If it is built with LIBUSB enabled, please try adding the following to your scdaemon.conf:
disable-ccid
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
May 6 2021
May 6 2021
May 5 2021
May 5 2021
Thank you for your response! I tried out all variants of gpgme_pinentry_mode_t and implemented a passphrase callback (using gpgme_set_passphrase_cb as suggested). It turns out that the callback is not invoked at all. However, if I switch back to gnupg 2.2.27, the callback is being invoked and the key is being generated (using the passphrase specified by the callback, as expected).
The problem might be that gpg tries to ask for a passphrase which fails on the CI. Try setting a passphrase callback and setting the pinentry mode to loopback. See https://dev.gnupg.org/source/gpgme/browse/master/tests/run-genkey.c$435.
• ikloecker committed rKLEOPATRAf9a921135b37: Create shadow key also for the smartcard's encryption key. (authored by • werner).
Create shadow key also for the smartcard's encryption key.
• werner closed T5416: [windows] Smartcards are less reliable under 2.3.1 (requires restarting gpg-agent.exe) as Resolved.
Thanks for testing. I hope to get 2.3.2 out in two weeks.
May 4 2021
May 4 2021
colemickens added a comment to T5416: [windows] Smartcards are less reliable under 2.3.1 (requires restarting gpg-agent.exe).
After upgrade:
Laurent Montel <montel@kde.org> committed rKLEOPATRAab36849ebdb3: GIT_SILENT Add auto generated files to .gitignore (authored by Laurent Montel <montel@kde.org>).
GIT_SILENT Add auto generated files to .gitignore
Laurent Montel <montel@kde.org> committed rLIBKLEO85c593a89a81: GIT_SILENT Add auto generated files to .gitignore (authored by Laurent Montel <montel@kde.org>).
GIT_SILENT Add auto generated files to .gitignore
• ikloecker triaged T5421: gpgme++, qgpgme: Add support for creating trust signatures as High priority.
Added documentation for the new fields.
- Renamed trust_regexp to trust_scope.
- Use part of _unused for storing trust_depth and trust_value.
• ikloecker added inline comments to D530: gpgme: Add support for trust signatures to key list result.
• aheinecke awarded T5419: gpgme: Add support for trust signatures to key list result a Like token.
• ikloecker triaged T5419: gpgme: Add support for trust signatures to key list result as Normal priority.
build: Silence two compiler warnings.
• werner committed rGb203325ce112: gpg: Allow ECDH with a smartcard returning just the x-coordinate. (authored by • werner).
gpg: Allow ECDH with a smartcard returning just the x-coordinate.
• werner committed rG9d83bfb63968: scd: Fix possible PC/SC removed card problem (authored by • werner).
scd: Fix possible PC/SC removed card problem
• werner committed rG22fe23f46d31: gpg: Fix mailbox based search via AKL keyserver method. (authored by • werner).
gpg: Fix mailbox based search via AKL keyserver method.
• werner committed rGa475bb725be7: scd: Add string for another PC/SC error code. (authored by • werner).
scd: Add string for another PC/SC error code.
• werner committed rG569fa67277a4: build: Allow running sign-release target from the dist dir. (authored by • werner).
build: Allow running sign-release target from the dist dir.
• werner committed rG6c4216094ef4: scd: Fix unblock PIN by a Reset Code with KDF. (authored by kirelagin).
scd: Fix unblock PIN by a Reset Code with KDF.
• werner committed rGe7251be84c79: gpg: Auto import keys specified with --trusted-keys. (authored by • werner).
gpg: Auto import keys specified with --trusted-keys.
• werner committed rGe53f6037283e: gpg: Allow decryption w/o public key but with correct card inserted. (authored by • werner).
gpg: Allow decryption w/o public key but with correct card inserted.
• werner committed rG79e8ea100df9: speedo: Automatically select Authenticode signing cert. (authored by • werner).
speedo: Automatically select Authenticode signing cert.
• werner committed rGaa612d752ebb: agent: Silence error messages for READKEY --card (authored by • werner).
agent: Silence error messages for READKEY --card
May 3 2021
May 3 2021
• werner committed rGc2ba6bea4ce8: common: Fix gnupg_wait_processes, by skipping invalid PID. (authored by • gniibe).
common: Fix gnupg_wait_processes, by skipping invalid PID.
• werner committed rG2af217ecd7e4: gpg: Allow fingerprint based lookup with --locate-external-key. (authored by • werner).
gpg: Allow fingerprint based lookup with --locate-external-key.
• werner committed rGb59af0e2a05a: gpg: Lookup a missing public key of the current card via LDAP. (authored by • werner).
gpg: Lookup a missing public key of the current card via LDAP.
• werner committed rGb8df8321e1ef: scd: Add option --info to emit KEYPAIRINFO by readkey command. (authored by • werner).
scd: Add option --info to emit KEYPAIRINFO by readkey command.
gpg: Minor restructuring of a function.
• werner committed rGa456303ae306: gpgconf: Do not i18n an empty string to the PO files meta data. (authored by • werner).
gpgconf: Do not i18n an empty string to the PO files meta data.
• werner committed rGbbf4bd3bfcb5: agent: Skip unknown unknown ssh curves seen on cards. (authored by • werner).
agent: Skip unknown unknown ssh curves seen on cards.
doc: Fix option name.
• werner committed rG26a024057dc6: gpg: No warning in quiet mode for S2K mode 0. (authored by • werner).
gpg: No warning in quiet mode for S2K mode 0.
scd: New option --pcsc-shared.
• werner committed rG8bc808a98f3a: w32: Silence a compiler warning in dirmngr.c (authored by • werner).
w32: Silence a compiler warning in dirmngr.c
Thank you for taking time to look into that. There are couple of issues in the CAcert bug tracker talking about the same issue but if, (I see right), the certs still miss the usage flags:
RFC-5280 states in 4.2.1.3 for Key Usage:
The error code is: No Readers Available. With the latest version you should have seen that string.
• werner added projects to T5416: [windows] Smartcards are less reliable under 2.3.1 (requires restarting gpg-agent.exe): gnupg (gpg23), scd, yubikey.
Meanwhile we did some more tests on Windows and so you many want to try our betas at
hansoli added a comment to T4149: Kleopatra OpenPGP and GpgSM self test fail after installation on Windows 7.
I had a similar issue in Windows 10 too. In my case, the issue occurs only when my home path has non-ASCII characters. After I changed home path it works well.
Any chance looking into this @werner?
• ikloecker added a comment to T5359: Kleopatra: Loop in DeviceInfoWatcher with GnuPG 2.3 on Windows.
In T5359#145741, @werner wrote:Can you please clarify this point: If you run on Unix with --disable-ccid-driver, do you get the same behavior as on Windows?
Can you please clarify this point: If you run on Unix with --disable-ccid-driver, do you get the same behavior as on Windows?
Laurent Montel <montel@kde.org> committed rLIBKLEO35776a01dafc: GIT_SILENT: Port away from ECMSetupVersion's deprecated *_VERSION_STRING CMake… (authored by Laurent Montel <montel@kde.org>).
GIT_SILENT: Port away from ECMSetupVersion's deprecated *_VERSION_STRING CMake…
colemickens added a comment to T5409: scdaemon: 'Operation not supported by device' error under macOS after upgrading to 2.3.1.
I'm referring to this: https://www.gnupg.org/howtos/card-howto/en/ch02s03.html
• gniibe added a comment to T5409: scdaemon: 'Operation not supported by device' error under macOS after upgrading to 2.3.1.
@colemickens We don't maintain any ccid udev rules in GnuPG. What do you refer?
May 2 2021
May 2 2021
Laurent Montel <montel@kde.org> committed rKLEOPATRAb84aba26685c: Modernize code (authored by Laurent Montel <montel@kde.org>).
Modernize code
May 1 2021
May 1 2021
l10n daemon script <scripty@kde.org> committed rLIBKLEO0e3414b661a7: SVN_SILENT made messages (.desktop file) - always resolve ours (authored by l10n daemon script <scripty@kde.org>).
SVN_SILENT made messages (.desktop file) - always resolve ours
Apr 30 2021
Apr 30 2021
colemickens added a comment to T5416: [windows] Smartcards are less reliable under 2.3.1 (requires restarting gpg-agent.exe).
To note, this is in contrast to my experience with gpg-2.2 (provided by gpg4win). With gpg-2.2, I was reliably using my Yubikey for a variety of things, and it handled hotplugging perfectly, as one would expect.
• ikloecker moved T5359: Kleopatra: Loop in DeviceInfoWatcher with GnuPG 2.3 on Windows from Restricted Project Column to Restricted Project Column on the Restricted Project board.
• ikloecker reopened T5359: Kleopatra: Loop in DeviceInfoWatcher with GnuPG 2.3 on Windows as "Testing".
• ikloecker closed T5359: Kleopatra: Loop in DeviceInfoWatcher with GnuPG 2.3 on Windows as Resolved.
I have disabled this on Windows. Once "SCD DEVINFO --watch" works reliably on Windows, we can reenable the DeviceInfoWatcher on Windows.
• ikloecker committed rKLEOPATRAf87b256d66e3: Disable DeviceInfoWatcher on Windows (authored by • ikloecker).
Disable DeviceInfoWatcher on Windows
• aheinecke committed rKLEOPATRAfb90ce069227: PKCS#15: Update readerstatus after import (authored by • aheinecke).
PKCS#15: Update readerstatus after import
Also let me know if there are any daemons I have to kill/restart when switching between GnuPG versions by changing the $PATH. Whenever I have problems with my YubiKey, I run gpgconf --kill gpg-agent, which I also executed when I switched from version 2.2.27 back to 2.3.1 but I have no idea whether this is required or sufficient.
$ gpg --version gpg (GnuPG) 2.3.1 libgcrypt 1.9.3 $ gpg --debug ipc --card-status gpg: reading options from '/Users/user/.gnupg/gpg.conf' gpg: reading options from '[cmdline]' gpg: enabled debug flags: ipc gpg: DBG: chan_3 <- OK Pleased to meet you, process 15218 gpg: DBG: connection to the gpg-agent established gpg: DBG: chan_3 -> RESET gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> OPTION ttyname=/dev/ttys007 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> OPTION ttytype=xterm-256color gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> OPTION lc-ctype=en_US.UTF-8 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> OPTION lc-messages=en_US.UTF-8 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> GETINFO version gpg: DBG: chan_3 <- D 2.3.1 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> OPTION allow-pinentry-notify gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> OPTION agent-awareness=2.1.0 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> SCD GETINFO version gpg: DBG: chan_3 <- D 2.3.1 gpg: DBG: chan_3 <- OK gpg: DBG: chan_3 -> SCD SERIALNO gpg: DBG: chan_3 <- ERR 100696144 Operation not supported by device <SCD> gpg: selecting card failed: Operation not supported by device gpg: OpenPGP card not available: Operation not supported by device gpg: secmem usage: 0/32768 bytes in 0 blocks
• ikloecker moved T5359: Kleopatra: Loop in DeviceInfoWatcher with GnuPG 2.3 on Windows from Restricted Project Column to Restricted Project Column on the Restricted Project board.
• ikloecker added a project to T5359: Kleopatra: Loop in DeviceInfoWatcher with GnuPG 2.3 on Windows: Restricted Project.
• werner added a project to T5415: YubiKey no longer recognized in GnuPG 2.3.1 on macOS 10.15.7: MacOS.
Run gpg --debug ipc --card-status to quickly see the communication with the scdaemon.
• aheinecke raised the priority of T5359: Kleopatra: Loop in DeviceInfoWatcher with GnuPG 2.3 on Windows from High to Unbreak Now!.
Hi Ingo,
Apr 29 2021
Apr 29 2021
• aheinecke committed rKLEOPATRA1e77bdf6df5c: Search PKCS#15 keys on ldap servers (authored by • aheinecke).
Search PKCS#15 keys on ldap servers
• aheinecke committed rKLEOPATRAb5398c4e3217: Import keystubs for PKCS#15 cards (authored by • aheinecke).
Import keystubs for PKCS#15 cards
scd:p15: Update from current GnuPG 2.3
• werner committed rG96577e2e46e4: scd: Rewrite READKEY to allow for compressed points. (authored by • werner).
scd: Rewrite READKEY to allow for compressed points.
• werner committed rG5b8593135fa6: common: Extend the openpgp_curve_to_oid function. (authored by • werner).
common: Extend the openpgp_curve_to_oid function.
• werner committed rGf3c98b8cb5ad: common: New module to compute openpgp fingerprints (authored by • werner).
common: New module to compute openpgp fingerprints
• werner committed rGc825117c5fa5: common: New function to uncompress an ECC public key. (authored by • werner).
common: New function to uncompress an ECC public key.
common: New function cmp_canon_sexp.
• werner committed rG72a7d45a230b: scd: Extend an internal function to also return the algo. (authored by • werner).
scd: Extend an internal function to also return the algo.
• werner committed rG0eed0ced9bcd: scd: New function send_keyinfo to assist in backporting. (authored by • werner).
scd: New function send_keyinfo to assist in backporting.
scd: New function for iso7816 PSO_CSV.
• werner committed rG3db99b8861a7: scd: Minor changes to assist in backporting from 2.3 (authored by • werner).
scd: Minor changes to assist in backporting from 2.3
scd: Add new status codes.
scd: Extend iso7816_select_path
• werner committed rGec9e8e0d6a1f: scd: Extend ISO binary and record reading functions. (authored by • werner).
scd: Extend ISO binary and record reading functions.
Can you help me, please?
• ikloecker moved T5245: Kleopatra: Add support for trust signatures / trusted introducer from Restricted Project Column to Restricted Project Column on the Restricted Project board.
scd: Fix PC/SC removed card problem
l10n daemon script <scripty@kde.org> committed rLIBKLEO2e3675836957: SVN_SILENT made messages (.desktop file) - always resolve ours (authored by l10n daemon script <scripty@kde.org>).
SVN_SILENT made messages (.desktop file) - always resolve ours
Apr 28 2021
Apr 28 2021
colemickens added a comment to T5409: scdaemon: 'Operation not supported by device' error under macOS after upgrading to 2.3.1.
@gniibe can you provide any commentary on why the gnupg ccid udev rule is so much smaller than the one debian maintains? Is the debian one considered authoritative these days?
hwf-x86: fix use of wrong operand type
scd:p15: Fix the name of a card.
• werner committed rG178e4eb6555e: build: Allow running sign-release target from the dist dir. (authored by • werner).
build: Allow running sign-release target from the dist dir.
• werner committed rGbb8e3996e44f: scd: Fix problem with reader list becoming empty. (authored by • werner).
scd: Fix problem with reader list becoming empty.
The patch references the following bug:
• ikloecker added a comment to T5283: GpgOL: Add mixed mode for S/MIME and OpenPGP to libkleo newkeyresolver.
Should be mostly done. What's missing is selection of groups in the approval dialog. Groups are not (yet) supported by the KeySelectionCombo.
• ikloecker closed T5397: GpgOL: Add support for groups with S/MIME keys, a subtask of T5283: GpgOL: Add mixed mode for S/MIME and OpenPGP to libkleo newkeyresolver, as Resolved.