Gnome Keyring (GKR) currently proxies all communication with gpg agent. Because
GKR's implementation of the state machine is incomplete, this prevents a lot of
functionality from working correctly. For instance, it is not possible to use a
smart card. (Further, this is basically a MITM attack.)
The maintainer of GKR (Stef) has confirmed that the only reason they intercept
the communication with gpg agent is to be able to cache the passphrase. This
could instead be done by having a GKR-aware pin entry program. When gpg agent
needs a password, it invokes the pin entry program as usual and the pin entry
can consult GKR before prompting the user for a password. If the password is
not cached, the pin entry program can save it with GKR.
For this to work, GKR needs a stable identifier. Currently, this is what the
prompt looks like:
OPTION grab OPTION ttyname=/dev/pts/1 OPTION ttytype=xterm-256color OPTION lc-ctype=en_US.UTF-8 OPTION lc-messages=en_US.UTF-8 OPTION default-ok=_OK OPTION default-cancel=_Cancel OPTION default-prompt=PIN: OPTION touch-file=/data/.gnupg/S.gpg-agent GETINFO pid SETDESC You need a passphrase to unlock the secret key for user:%0A"Stef
Walter <stef@thewalter.net>"%0A1024-bit DSA key, ID D92765AF, created 2002-01-24%0A
SETPROMPT Passphrase SETERROR Invalid passphrase; please try again GETPIN BYE
What is needed is an OPTION that indicates the key's fingerprint or some other
stable identifier identifying the context.