Debian Bug report logs - #796931
gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <tg@mirbsd.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Tue, 25 Aug 2015 23:29:05 +0200

Package: gnupg-agent
Version: 2.1.7-2
Severity: important

Hi,

since one of the recent upgrades, gpg-agent no longer writes its
environment file. This is a rather bad regression for my setup,
which uses the env file for sharing a gpg-agent across all (both
SSH and local console or X11) sessions of one user (i.e. that
particular sharing now becomes impossible).

-- System Information:
Debian Release: stretch/sid
  APT prefers unreleased
  APT policy: (500, 'unreleased'), (500, 'buildd-unstable'), (500, 'unstable')
Architecture: x32 (x86_64)
Foreign Architectures: i386, amd64

Kernel: Linux 4.1.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/lksh
Init: sysvinit (via /sbin/init)

Versions of packages gnupg-agent depends on:
ii  libassuan0               2.2.1-1
ii  libc6                    2.19-19
ii  libgcrypt20              1.6.3-2
ii  libgpg-error0            1.19-2
ii  libnpth0                 1.2-1
ii  libreadline6             6.3-8+b3
ii  pinentry-qt4 [pinentry]  0.9.5-4

Versions of packages gnupg-agent recommends:
ii  gnupg   1.4.19-5
ii  gnupg2  2.1.7-2
ii  gpgsm   2.1.7-2

gnupg-agent suggests no packages.

-- no debconf information

Message #10 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Werner Koch <wk@gnupg.org>

To: Thorsten Glaser <tg@mirbsd.de>

Cc: 796931@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 26 Aug 2015 14:13:59 +0200

On Tue, 25 Aug 2015 23:29, tg@mirbsd.de said:

> since one of the recent upgrades, gpg-agent no longer writes its
> environment file. This is a rather bad regression for my setup,

Rignt, that is because it is not anymore used except for ssh.  See the
man page.  Here is what I have in my profile (.bashrc in my case) for
ages (eben 2.0 could be configured or started with a fixed socket)

--8<---------------cut here---------------start------------->8---
if [ "$PS1" ]; then
    # Setup information required by GnuPG and ssh.  We use the
    # standard socket in GnuPG's homedir, thus there is no need for an
    # environment variable.  We reset any left over envvar.
    # SSH_AGENT_PID should not be set because it is only used
    # to kill ssh-agent (option -k) but we don't want this to kill
    # gpg-agent.  Because ssh does not know about GnuPG's homedir we
    # need to set its envvar to the standard of gpg-agent.  GPG_TTY needs
    # to be set to the current TTY.  The extra test is used to avoid
    # setting SSH_AUTH_SOCK if gpg-agent has been started with the
    # shell on the command line (often used for testing).
    unset GPG_AGENT_INFO
    unset SSH_AGENT_PID
    if [ "${gnupg_SSH_AUTH_SOCK_by:-0}" -ne $$ ]; then
      export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh"
    fi
fi
export GPG_TTY=`tty`
--8<---------------cut here---------------end--------------->8---


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.

Message #15 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <t.glaser@tarent.de>

To: Werner Koch <wk@gnupg.org>

Cc: 796931@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 26 Aug 2015 13:35:55 +0000 (UTC)

Werner Koch dixit:

>On Tue, 25 Aug 2015 23:29, tg@mirbsd.de said:
>
>> since one of the recent upgrades, gpg-agent no longer writes its
>> environment file. This is a rather bad regression for my setup,
>
>Rignt, that is because it is not anymore used except for ssh.  See the

I do, however, wish to be able to ssh into the machine and have
it “pick up” the gpg-agent that was started when I logged in at
the kdm prompt.

Thanks,
//mirabilos
-- 
tarent solutions GmbH
Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-393 • Fax: +49 228 54881-235
HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

Message #20 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <t.glaser@tarent.de>

To: 796931@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 26 Aug 2015 18:22:11 +0200 (CEST)

severity 796931 serious
thanks

On Tue, 25 Aug 2015, Thorsten Glaser wrote:

> particular sharing now becomes impossible).

It’s actually worse: when using startx or no X environment
at all, I can no longer use gpg-agent:

tglase@tglase-nb:~ $ eval $(gpg-agent --daemon --sh)
tglase@tglase-nb:~ $ gpg --clearsign <<<x

You need a passphrase to unlock the secret key for
user: "Thorsten Glaser (tarent GmbH) <t.glaser@tarent.de>"
4096-bit RSA key, ID 5EB8D3B3, created 2009-01-05

gpg: gpg-agent is not available in this session
Enter passphrase: 


Apparently, this does work with gpg2…

tglase@tglase-nb:~ $ gpg2 --clearsign <<<x                                                                      
gpg: keyserver option 'verbose' is unknown
gpg: keyserver option 'verbose' is unknown
gpg: starting migration from earlier GnuPG versions
gpg: porting secret keys from '/home/tglase/.gnupg/secring.gpg' to gpg-agent
gpg: key 5EB8D3B3: secret key imported
gpg: key 272AD62F: secret key imported
gpg: key EB839C67: secret key imported
gpg: key E780F2AB: secret key imported
gpg: key 82C875DC: secret key imported
gpg: migration succeeded
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA384

x
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCQAGBQJV3edUAAoJEIlQwYleuNOzoe0P/066sPOUB8xSbdeEwd+1s2jw
b4PchR/N75ZxCDThcBqY5DjHptDHTz3pvEhIJnXMsjUomws2NUjH63/s1gSlnbD8
4cuok/X+IAYMFPXuPVpZHfKqXyHeEA6VSPDh1ID+R7+bGupz/zCOdRHZX1C3ObW1
Lzlior5ERruXTJy5UcFEJ82SnMCts3gWeDKJRQgs3I6Shac95zLRBBrJM3WsvWWi
n4yIeYEnE4In8VlmxyZfu0UsHcotJS+pRgBHrN6p26KWwge/bOeousMCPRgFciWa
aA2u2VE7OrqF1tY4Z74XFerj8j4PmumMRmmnDnLQ/985o8/ARrN94zcua/Zw05ln
M7sRrky6xW0V6GS6LBxJkLSYTfZFcPdQVwiDvhpHtbA6E0OOirokf51jfCajQeRX
f7g7nVW1pDXv9ms8TXGDvyjy/GnyK/hBix0XFwYUPegIpgZBfhyJ2gudNltaHhCq
a4L0xR6XKEAQ20bH8gSQ5flC251e+zqPBHodoiW0Hc6aIYDmXyu4Y2inU4x/KooR
+FuPEUXlAW/Je1JkWXzRz/m7Swva10ICZvw2a2HYIgbnuC1PJkDINIHIrazOmhVN
R1bE2ig0WVJ2az/8AMu0F0s0kcTIfadrplxszXtqDSqXcAx+J4xYt3wbuqBTUMIh
OoKi2o1CaglwkW+nvigN
=j0q+
-----END PGP SIGNATURE-----


… as a repeat attempt does not ask me for the password, but this
is clearly inacceptable because gpg2 is no replacement for gpg,
but a totally separate tool with different use cases.

bye,
//mirabilos
-- 
tarent solutions GmbH
Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-393 • Fax: +49 228 54881-314
HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941
Geschäftsführer: Boris Esser, Sebastian Mancke

Message #27 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Michael Gold <michael@bitplane.org>

To: Thorsten Glaser <t.glaser@tarent.de>

Cc: 796931@bugs.debian.org

Subject: Re: Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Sat, 29 Aug 2015 12:10:02 -0400

[Message part 1 (text/plain, inline)]

> On Tue, 25 Aug 2015, Thorsten Glaser wrote:
> 
> > particular sharing now becomes impossible).
> 
> It’s actually worse: when using startx or no X environment
> at all, I can no longer use gpg-agent:
> 
> tglase@tglase-nb:~ $ eval $(gpg-agent --daemon --sh)
> tglase@tglase-nb:~ $ gpg --clearsign <<<x
...
> gpg: gpg-agent is not available in this session

This seems to work for gpg1 and gpg2:
	: "${GPG_AGENT_INFO=${GNUPGHOME-$HOME/.gnupg}/S.gpg-agent:0:1}"
	export GPG_AGENT_INFO

(It also makes mutt happy--if there's no GPG_AGENT_INFO, it will prompt
for a passphrase itself; GPG_AGENT_INFO='' is OK for mutt, too.)

Since there's a known location, you should be able to share across
sessions.

Trying to support gpg2.0 and 2.1 in one startup script is still annoying
for various reasons; e.g., 2.0 needs --use-standard-socket to get this
behaviour, but 2.1 will complain loudly about it.  And 2.1's automatic
agent spawning makes it look like things are working as expected, until
problems like this appear.

-- Michael

[signature.asc (application/pgp-signature, inline)]

Message #32 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <t.glaser@tarent.de>

To: Michael Gold <michael@bitplane.org>

Cc: 796931@bugs.debian.org

Subject: Re: Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Mon, 31 Aug 2015 00:22:06 +0200 (CEST)

On Sat, 29 Aug 2015, Michael Gold wrote:

> This seems to work for gpg1 and gpg2:
> 	: "${GPG_AGENT_INFO=${GNUPGHOME-$HOME/.gnupg}/S.gpg-agent:0:1}"
> 	export GPG_AGENT_INFO

I assume this needs to be written after the eval?

> Trying to support gpg2.0 and 2.1 in one startup script is still annoying

This is a requirement, though.

bye,
//mirabilos
-- 
tarent solutions GmbH
Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-393 • Fax: +49 228 54881-235
HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

Message #37 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Michael Gold <michael@bitplane.org>

To: Thorsten Glaser <t.glaser@tarent.de>

Cc: 796931@bugs.debian.org

Subject: Re: Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Sun, 30 Aug 2015 23:50:14 -0400

[Message part 1 (text/plain, inline)]

On Mon, Aug 31, 2015 at 00:22:06 +0200, Thorsten Glaser wrote:
> On Sat, 29 Aug 2015, Michael Gold wrote:
> 
> > This seems to work for gpg1 and gpg2:
> > 	: "${GPG_AGENT_INFO=${GNUPGHOME-$HOME/.gnupg}/S.gpg-agent:0:1}"
> > 	export GPG_AGENT_INFO
> 
> I assume this needs to be written after the eval?

I was assuming that, but I don't think it matters.  2.1 won't give you
anything to eval, and 2.0 will overwrite any earlier setting.

> > Trying to support gpg2.0 and 2.1 in one startup script is still annoying
> 
> This is a requirement, though.

I've attached the script I'm using as an example.  I didn't test this
version with gpg 2.0 but I expect it will still work.  ('gpg2 --version'
is the obvious way to set $gpg21; I was just avoiding the subshell.)

-- Michael

[70gnupg-agent.sh (application/x-sh, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #42 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <t.glaser@tarent.de>

To: Michael Gold <michael@bitplane.org>

Cc: 796931@bugs.debian.org

Subject: Re: Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 9 Sep 2015 09:27:22 +0200 (CEST)

On Sun, 30 Aug 2015, Michael Gold wrote:

> > > Trying to support gpg2.0 and 2.1 in one startup script is still annoying
> > 
> > This is a requirement, though.
> 
> I've attached the script I'm using as an example.  I didn't test this

Hmm, really complex stuff there. I guess whatever I cobbled together
in 2009 isn’t as sophisticated.

https://evolvis.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=shellsnippets/shellsnippets.git;a=blob;f=posix/sysadmin/agents.sh;h=485f025a5171a0721bb0cb10c3676f96393715f3;hb=HEAD

Anyway, at first glance, the new script (ignore the first part about
removing old gpg configs and running ssh-agent) appears to work,
although I’ve not yet tested after reboot. Thanks for the information!

Besides some logic changes (to avoid nesting ifs) I now set the
GPG_AGENT_INFO myself if not set, and write the “PID” file manually
instead of telling gpg-agent to do it. This appears to make pickup
from another session work, too.

bye,
//mirabilos
-- 
tarent solutions GmbH
Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-393 • Fax: +49 228 54881-235
HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941
Geschäftsführer: Dr. Stefan Barth, Kai Ebenrett, Boris Esser, Alexander Steeg

Message #47 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Benjamin Eltzner <b.eltzner@gmx.de>

To: 796931@bugs.debian.org

Subject: Related problem?

Date: Sun, 1 Nov 2015 13:04:43 +0100

Hi,

I think I have a similar problem: I run unstable and enigmail does not
work. The log contains:

2015-11-01 11:41:09.774 [DEBUG] enigmail.js: detectGpgAgent: no
GPG_AGENT_INFO variable set

and in a shell I can confirm that the variable is not set:

~$ echo $GPG_AGENT_INFO

~$

I have not change the file /etc/X11/Xsession.d/90gpg-agent so its
content is as written below. If I understand the discussion so far
correctly, this file is no longer run by default?

I am somewhat inexperienced with shell syntax, system startup and the
architecture of gnupg in debian, so I would be grateful for a simple
explanation how to fix my immediate problem. An awesome extra would be a
beginner-level explanation what went wrong and why, so I may be able to
do better trouble shooting next time.

If my problem is related to another bug or I should open a new bug
report, please tell me.

Cheers, Benjamin

--- APPENDIX: content of my /etc/X11/Xsession.d/90gpg-agent ---

: ${GNUPGHOME=$HOME/.gnupg}

GPGAGENT=/usr/bin/gpg-agent

if grep -qs '^[[:space:]]*use-agent' "$GNUPGHOME/gpg.conf"
"$GNUPGHOME/options"$
test -x $GPGAGENT; then

# Invoking gpg-agent with no arguments exits successfully if the agent
# is already running on the standard socket
if ! $GPGAGENT 2>/dev/null; then
"$GPGAGENT" --daemon
fi
GPG_AGENT_INFO="${GNUPGHOME}/S.gpg-agent:0:1"
export GPG_AGENT_INFO
if grep -qs '^[[:space:]]*enable-ssh-support'
"${GNUPGHOME}/gpg-agent.conf";$
SSH_AUTH_SOCK="${GNUPGHOME}/S.gpg-agent.ssh"
export SSH_AUTH_SOCK
fi
fi

Message #52 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Axel Beckert <abe@debian.org>

To: 796931@bugs.debian.org

Cc: Thorsten Glaser <t.glaser@tarent.de>

Subject: Re: Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 23 Dec 2015 19:21:45 +0100

Hi,

Thorsten Glaser wrote:
> severity 796931 serious

I agree with this severity. This issue breaks quite some automatic
stuff and is a severe and unexpected regression.

> It’s actually worse: when using startx or no X environment
> at all, I can no longer use gpg-agent:

Interestingly it still works for me under X, but there are chances
that I used gnupg/gnupg2 from experimental where "gpg" is gpg2.

On some other host I just ran into the issue that this no more works:

> tglase@tglase-nb:~ $ eval $(gpg-agent --daemon --sh)

The point is that neither "gpg-agent --daemon --sh" outputs any shell
code to be eval'ed anymore nor does "gpg-agent --daemon /usr/bin/zsh"
work for me as advertised in gpg-agent's man page (no GPG_* named
environment variables set inside). Because if I try to sign something
inside that shell, it claims that "gpg-agent is not available in this
session" as it does for Thorsten:

> You need a passphrase to unlock the secret key for
> user: "Thorsten Glaser (tarent GmbH) <t.glaser@tarent.de>"
> 4096-bit RSA key, ID 5EB8D3B3, created 2009-01-05
> 
> gpg: gpg-agent is not available in this session

Having "gpg-agent --daemon" outputting lines like
"GPG_AGENT_INFO=/tmp/gpg-4hLrL9/S.gpg-agent:5152:1; export
GPG_AGENT_INFO;" respectively setting this in the child process'
environment as it did before would fix the issue for me. But there
seem to be other interfaces I haven't used so far, too.

		Regards, Axel
-- 
 ,''`.  |  Axel Beckert <abe@debian.org>, http://people.debian.org/~abe/
: :' :  |  Debian Developer, ftp.ch.debian.org Admin
`. `'   |  4096R: 2517 B724 C5F6 CA99 5329  6E61 2FF9 CD59 6126 16B5
  `-    |  1024D: F067 EA27 26B9 C3FC 1486  202E C09E 1D89 9593 0EDE

Message #57 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <t.glaser@tarent.de>

To: Axel Beckert <abe@debian.org>

Cc: 796931@bugs.debian.org

Subject: Re: Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 23 Dec 2015 21:55:25 +0100 (CET)

On Wed, 23 Dec 2015, Axel Beckert wrote:

> Having "gpg-agent --daemon" outputting lines like
> "GPG_AGENT_INFO=/tmp/gpg-4hLrL9/S.gpg-agent:5152:1; export
> GPG_AGENT_INFO;" respectively setting this in the child process'
> environment as it did before would fix the issue for me. But there

Indeed. I have a workaround now. Look at the git revision log for…
https://evolvis.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=shellsnippets/shellsnippets.git;a=blob;f=posix/sysadmin/agents.sh;h=485f025a5171a0721bb0cb10c3676f96393715f3;hb=HEAD
… to see what I did. (That script is supposed to end up in e.g.
/etc/profile.d/ and automatically runs ssh-agent and gpg-agent.)

bye,
//mirabilos
-- 
Yes, I hate users and I want them to suffer.
	-- Marco d'Itri on gmane.linux.debian.devel.general

Message #62 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Iain Lane <laney@debian.org>

To: 796931@bugs.debian.org

Subject: Re: Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Thu, 7 Jan 2016 12:33:34 +0000

[Message part 1 (text/plain, inline)]

On Wed, Dec 23, 2015 at 07:21:45PM +0100, Axel Beckert wrote:
> Hi,
> 
> Thorsten Glaser wrote:
> > severity 796931 serious
> 
> I agree with this severity. This issue breaks quite some automatic
> stuff and is a severe and unexpected regression.

I assume this problem I'm having is the same thing:

 - I have a gpg-agent running in my normal desktop session
 - All development happens in an lxc container into which my home
   directory is bind mounted
 - When I ssh into this container, keychain is used to start a gpg-agent

Previously this worked - I got a GPG_AGENT_INFO pointing to a socket
under /tmp/gpg-XXXXXX. Now gpg-agent --daemon just bails out if it sees
a socket under ~/.gnupg/ and so things fall back to using the
pre-existing agent which they can't communicate with.

Cheers,

-- 
Iain Lane                                  [ iain@orangesquash.org.uk ]
Debian Developer                                   [ laney@debian.org ]
Ubuntu Developer                                   [ laney@ubuntu.com ]

[signature.asc (application/pgp-signature, inline)]

Message #67 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Manoj Srivastava <srivasta@debian.org>

To: 796931@bugs.debian.org

Subject: Another data point

Date: Wed, 20 Jan 2016 01:04:43 -0800

[Message part 1 (text/plain, inline)]

Hi,

        I sourced the file 70gnupg-agent.sh discussed earlier int he bug
 report. I am still having issues -- at least, with gpg, I can actually
 use gpg; gpg2 just fails.

        manoj

> echo $GNUPGHOME
/home/srivasta/lib/.sec
>echo $GPG_AGENT_INFO

> echo $GPG_AGENT

> gpg-agent
gpg-agent[1725]: gpg-agent running and available
> gpg2 -vvv --clearsign ~/.login
gpg: keyserver option 'include-disabled' is unknown
gpg: keyserver option 'honor-http-proxy' is unknown
gpg: using character set 'utf-8'
gpg: Note: signature key 9D760D4D has been revoked
gpg: Note: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
gpg: using PGP trust model
gpg: key C5779A1C: accepted as trusted key
gpg: Note: signature key 9D760D4D has been revoked
gpg: Note: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
gpg: using subkey 6F576472 instead of primary key C5779A1C
gpg: writing to '/home/srivasta/.login.asc'
gpg: signing failed: No secret key
gpg: /home/srivasta/.login: clearsign failed: No secret key
[1]    1767 exit 2     gpg2 -vvv --clearsign ~/.login
> gpg -vvv --clearsign ~/.login
gpg: using character set `utf-8'
gpg: using PGP trust model
gpg: key C5779A1C: accepted as trusted key
gpg: can't handle public key algorithm 22
gpg: can't handle public key algorithm 19
gpg: error checking usability status of C7261095
gpg: key C7261095: secret key without public key - skipped
gpg: NOTE: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
gpg: NOTE: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
gpg: no secret subkey for public subkey 840A4306 - ignoring
gpg: using subkey 6F576472 instead of primary key C5779A1C

You need a passphrase to unlock the secret key for
user: "Manoj Srivastava <srivasta@golden-gryphon.com>"
gpg: NOTE: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
gpg: using subkey 6F576472 instead of primary key C5779A1C
2048-bit RSA key, ID 6F576472, created 2009-07-23 (main key ID C5779A1C)

gpg: gpg-agent is not available in this session
You need a passphrase to unlock the secret key for
user: "Manoj Srivastava <srivasta@golden-gryphon.com>"
2048-bit RSA key, ID 6F576472, created 2009-07-23 (main key ID C5779A1C)

gpg: writing to `/home/srivasta/.login.asc'
gpg: RSA/SHA512 signature from: "6F576472 Manoj Srivastava <srivasta@golden-gryphon.com>"


 ps auwwx | egrep '[g]pg-agent'
srivasta 24911  0.0  0.0 165000  2180 ?        SNs  00:39   0:00 gpg-agent --daemon --enable-ssh-support --allow-preset-passphrase --no-allow-external-cache

-- 
Man is a military animal, glories in gunpowder, and loves
parade. P.J. Bailey
Manoj Srivastava <srivasta@debian.org> <http://www.debian.org/~srivasta/>  
4096R/C5779A1C E37E 5EC5 2A01 DA25 AD20  05B6 CF48 9438 C577 9A1C

[signature.asc (application/pgp-signature, inline)]

Message #72 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

To: Manoj Srivastava <srivasta@debian.org>, 796931@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#796931: Another data point

Date: Wed, 20 Jan 2016 13:32:19 -0500

Hi Manoj--

On Wed 2016-01-20 04:04:43 -0500, Manoj Srivastava wrote:

> I sourced the file 70gnupg-agent.sh discussed earlier int he bug
> report.

If you're running X11, i'd assume that file would have been sourced
during your session startup.

> I am still having issues -- at least, with gpg, I can actually use
> gpg; gpg2 just fails.

can you show the version numbers you're using?

dpkg -l gnupg gnupg2 gnupg-agent


>> echo $GNUPGHOME
> /home/srivasta/lib/.sec
>>echo $GPG_AGENT_INFO
>
>> echo $GPG_AGENT
>
>> gpg-agent
> gpg-agent[1725]: gpg-agent running and available

the fact that GPG_AGENT_INFO isn't set is a little odd if you've sourced
70gpg-agent.sh, although the fact that you're not using a standard
GNUPGHOME also makes me wonder what's going on here.  do you have
"use-agent" set in /home/srivastava/lib/.sec/gpg.conf?  what about in
/home/srivastava/.gnupg/gpg.conf ?

>> gpg2 -vvv --clearsign ~/.login
> gpg: keyserver option 'include-disabled' is unknown
> gpg: keyserver option 'honor-http-proxy' is unknown
> gpg: using character set 'utf-8'
> gpg: Note: signature key 9D760D4D has been revoked
> gpg: Note: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
> gpg: using PGP trust model
> gpg: key C5779A1C: accepted as trusted key
> gpg: Note: signature key 9D760D4D has been revoked
> gpg: Note: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
> gpg: using subkey 6F576472 instead of primary key C5779A1C
> gpg: writing to '/home/srivasta/.login.asc'
> gpg: signing failed: No secret key
> gpg: /home/srivasta/.login: clearsign failed: No secret key
> [1]    1767 exit 2     gpg2 -vvv --clearsign ~/.login

This response suggests that you might be using gpg2 2.1.x (it finds the
agent while GPG_AGENT_INFO is unset, without specifying
--use-standard-socket), but your secret keys have not been imported.
does /home/srivastava/lib/.sec/private-keys-v1.d/ contain the keygrip of
the secret key you need to use?

the keygrip for your signing-capable subkey 0x36BD720F6F576472 is
4AA76328759B16116F1C2F3380A3C313A1398F34 (you can find this with "gpg2
--with-keygrip --list-keys 0x36BD720F6F576472), so i'd expect there to
be a file at:

 /home/srivastava/lib/.sec/private-keys-v1.d/4AA76328759B16116F1C2F3380A3C313A1398F34.key

If that doesn't exist, and you're using gpg 2.1.x, can you try importing
your gpgv1 secret keyring again and then retrying your command?

   gpg2 --import < /home/srivastava/lib/.sec/secring.gpg


If this solves things for you, i'd still like to understand why the
secret keyring didn't get imported automatically the first time you used
gpg 2.1.x.  Can you tell me any history of how and when (what versions?)
you first moved to 2.1.x ?

>> gpg -vvv --clearsign ~/.login
> gpg: using character set `utf-8'
> gpg: using PGP trust model
> gpg: key C5779A1C: accepted as trusted key
> gpg: can't handle public key algorithm 22
> gpg: can't handle public key algorithm 19
> gpg: error checking usability status of C7261095
> gpg: key C7261095: secret key without public key - skipped
> gpg: NOTE: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
> gpg: NOTE: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
> gpg: no secret subkey for public subkey 840A4306 - ignoring
> gpg: using subkey 6F576472 instead of primary key C5779A1C
>
> You need a passphrase to unlock the secret key for
> user: "Manoj Srivastava <srivasta@golden-gryphon.com>"
> gpg: NOTE: signature key 840A4306 expired Wed 11 May 2011 02:33:47 PM PDT
> gpg: using subkey 6F576472 instead of primary key C5779A1C
> 2048-bit RSA key, ID 6F576472, created 2009-07-23 (main key ID C5779A1C)
>
> gpg: gpg-agent is not available in this session
> You need a passphrase to unlock the secret key for
> user: "Manoj Srivastava <srivasta@golden-gryphon.com>"
> 2048-bit RSA key, ID 6F576472, created 2009-07-23 (main key ID C5779A1C)
>
> gpg: writing to `/home/srivasta/.login.asc'
> gpg: RSA/SHA512 signature from: "6F576472 Manoj Srivastava <srivasta@golden-gryphon.com>"

This shows you not using the gpg-agent at all.

>  ps auwwx | egrep '[g]pg-agent'
> srivasta 24911  0.0  0.0 165000  2180 ?        SNs  00:39   0:00 gpg-agent --daemon --enable-ssh-support --allow-preset-passphrase --no-allow-external-cache

OK, so the agent is running, but it's not clear what started it.  I
suspect it's likely that it was auto-launched by gpg 2.1.x.

Regards,

     --dkg

Message #77 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

To: Thorsten Glaser <tg@mirbsd.de>, 796931@bugs.debian.org, control@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 17 Feb 2016 14:45:28 -0500

[Message part 1 (text/plain, inline)]

severity 796931 normal
thanks

On Tue 2015-08-25 17:29:05 -0400, Thorsten Glaser wrote:
> since one of the recent upgrades, gpg-agent no longer writes its
> environment file. This is a rather bad regression for my setup,
> which uses the env file for sharing a gpg-agent across all (both
> SSH and local console or X11) sessions of one user (i.e. that
> particular sharing now becomes impossible).

For GnuPG's modern suite (2.1.x), the gpg-agent will always be
automatically launched, and will be shared by users on the system
system.  There is no need for $GNUPGHOME/gpg-agent-info-$(hostname),
because they will all use $GNUPGHOME/S.gpg-agent as the standard socket.

Trying to pair this with gpg from the "classic" suite (1.4.x) is
slightly more awkward, because:

 a) gpg 1.4.x does not auto-launch the agent, and
 b) gpg 1.4.x relies on GPG_AGENT_INFO to be explicitly set

I don't want to overengineer solutions for gpg 1.4.x because the plan
for gpg 1.4.x is to make it gpg1, and have /usr/bin/gpg supplied
directly by the modern gpg.  That said, all that's needed for gpg 1.4.x
to work (assuming "use-agent" has been set in gpg.conf) is to ensure the
agent is running (e.g. "gpg-connect-agent /bye" or "gpgconf --launch
gpg-agent"), and to ensure that GPG_AGENT_INFO is set explicitly to
$GNUPGHOME/S.gpg-agent:0:1

For ssh, the situation is similar: a standard socket will be used
($GNUPGHOME/S.gpg-agent.ssh), and the OpenSSH tools need to be informed
about it via the SSH_AUTH_SOCK environment variable.

So I think all of this boils down to:

 gpgconf --launch gpg-agent
 export GPG_AGENT_INFO=$HOME/.gnupg/S.gpg-agent:0:1
 if [ -n "$(gpgconf --list-options gpg-agent | awk -F: '/^enable-ssh-support:/{ print $10 }')" ]; then
    export SSH_AUTH_SOCK=$HOME/.gnupg/S.gpg-agent.ssh
 fi

I think this is a plausible workaround for the use cases described in
this bug, and it should be pretty simple.

Please let me know how this works for you.  I don't think anyone should
need any gpg-agent-info-$(hostname) file at all to support the use case
you describe.

       --dkg

[signature.asc (application/pgp-signature, inline)]

Message #84 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <tg@mirbsd.de>

To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

Cc: 796931@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 17 Feb 2016 21:30:47 +0000 (UTC)

Daniel Kahn Gillmor dixit:

>Please let me know how this works for you.  I don't think anyone should

Didn’t I already post the code I’m using now, which works around
this bug?

bye,
//mirabilos
-- 
Stéphane, I actually don’t block Googlemail, they’re just too utterly
stupid to successfully deliver to me (or anyone else using Greylisting
and not whitelisting their ranges). Same for a few other providers such
as Hotmail. Some spammers (Yahoo) I do block.

Message #89 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

To: Thorsten Glaser <tg@mirbsd.de>

Cc: 796931@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 02 Mar 2016 08:39:18 +0100

On Wed 2016-02-17 22:30:47 +0100, Thorsten Glaser wrote:
> Daniel Kahn Gillmor dixit:
>
>>Please let me know how this works for you.  I don't think anyone should
>
> Didn’t I already post the code I’m using now, which works around
> this bug?

yes, there's a complex script at

https://evolvis.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=shellsnippets/shellsnippets.git;a=blob;f=posix/sysadmin/agents.sh;h=485f025a5171a0721bb0cb10c3676f96393715f3;hb=HEAD

But I was trying to describe a simple workaround in the bug log itself
for those who might stumble across this bug later.  If you don't want to
tinker with your setup further, i completely understand.

Thanks for your help with debugging the issue and describing your own
solutions!

Regards,

          --dkg

Message #94 received at 796931@bugs.debian.org (full text, mbox, reply):

From: Thorsten Glaser <tg@mirbsd.de>

To: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

Cc: 796931@bugs.debian.org

Subject: Re: [pkg-gnupg-maint] Bug#796931: gnupg-agent: no longer writes $GNUPGHOME/gpg-agent-info-$(hostname) file

Date: Wed, 2 Mar 2016 20:30:10 +0000 (UTC)

Daniel Kahn Gillmor dixit:

>But I was trying to describe a simple workaround in the bug log itself
>for those who might stumble across this bug later.  If you don't want to
>tinker with your setup further, i completely understand.

OK, that’s fair, thanks.

>Thanks for your help with debugging the issue and describing your own
>solutions!

You’re welcome!

bye,
//mirabilos
-- 
Stéphane, I actually don’t block Googlemail, they’re just too utterly
stupid to successfully deliver to me (or anyone else using Greylisting
and not whitelisting their ranges). Same for a few other providers such
as Hotmail. Some spammers (Yahoo) I do block.

Send a report that this bug log contains spam.