Page MenuHome GnuPG

gpgconf does not support the --enable-win32-openssh-support option for gpg-agent
Open, NormalPublic

Description

On GnuPG 2.4.8 (gpg4win 4.4.1, Windows 11), attempting to configure gpg-agent to use the --enable-win32-openssh-support option can seemingly only be done by manually editing gpg-agent.conf.

  • gpgconf --list-options gpg-agent does not report any output line containing enable-win32-openssh-support, even if gpg-agent.conf contains only that line.
  • echo enable-win32-openssh-support:0:1 | gpgconf --change-options gpg-agent fails with the error message unknown option enable-win32-openssh-support.

Given these symptoms, I would assume that when the command-line option was added, the corresponding configuration option for gpgconf was forgotten.

Details

Version
GnuPG 2.4.8 (gpg4win 4.4.1) on Windows 11

Event Timeline

werner triaged this task as Normal priority.Tue, Jan 6, 8:53 AM
werner edited projects, added gnupg26, ssh, Feature Request; removed gpgagent, Bug Report.
werner added a subscriber: werner.

Frankly, he OpenSSH support for Windows was experimental and I have never tested it. If it can be confirmed that this really works and is useful, it will be easy to add the opeion to gpgconf. Note that the gpgconf option feature handles only a subset of all options on purpose.

Frankly, he OpenSSH support for Windows was experimental and I have never tested it. If it can be confirmed that this really works and is useful, it will be easy to add the opeion to gpgconf.

I see no such mention of its experimental status in the documentation. I would argue that the way the documentation is presented, it is natural to assume that OpenSSH agent emulation is as stable and supported as the rest of gpg-agent is.

That said, depending on what kind of testing you need, I may be able to help out. My original use case (during which I discovered this behavior of gpgconf) revolved around talking to the SSH agent directly, outside of any SSH connection context… but I do have access to the Win32 OpenSSH port whose agent GnuPG is attempting to emulate, and I can run specific tests on that, if I know what to run.

Note that the gpgconf option feature handles only a subset of all options on purpose.

This is highly regrettable for gpg-agent, and for the other background servers with auto-start: those servers are designed to not be run directly on the command-line, so they cannot accept command-line arguments the conventional way, so the next logical place to put them is in their respective configuration file. And gpgconf is (or at least looks like) the right tool to do this, programmatically. If there are options/command-line arguments that cannot be set this way, then how would we pass those to gpg-agent etc.? By editing the configuration files ourselves? That seems unnecessarily risky to me, i.e., it might quickly lead to faulty or unintended command-lines if the user's other settings also need to be respected.