Page MenuHome GnuPG

gpg 2.3.6 and 2.3.7 don't seem to work with Yubikey anymore
Closed, DuplicatePublic


I've been using gpg (via Homebrew on macOS Catalina) with my Yubikey 5C for many months without issue, primarily for signing git commits, but this stopped working the other day. At first I thought it was something wrong with the key, then I thought maybe I needed to tweak scdaemon configuration for some unknown reason, but nothing helped. Finally it occurred to me that I had run brew upgrade recently and so wondered if that had to do with it. Once I worked out how to downgrade gpg (not so easy with Homebrew) I tried 2.3.6 with the same result (I had been using 2.3.7 before). However, after downgrading to 2.3.5 everything now works as before so I strongly suspect that there's a regression in 2.3.6, since downgrading was the only change I made to get it from broken state to working.

I'm afraid all my logs are gone by now. From memory, when running gpg --debug ipc --card-status with 2.3.7 I saw that SCD GETATTR KEY-ATTR was reporting an error. With 2.3.5 there is no error.

I could share a few more details about my specific setup, and happy to run any diagnostics that you think would be useful. Is there another channel so I don't have to post these details here in public?

There is one related issue that I wanted to mention here: the output of gpg --card-status with 2.3.7 looked just like the card was blank, no error to be seen in the output. In a parallel universe I might have contemplated factory resetting the card and starting over at that point. It was only with the --debug ipc flag that I noticed there were low-level errors involved. It appears as if card communication errors are silently ignored in this situation? If so I would suggest they be surfaced instead even without any debug settings enabled.