You are not logged in.
I do not want to necrobump, but this very brief thread alludes to what I am looking for.
My current ~/.mutt/gpg.rc, copy-pasted from /usr/share/docs/mutt/sample/gpg.rc
# -*-muttrc-*-
#
# Command formats for gpg.
#
# This version uses gpg-2comp from
# http://70t.de/download/gpg-2comp.tar.gz
#
# $Id$
#
# %p The empty string when no passphrase is needed,
# the string "PGPPASSFD=0" if one is needed.
#
# This is mostly used in conditional % sequences.
#
# %f Most PGP commands operate on a single file or a file
# containing a message. %f expands to this file's name.
#
# %s When verifying signatures, there is another temporary file
# containing the detached signature. %s expands to this
# file's name.
#
# %a In "signing" contexts, this expands to the value of the
# configuration variable $pgp_sign_as. You probably need to
# use this within a conditional % sequence.
#
# %r In many contexts, mutt passes key IDs to pgp. %r expands to
# a list of key IDs.
# Note that we explicitly set the comment armor header since GnuPG, when used
# in some localiaztion environments, generates 8bit data in that header, thereby
# breaking PGP/MIME.
# decode application/pgp
set pgp_decode_command="gpg --status-fd=2 %?p?--passphrase-fd 0? --no-verbose --quiet --batch --output - %f"
# verify a pgp/mime signature
set pgp_verify_command="gpg --status-fd=2 --no-verbose --quiet --batch --output - --verify %s %f"
# decrypt a pgp/mime attachment
set pgp_decrypt_command="gpg --status-fd=2 %?p?--passphrase-fd 0? --no-verbose --quiet --batch --output - %f"
# create a pgp/mime signed attachment
# set pgp_sign_command="gpg-2comp --comment '' --no-verbose --batch --output - %?p?--passphrase-fd 0? --armor --detach-sign --textmode %?a?-u %a? %f"
set pgp_sign_command="gpg --no-verbose --batch --quiet --output - %?p?--passphrase-fd 0? --armor --detach-sign --textmode %?a?-u %a? %f"
# create a application/pgp signed (old-style) message
# set pgp_clearsign_command="gpg-2comp --comment '' --no-verbose --batch --output - %?p?--passphrase-fd 0? --armor --textmode --clearsign %?a?-u %a? %f"
set pgp_clearsign_command="gpg --no-verbose --batch --quiet --output - %?p?--passphrase-fd 0? --armor --textmode --clearsign %?a?-u %a? %f"
# create a pgp/mime encrypted attachment
# set pgp_encrypt_only_command="pgpewrap gpg-2comp -v --batch --output - --encrypt --textmode --armor --always-trust -- -r %r -- %f"
set pgp_encrypt_only_command="pgpewrap gpg --batch --quiet --no-verbose --output - --encrypt --textmode --armor --always-trust -- -r %r -- %f"
# create a pgp/mime encrypted and signed attachment
# set pgp_encrypt_sign_command="pgpewrap gpg-2comp %?p?--passphrase-fd 0? -v --batch --output - --encrypt --sign %?a?-u %a? --armor --always-trust -- -r %r -- %f"
set pgp_encrypt_sign_command="pgpewrap gpg %?p?--passphrase-fd 0? --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --always-trust -- -r %r -- %f"
# import a key into the public key ring
set pgp_import_command="gpg --no-verbose --import %f"
# export a key from the public key ring
set pgp_export_command="gpg --no-verbose --export --armor %r"
# verify a key
set pgp_verify_key_command="gpg --verbose --batch --fingerprint --check-sigs %r"
# read in the public key ring
set pgp_list_pubring_command="gpg --no-verbose --batch --quiet --with-colons --list-keys %r"
# read in the secret key ring
set pgp_list_secring_command="gpg --no-verbose --batch --quiet --with-colons --list-secret-keys %r"
# fetch keys
# set pgp_getkeys_command="pkspxycwrap %r"
# pattern for good signature - may need to be adapted to locale!
# set pgp_good_sign="^gpgv?: Good signature from "
# OK, here's a version which uses gnupg's message catalog:
# set pgp_good_sign="`gettext -d gnupg -s 'Good signature from "' | tr -d '"'`"
# This version uses --status-fd messages
set pgp_good_sign="^\\[GNUPG:\\] GOODSIG"My ~/mutt/options.encryption file, where the real action is.
set pgp_auto_decode = yes
send-hook "~f @work.tld" set pgp_autosign = no
send-hook "~f @personal.tld" set pgp_autosign = yes
#set pgp_create_traditional = yes
set pgp_replysign = yes
set pgp_replyencrypt = yes
set crypt_replysignencrypted = yes
set crypt_verify_sig = yes
send-hook "~f @personal.tld" set pgp_sign_as=12345678
set pgp_use_gpg_agent = yesI have tried playing with the --passphrase-fd options and I clearly edit them wrong, because it causes more problems and the commands fail to execute. I tried finding other forum posts with a spelled out gpg.rc with the --passphrase-fd option properly missing. I have also played with this in conjunction with pgp_timeout = 0, and it does not help.
Thoughts? I am embarassed I cannot figure this out, but all I want is mutt to use, and only use, the gpg-agent I have setup in systemctl-user process and not prompt or cache the answer on its end.
Last edited by ajstein (2014-06-28 09:14:09)
Offline
Do I understand you correctly, you want mutt to use gpg-agent and not enter the password everytime?
If so, I had a similar issue just now and these are the things I came up with (not running arch, but hey, it might help someone):
I want to use mutt to use msmtp to send mail with the password to the account stored in a gpg encrypted file. After a long and finally lucky search, I was able to gather that my gpg version 1.4.14 (lubuntu) did not get gpg-agent to store a symmetric cipher encrypted passphrase. That means a 'gpg -c file' supplied passphrase was not remembered with gpg-agent. That feature seems to have been added around v1.4.16, at least that version does store both passphrases. Also tested a gpg2 version, can't remeber which one, though, that works as well.
What did work was using an (a)symmetric key-pair to encrypt that file, using 'gpg -e file' or 'gpg --symmetric -e file'. You have to specify your own key to sign the file when prompted or use the '-r <key>' option.
These are my gpg.conf settings, important is 'use-agent':
keyserver hkp://keys.gnupg.net
keyserver-options auto-key-retrieve
use-agent
utf8-strings
auto-key-locate local
personal-digest-preferences SHA256
cert-digest-algo SHA256
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
personal-cipher-preferences TWOFISH AES256 AES192 CAMELLIA256 CAMELLIA192 CAMELLIA128 AES CAST5gpg-agent.conf:
default-cache-ttl 3600
max-cache-ttl 7200
ignore-cache-for-signing
# pinentry-curses does not work with mutt, use some graphical version, e.g.
# pinentry-gtk-2, pinentry-x11 or pinentry-qt4, if system does not use the right one automatically
#pinentry-program /usr/bin/pinentry-gtk-2In order for mutt to use gpg-agent, I have the following pgp_* related options in my .muttrc:
# this command is yet untested, hence commented:
#set pgp_decode_command="gpg %?p?--passphrase-fd 0? --no-verbose --batch --output - %f"
set pgp_verify_command="gpg --no-verbose --batch --output - --verify %s %f"
set pgp_decrypt_command="gpg --passphrase-fd 0 --no-verbose --batch --output - %f"
set pgp_sign_command="gpg --no-verbose --batch --output - --passphrase-fd 0 --armor --detach-sign --textmode %?a?-u %a? %f"
set pgp_clearsign_command="gpg --no-verbose --batch --output - --passphrase-fd 0 --armor --textmode --clearsign %?a?-u %a? %f"
# maybe insert your own keys '0xF..' here
set pgp_encrypt_only_command="/usr/lib/mutt/pgpewrap gpg --batch --quiet --no-verbose --output \- --encrypt --textmode --armor --always-trust --encrypt-to <enter-key-here> -- -r %r -- %f"
set pgp_encrypt_sign_command="/usr/lib/mutt/pgpewrap gpg --passphrase-fd 0 --batch --quiet --no-verbose --textmode --output - --encrypt --sign %?a?-u %a? --armor --always-trust --encrypt-to <enter-key-here> -- -r %r -- %f"
set pgp_import_command="gpg --no-verbose --import -v %f"
set pgp_export_command="gpg --no-verbose --export --armor %r"
set pgp_verify_key_command="gpg --no-verbose --batch --fingerprint --check-sigs %r"
set pgp_list_pubring_command="gpg --no-verbose --batch --with-colons --list-keys %r"
set pgp_list_secring_command="gpg --no-verbose --batch --with-colons --list-secret-keys %r"
# let gpg-agent take care of already supplied passphrases
set pgp_use_gpg_agent = yes
#set pgp_timeout=3600
#set pgp_autosign=yes
set pgp_replysign=yes
set pgp_verify_sig=yes
set pgp_replyencrypt=yesThis way I when sending the first encrypted/signed email, I am prompted for the pass and gpg-agent stores it. In case you want to be prompted for the pass when launching mutt, try setting
set my_msmtp_pass=`gpg --decrypt --quiet --no-tty ~/.msmtp.password.gpg`in your muttrc as well to decrypt the file right away. I yet have to test all the gpg related stuff, but the password will be available via gpg-agent. Make sure you have 'pgp_use_gpg_agent = yes' set.
Sample .msmtprc syntax:
auth on
account ACCNAME
user me
host mail.somerandommailer
from me@somerandommailer
passwordeval gpg --decrypt --quiet --no-tty ~/.msmtp.password.gpgCode and file location untested for arch, as this is a *buntu system … yet.
Maybe this is useful for someone else.
Edit: here is some nice in depth info and mentioning of gpgme, maybe that helps clear up issues with all the pgp_* stuff as well …
http://blog.sanctum.geek.nz/tag/mutt/
Last edited by justatempname (2014-05-17 13:52:13)
Offline
Sorry, long time to wait for a reply. I had to time to look at this during the weekend and discovered, especially since GPGME is up and running with mutt (or more specifically AUR/mutt-kz package which I have subsequently moved to in conjunction with notmuch package) that I can use GPGME directly. I am pretty sure, since GPGME was part of my core Arch install a while back (I looked into what it was not sure how it was different from gpg as I knew, now I am pleasantly surprised).
I checked like so.
[me@laptop ~]$ mutt -v | grep -i GPGME
Configure options: '--enable-notmuch' '--prefix=/usr' '--sysconfdir=/etc' '--enable-gpgme' '--enable-pop' '--enable-imap' '--enable-smtp' '--enable-pgp' '--enable-hcache' '--with-curses=/usr' '--with-regex' '--with-gss=/usr' '--with-ssl=/usr' '--with-sasl' '--with-idn' 'CFLAGS=-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector --param=ssp-buffer-size=4' 'LDFLAGS=-Wl,-O1,--sort-common,--as-needed,-z,relro' 'CPPFLAGS=-D_FORTIFY_SOURCE=2'
+CRYPT_BACKEND_CLASSIC_PGP +CRYPT_BACKEND_CLASSIC_SMIME +CRYPT_BACKEND_GPGMEAnd now I have this updated, and much simpler configuration file for encryption options.
set pgp_auto_decode = yes
send-hook "~f @work.tld" set pgp_autosign = no
send-hook "~f @personal.tld" set pgp_autosign = yes
set pgp_replysign = yes
set pgp_replyencrypt = yes
set crypt_replysignencrypted = yes
set crypt_verify_sig = yes
send-hook "~f @personal.tld" set pgp_sign_as=12345678
set pgp_use_gpg_agent = yes
set crypt_use_gpgme = yes
It does complain that gpg-agent is not running like so (even if it is, I run it through systemctl --user directives, cache config to file, and it eval with each run of .bashrc):
Using GPGME backend, although no agent is running
Press any key to continue...
It does in fact work. Much, much better than before in initial testing. Regardless, I will mark this solved. I found very good, to-the-point information on the Arabesque blog referenced above. That got me where I needed. Thanks for posting the link. Here is the specific article I read.
http://blog.sanctum.geek.nz/linux-crypto-email/
UPDATE: Turns out the reason for the backend and no agent error was how I was sourcing, and not properly exporting, the GPG_AGENT_INFO. That is independent of this issue. The solution is definitely what I was looking for. Thanks for your help everyone. Hope someone can use this later on.
Last edited by ajstein (2014-06-28 15:33:57)
Offline
Hello, sorry for bumping this
I've found the solution for mutt&gpgme - add
export GPG_AGENT_INFO=$HOME/.gnupg/S.gpg-agentto .bashrc/.zshrc/.profile
Offline