GNU bug report logs - #8791
23.3; EasyPG: pinentry in remote emacs session without X

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 8791 in the body.
You can then email your comments to 8791 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Roland Winkler <winkler <at> gnu.org>
To: bug-gnu-emacs <at> gnu.org
Subject: 23.3; EasyPG: pinentry in remote emacs session without X
Date: Thu, 02 Jun 2011 19:03:47 -0500

I am running emacs remotely as a child of gpg-agent, but with X
forwarding disabled. If I am trying to visit a gpg-encrypted file, 
I simply get the error message

  File exists, but cannot be read

and I get an empty buffer.

I expect that this is related to the fact that EasyPG does not run
pinentry (or: does not run pinentry properly) if X forwarding is
disabled. If I do enable X forwarding and I try to open a
gpg-encrypted file, a pinentry window pops up, asking me for the
passphrase. Then I can visit gpg-encrypted files as expected.

I would expect that with X forwarding disabled, emacs will ask for the
passphrase in the minibuffer. (I believe I got this behavior when I had
no pinentry program installed.)



In GNU Emacs 23.3.1 (x86_64-unknown-linux-gnu, GTK+ Version 2.12.9)
 of 2011-06-02 on lukas

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: C
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: en_GB.utf8
  value of $LANG: en_US.ISO-8859-15
  value of $XMODIFIERS: nil
  locale-coding-system: iso-latin-9-unix
  default enable-multibyte-characters: t

Message #8 received at 8791 <at> debbugs.gnu.org (full text, mbox):

From: Daiki Ueno <ueno <at> unixuser.org>
To: Roland Winkler <winkler <at> gnu.org>
Cc: 8791 <at> debbugs.gnu.org
Subject: Re: bug#8791: 23.3; EasyPG: pinentry in remote emacs session without X
Date: Fri, 03 Jun 2011 13:20:15 +0900

Roland Winkler <winkler <at> gnu.org> writes:

> I am running emacs remotely as a child of gpg-agent, but with X
> forwarding disabled. If I am trying to visit a gpg-encrypted file, 
> I simply get the error message
>
>   File exists, but cannot be read
>
> and I get an empty buffer.
>
> I would expect that with X forwarding disabled, emacs will ask for the
> passphrase in the minibuffer. (I believe I got this behavior when I had
> no pinentry program installed.)

Well I think pinentry should fallback to use curses in this case.
However it is not currently possible since there is no way to get the
tty where Emacs is running.  See:

http://article.gmane.org/gmane.emacs.devel/96207

Regards,
-- 
Daiki Ueno

Message #11 received at 8791 <at> debbugs.gnu.org (full text, mbox):

From: "Roland Winkler" <winkler <at> gnu.org>
To: Daiki Ueno <ueno <at> unixuser.org>
Cc: 8791 <at> debbugs.gnu.org
Subject: Re: bug#8791: 23.3; EasyPG: pinentry in remote emacs session without X
Date: Fri, 3 Jun 2011 21:18:10 -0500

On Fri Jun 3 2011 Daiki Ueno wrote:
> Well I think pinentry should fallback to use curses in this case.
> However it is not currently possible since there is no way to get the
> tty where Emacs is running.  See:
> 
> http://article.gmane.org/gmane.emacs.devel/96207

I do not know much about the internals of gpg. I was wondering: for
gpg, is there anything similar to the ssh-add command, which could
serve as a fallback?

Roland

Message #14 received at 8791 <at> debbugs.gnu.org (full text, mbox):

From: Daiki Ueno <ueno <at> unixuser.org>
To: "Roland Winkler" <winkler <at> gnu.org>
Cc: 8791 <at> debbugs.gnu.org
Subject: Re: bug#8791: 23.3; EasyPG: pinentry in remote emacs session without X
Date: Mon, 06 Jun 2011 10:46:05 +0900

"Roland Winkler" <winkler <at> gnu.org> writes:

> On Fri Jun 3 2011 Daiki Ueno wrote:
>> Well I think pinentry should fallback to use curses in this case.
>> However it is not currently possible since there is no way to get the
>> tty where Emacs is running.  See:
>> 
>> http://article.gmane.org/gmane.emacs.devel/96207
>
> I do not know much about the internals of gpg. I was wondering: for
> gpg, is there anything similar to the ssh-add command, which could
> serve as a fallback?

I suspect that gpg command installed on your remote system is GPG2,
which is tightly coupled with gpg-agent (and thus pinentry) for secret
key operations by its design.

Assuming that, I could imagine a couple of (insecure) workarounds:

1. install both GPG1 and GPG2
2. keep using GPG2 and write a pinentry program which retrieves
  passphrase via emacsclient.

Generally I'd recommend 1, since most distros provide both packages,
which can be installed with no conflict.

Regards,
-- 
Daiki Ueno

Message #17 received at 8791 <at> debbugs.gnu.org (full text, mbox):

From: "Roland Winkler" <winkler <at> gnu.org>
To: Daiki Ueno <ueno <at> unixuser.org>
Cc: 8791 <at> debbugs.gnu.org
Subject: Re: bug#8791: 23.3; EasyPG: pinentry in remote emacs session without X
Date: Mon, 6 Jun 2011 00:24:28 -0500

On Mon Jun 6 2011 Daiki Ueno wrote:
> > I do not know much about the internals of gpg. I was wondering: for
> > gpg, is there anything similar to the ssh-add command, which could
> > serve as a fallback?
> 
> I suspect that gpg command installed on your remote system is GPG2,
> which is tightly coupled with gpg-agent (and thus pinentry) for secret
> key operations by its design.

...So I assume from your reply that, first of all, gpg does not have
anything similar to shh-add which is a program the user runs in
order to talk to the ssh agent. But gpg is doing it the other way
round: it's always the gpg agent which runs pinentry to ask the user
for a password.

I do not quite understand what motivated the authors of gpg and ssh
to use these different strategies. Oh well...

Anyway: thanks for EasyPG!

Roland

Message #22 received at 8791-done <at> debbugs.gnu.org (full text, mbox):

From: Daiki Ueno <ueno <at> unixuser.org>
To: "Roland Winkler" <winkler <at> gnu.org>
Cc: 8791-done <at> debbugs.gnu.org
Subject: Re: bug#8791: 23.3; EasyPG: pinentry in remote emacs session without X
Date: Mon, 06 Jun 2011 15:12:32 +0900

"Roland Winkler" <winkler <at> gnu.org> writes:

> ...So I assume from your reply that, first of all, gpg does not have
> anything similar to shh-add which is a program the user runs in
> order to talk to the ssh agent.

Ah, sorry, I misinterpreted your question - yes, there is:
gpg-preset-passphrase which is normally installed in /usr/libexec.
I'm not quite sure this is what you want as I seldom use that utility,
but anyway closing this bug for now.

> Anyway: thanks for EasyPG!

Welcome.

Regards,
-- 
Daiki Ueno

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.