Page MenuHome GnuPG

No NEED_PASSPHRASE in batch mode
Closed, InvalidPublic

Description

Description of problem:
Now it's not impossible to check for need passphrase for key.

How reproducible: always

Steps to Reproduce:
Create a new key for signing with passphrase (or can be used existing). In terminal:
mkfifo passphrase
touch status
echo "hello world" | gpg --batch --status-file status --passphrase-file
passphrase -s -u 'Your Key Name'
In another terminal:
cat status

Actual results:
status is empty

Expected results:
some lines. One of them is '[GNUPG:] NEED_PASSPHRASE ...'

Additional info:
echo > passphrase
cat status
[GNUPG:] USERID_HINT C9xx59xxA9xx36xx Name <e@mail>
[GNUPG:] NEED_PASSPHRASE C9xx59xxA9xx36xx C9xx59xxA9xx36xx 17 0
[GNUPG:] MISSING_PASSPHRASE
[GNUPG:] BAD_PASSPHRASE C9xx59xxA9xx36xx

Details

Version
1.4.18 and 2.0.25

Event Timeline

iromanov set Version to 1.4.18 and 2.0.25.
iromanov added a subscriber: iromanov.

It doesn't reproducible for me with 2.0.26 in Debian.
For 1.4, you need --no-use-agent when you have use-agent option in your
configuration.

I just now tested it on my Fedora 20 with gpg 1.4.19 and 2.0.27. I tried to use
--no-use-agent no password request again.

Thanks for your further experiment. I didn't read well about the part of
'mkfifo' in your first message.
I think that you expect some interactive behavior; gpg emits NEED_PASSPHRASE
when its needed, and your program writes to the fifo.

No, gpg doesn't work like that with --passphrase-file or --passphrase-fd.
gpg will read the passphrase string from a file or an fd at the start.

Although the output timing of NEED_PASSPHRASE is different (than your
expectation), it is emitted after gpg reads passphrase string and it needs the
passphrase for signing.

Although the output timing of NEED_PASSPHRASE is different (than your

expectation), it is emitted after gpg reads passphrase string and it needs the
passphrase for signing.

It is nonsense. In this case status is such log file. Such behaviour is no
obviously and documentation says nothing about ths.
And user can't know must or no he provides passphrase.

So maybe there is another correct way to say user that he must type passphrase?
It is need for QCA gnupg plugin. qca-gnupg plugins uses pipes to send/recieve
data with gpg. It was many time ago when I tried to fix problem. So now I can't
remember particularity problem. Seems it was gpg2 related.

I wrote this in my QCA TODO

  • New plugin qca-gpgme to replace current qca-gnupg. qca-gnupg requires to have gpg binary which can be any 1.4.x or 2.x. Them behaviour is different. gpg2 requires gpg-agent to ask user for passphrase. No correct way to check that key requires passphrase.
marcus added a subscriber: marcus.

You should really use GPGME.