I don't understand what you mean by unlocking gpg-agent. Can you please explain in detail what you try to achieve.

Hi,

what I mean by unlocking is the act of using the passphrase to load the gpg and ssh keys and hence not needing to tip the phrase again afterwards.

SO what I would like to see is this:
You log in into your session. For that you use a password. That password is validated through pam. The same password is passed to gpg-agent and hence unlocks it for the future.

Same situation for a screensaver. Screensaver pops on and I lock (i.e. unload the keys) gpg-agent. Once I give the right password to the screensaver who processes it through pam, I am back in my session with an unlocked gpg-agent.

In the past, you could use envoy for that but today this does not work anymore.

Btw, this was envoy: https://github.com/vodik/envoy

So this is basically 0what GNOME does with its keyring daemon and pinentry-gnome.

I am not to familiar with the gnome keyring but from looking it up on the arch wiki, it seems to have this single sign on capability.

For context, here's what the wisdom of the crowd is rigging together around GPG to get this single-sign-on feature:

• https://www.reddit.com/r/archlinux/comments/5uyw6m/unlock_gnupg_keys_on_login/
  • using pam_exec
  • using pam_gnupg which covers the gap, but is very new and hasn't been audited
• https://github.com/vodik/envoy/issues/6