Maniphest T2036

gpgme_set_pinentry_mode GPGME_PINENTRY_MODE_LOOPBACK doesn't work
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	flok
	Jul 9 2015, 3:44 PM

Description

At least with gpg2 2.1.4-1 and gpgme 1.5.5-2 the passphrase callback
does not work.
When enabled I get the "secret key unusable" error, and without the
callback (enter passphrase via agent) it works fine.
If I remember correctly you stated that you need gpg2 v2.1 or better
for that to work:
https://lists.gnupg.org/pipermail/gnupg-devel/2015-May/029872.html

Steps:
download http://vps001.vanheusden.com/~folkert/gbug.tgz
unpack it
make
Then:
./gpgme_test E96F346A94A761F898F9DA35D8CD7D21B2A93EF9 test4.txt 1f28d8ae

First parameter is your key-id, second is a text-file containing your
passphrase and the third is the pubkey for which it will sign and
encrypt.
The output looks like:

2015-07-04 18:55:50 (FIXME) GPGME version: 1.5.5
2015-07-04 18:55:50 (FIXME) GPGME protocol: OpenPGP, exe: /usr/bin/gpg2, home-
dir: (null), version: 2.1.4, req version: 1.4.0
2015-07-04 18:55:50 (FIXME) GPGME protocol: CMS, exe: /usr/bin/gpgsm, home-dir:
(null), version: (null), req version: 2.0.4
2015-07-04 18:55:50 (FIXME) GPGME protocol: GPGCONF, exe: /usr/bin/gpgconf,
home-dir: (null), version: 2.1.4, req version: 2.0.4
2015-07-04 18:55:50 (FIXME) GPGME protocol: Assuan, exe:
/home/folkert/.gnupg/S.gpg-agent, home-dir: !GPG_AGENT, version: 1.0,
req version: 1.0
2015-07-04 18:55:50 (FIXME) GPGME protocol: UIServer, exe:
/home/folkert/.gnupg/S.uiserver, home-dir: (null), version: 1.0, req version:
1.0
2015-07-04 18:55:50 (FIXME) GPGME protocol: Spawn, exe: /nonexistent, home-dir:
(null), version: 1.0, req version: 1.0
2015-07-04 18:55:50 (FIXME) my_key_id_in:
E96F346A94A761F898F9DA35D8CD7D21B2A93EF9, found key: D8CD7D21B2A93EF9
2015-07-04 18:55:50 (FIXME) gpgme init success
get_my_keyid: 1
key known: 1

error:

2015-07-04 18:55:50 (FIXME) my_key: D8CD7D21B2A93EF9
encrypt: 0

       error: gpgme_op_encrypt failed: Unusable secret key (117440566)

The "error:" without anythin behind it can be ignored.

Details

Version: 1.5.5-2

Event Timeline

flok set Version to 1.5.5-2.Jul 9 2015, 3:44 PM

flok added projects: Bug Report, gpgme.

flok added a subscriber: flok.

Do you have 'allow-loopback-pinentry' option in your .gnupg/gpg-agent.conf?
It is not enabled by default, since allowing loopback mode gives easier access
to private keys.

I had not. But when I do:

2015-07-10 12:10:07 (gpgme_test) my_key: D8CD7D21B2A93EF9
encrypt: 0
error: gpgme_op_encrypt failed: General error (117440513)

folkert@travelmate:~/Projects/PGF/trunk$ cat ~/.gnupg/gpg-agent.conf
allow-loopback-pinentry

Did an strace (with fork-follow) of my code and saw the following:

The first is a sign + encrypt:

[pid 19904] execve("/usr/bin/gpg2", ["gpg2", "--enable-special-filenames", "--
batch", "--no-sk-comments", "--lc-messages", "C", "--lc-ctype", "C", "--status-
fd", "4", "--no-tty", "--charset", "utf8", "--enable-progress-filter", "--
display", ":0.0", "--encrypt", "--sign", "--always-trust", "-r",
"E96F346A94A761F898F9DA35D8CD7D21B2A93EF9", "-u", "D8CD7D21B2A93EF9", "--
output", "-", "--", "-&7"], [/* 30 vars */]) = 0

The second is a decrypt:

[pid 19907] execve("/usr/bin/gpg2", ["gpg2", "--enable-special-filenames", "--
pinentry-mode=loopback", "--no-sk-comments", "--lc-messages", "C", "--lc-ctype",
"C", "--status-fd", "4", "--no-tty", "--charset", "utf8", "--enable-progress-
filter", "--display", ":0.0", "--command-fd", "5", "--decrypt", "--output", "-",
"--", "-&9"], [/* 30 vars */]) = 0

Now the decrypt does a --pinentry-mode=loopback while the sign, which also
requires password interaction, does not!

A brief check shows that the pinentry mode is passed to the egine for decrypt
and sign. Please double check your code that you set the pinentry mode for the
conext before signing. You should also set GPGME_DEBUG=4:/foo/bar/logfile for a
log.

Werner Koch <wk@gnupg.org> added the comment:

A brief check shows that the pinentry mode is passed to the egine for decrypt
and sign. Please double check your code that you set the pinentry mode for

the

conext before signing. You should also set GPGME_DEBUG=4:/foo/bar/logfile for

log.

I found that on some systems it works and on some it doesn't.

working:
ii gnupg 1.4.18-7
ii gnupg-agent 2.1.4-1
ii gnupg2 2.1.4-1
ii libgpgme++2 4:4.14.2-2+b1
ii libgpgme11:amd64 1.5.5-2
ii libgpgme11-dev 1.5.5-2
ii python-gnupginterface 0.3.2-9.1

failing:
ii gnupg 1.4.18-4
ii gnupg-agent 2.1.6-1
ii gnupg2 2.1.6-1
ii libgpgme++2 4:4.14.2-2+b1
ii libgpgme11:amd64 1.5.5-3
ii libgpgme11-dev 1.5.5-3

Tested it on 3 different debian systems.

When doing an strace, I see the following: