Keychain and gpg-agent not getting along

.:B:. · 2011-12-03 23:15:26

I have a problem with gpg-agent. I have been using the Funtoo keychain tool for a while, for my SSH keys exclusively. Works flawlessly - I log in, I call keychain, I type in my passphrases, and it caches my keys. Never get prompted for a passphrase during SSH connection attempts.

GPG is a different story. I have a GPG key, and I occasionally en- and decrypt files with it. So far so good. I also found out how to get keychain to cache the GPG key. It also picks up my gpg-agent, which is started as per the wiki entry (except that instead of putting it systemwide in /etc/profile.d, I put it in Openbox's ~/.config/openbox/environment file, which is where the SSH agent stuff is supposed to go as well.

Gpg-agent seemingly launches fine, it exports its environment variables just fine:

$ echo $GPG_AGENT_INFO
/tmp/gpg-3faT29/S.gpg-agent:2352:1

$ cat .gnupg/gpg-agent.env 
GPG_AGENT_INFO=/tmp/gpg-3faT29/S.gpg-agent:2352:1

There's only one gpg-agent process running:

$ ps aux|grep gpg-agent
luser     2352  0.0  0.0  16252  1184 ?        Ss   00:00   0:00 gpg-agent --daemon --write-env-file /home/stijn/.gnupg/gpg-agent.env
luser     3411  0.0  0.0   9276  1016 pts/0    S+   00:16   0:00 grep gpg-agent

Keychain picks that up as well:

$ keychain --eval

 * keychain 2.7.1 ~ http://www.funtoo.org
 * Found existing ssh-agent: 2346
SSH_AUTH_SOCK=/tmp/ssh-YhDgORoL2345/agent.2345; export SSH_AUTH_SOCK;
SSH_AGENT_PID=2346; export SSH_AGENT_PID;

 * Found existing gpg-agent: 2352
GPG_AGENT_INFO=/tmp/gpg-3faT29/S.gpg-agent:2352:1; export GPG_AGENT_INFO;

 * Known ssh key: /home/stijn/.ssh/id_rsa-amalthea
 * Known ssh key: /home/stijn/.ssh/id_rsa-athena
 * Known ssh key: /home/stijn/.ssh/id_rsa-zeus
 * Known ssh key: /home/stijn/.ssh/id_rsa-mnemosyne
 * Known gpg key: [8 digit hex key]

However, when I open Mutt (or just try to decrypt about any GPG encrypted file), it will prompt me for the passphrase, despite the key already being cached. Passing --use-agent does not help (I also set that in ~/.gnupg/gpg.conf).

The bizarre thing being, of course, that the keychain-cached key did not get picked up, but if I enter my passphrase into the prompt I get the first time I call gpg, it does seem to get cached - I can open mutt, decrypt files, etc., it will all use that cached key.

Any tips? I get the feeling I'm missing something, but couldn't find what exactly.

Last edited by .:B:. (2011-12-06 22:25:27)

.:B:. · 2011-12-04 23:23:33

Bump.

I have tested whether a gpg agent started by keychain itself improves the situation somewhat, but it does not. In fact, when I launch mutt now, it tells me there is no gpg-agent running. So it does not see the gpg agent at all.

Bump!

.:B:. · 2011-12-05 23:02:01

Bumpty.

/dev/zero · 2011-12-06 00:04:25

I've always found keychain to be a bit of a PITA. What happens if you disable keychain and just use gpg-agent by itself?

.:B:. · 2011-12-06 22:29:18

Gpg-agent by itself works fine, although I get the feeling that, a bit like sudo, there's an expiration date on the cached key - it seems I need to type the passphrase again after a few hours or so.

Either way, I'd love to get this working with keychain.

Arch Linux

#1 2011-12-03 23:15:26

Keychain and gpg-agent not getting along

#2 2011-12-04 23:23:33

Re: Keychain and gpg-agent not getting along

#3 2011-12-05 23:02:01

Re: Keychain and gpg-agent not getting along

#4 2011-12-06 00:04:25

Re: Keychain and gpg-agent not getting along

#5 2011-12-06 22:29:18

Re: Keychain and gpg-agent not getting along

Board footer