, it has!  as of gpg 2.1, the agent is launched automatically when
needed, and it uses the standard socket location of
$GNUPGHOME/S.gpg-agent (and in fact, the gpg process itself deliberately
doesn't handle the secret key material or passphrases at all, which is
great from a security perspective).

For backward compatibility, we're probably still going to continue
setting $GPG_AGENT_INFO anyway within the debian X11 session startup,
but that's not a good long-term solution.

Here's how i recommend that claws changes things (feel free to forward
this upstream if you think it's better dealt with there).  the basic
idea is that claws-mail should do everything it can to avoid handling
the user's passphrase:

 * check the version of gpg -- if it's 2.1 or later, *require* the use
   of the agent.

 * if it's before 2.1, and $GPG_AGENT_INFO is set, then enable the
   preference *and* make it default to checked.

 * if it's before 2.1 and $GPG_AGENT_INFO is not set, then enable the
   preference and make it default to unchecked.  If the user checks it,
   and tries to use gpg, and GPG_AGENT_INFO is still unset, present the
   user with a suggestion to either upgrade gpg (and the agent) to 2.1,
   or to ensure that gpg-agent is launched as part of their desktop
   session.

Thanks for talking this through here,