Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?

   Using gpg agent for ssh returns refused operation when using
   smartcard.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

   I configured the gpg agent by adding enable-ssh-support to ~/.gnupg/gpg-agent.conf,
   I added also my key grip to .gnupg/sshcontrol and I added the
   following lines to my .bashrc:

   export GPG_TTY=$(tty)
   export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)

   Since then I can see:

   $ ssh-add -l
   4096 SHA256:QXx1d/USG3KeT3UqD74YXHnTM5SEbzZ0t3HREUcpEjI cardno:000609023428 (RSA)

   And:

   ● gpg-agent-ssh.socket - GnuPG cryptographic agent (ssh-agent emulation)
     Loaded: loaded (/usr/lib/systemd/user/gpg-agent-ssh.socket; enabled; vendor preset: enabled)
     Active: active (running) since Sun 2021-11-07 10:27:36 EET; 42min ago
   Triggers: ● gpg-agent.service
       Docs: man:gpg-agent(1)
             man:ssh-add(1)
             man:ssh-agent(1)
             man:ssh(1)
     Listen: /run/user/1000/gnupg/S.gpg-agent.ssh (Stream)
     CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/gpg-agent-ssh.socket

   However, when I do a git clone over ssh, I see:

   sign_and_send_pubkey: signing failed for RSA "cardno:000609023428" from agent: agent refused operation

   * What was the outcome of this action?

   sign_and_send_pubkey: signing failed for RSA "cardno:000609023428" from agent: agent refused operation

   * What outcome did you expect instead?

   Doing the git clone.

*** End of the template - remove these template lines ***

Hi José and Vagrant,

It seems bugs #998728, 1008573, and #1032907 are all the same. Perhaps
the maintainers would like to merge them.

Thanks for your workaround, Vagrant; I found that adding
	KexAlgorithms -sntrup761x25519-sha512@openssh.com
to my ~/.ssh/config allows me to connect to a Bookworm machine, from
Bookworm, and also to hosts running a newer OpenSSH daemon.

A similar issue upstream is here:
https://dev.gnupg.org/T6250

Werner K. hints that it might be fixed in the GnuPG 2.3 series. As soon
as the maintainers upload it to experimental, I will be happy to test
it.

Thanks everyone for your attention.

I just confirmed that downgrading to openssh-server 1:9.2p1-2+deb12u3
does work again on at least one machine.

live well,
  vagrant

With the recent update of openssh in bookworm (1:9.2p1-2+deb12u4) this
no longer seems a sufficient workaround; I can no longer ssh in to
machines running this version of openssh.

My hunch is the problem was introduced in a new and exciting way with:

https://bugs.debian.org/1088873
  openssh: please add sntrup761x25519-sha512 as an alias to sntrup761x25519-sha512@openssh.com in 9.2/Bookworm

Specifying both in ~/.ssh/config does not work around the issue for me:

  KexAlgorithms -sntrup761x25519-sha512@openssh.com,-sntrup761x25519-sha512


live well,
  vagrant