[solved]kwallet complains about gpg after update/pinentry not starting

kazimir · 2015-12-11 00:26:57

Hi guys,

I'm using kde with kmail passwords stored in kwallet secured with gpg instead of the regular blowfish.

I just updated my system with pacman -Syu and rebooted.
Now instead of pinentry asking for my gpg passphrase, kwallet fails to open complaining about gpg with the following error:

Error decrypting message:  Decryption failed , code  152 , source  GPGME

Searching the web for this error doesn't return any obvious relevant info.
Looking into pacman logs, I noticed that both kwallet, kwalletmanager and pinentry have been upgraded so for lack of a better lead and time to investigate I downgraded those 3 and I'm reported this here. Hopefully someone more knowledgeable than me will be able to look into this.

For reference here are the downgraded versions that work:

warning: downgrading package kwallet (5.16.0-2 => 5.16.0-1)
warning: downgrading package kwalletmanager (15.08.3-2 => 15.08.3-1)
warning: downgrading package pinentry (0.9.7-1 => 0.9.5-2)

-edit-
Problem came from an obsolete package, kde-agent, removing it fixes the issue.
-/edit-

Last edited by kazimir (2015-12-18 22:34:58)

arojas · 2015-12-11 07:22:20

What's your pinentry-program in ~/.gnupg/gpg-agent.conf ?

kazimir · 2015-12-12 08:18:35

There's no pinentry-program specified in gpg-agent.conf only debug level and log-file, so according to man gpg-agent I'm using the default pinentry.

Last edited by kazimir (2015-12-12 08:25:22)

CarlEitsger · 2015-12-12 11:32:31

possibly I am experiencing the same (since 10th December when I updated) with thunderbird and the enigmail plugin (running on KDE plasma 4). Starting the pinentry dialog fails. A workaround (which I also had to use at 2nd October) is to

killall gpg-agent

. Then the dialog works upon next invoation by enigmail. I also have no pinentry specified in my gpg-agent.conf. Sadly, I do not remember what cured the problem after 2nd October.

downgrading to pinentry-0.9.5-2 is a workaround for the problem for me too. According to the window title the dialog is "pinentry-qt4" (which is apparently included in the pinentry packagage).

back again to pinentry-0.9.7-1:
specifying a pinentry program as listed as an option at https://wiki.archlinux.org/index.php/GnuPG#pinentry did not help: "pinentry-program /usr/bin/pinentry-qt4" or "pinentry-program /usr/bin/pinentry-gtk-2" did not work (restarting the whole system after each change).

arojas · 2015-12-12 11:48:11

CarlEitsger wrote:

downgrading to pinentry-0.9.5-2 is a workaround for the problem for me too. According to the window title the dialog is "pinentry-qt4" (which is apparently included in the pinentry packagage).

pinentry-qt4 has been renamed to pinentry-qt. You need to change it in gpg-agent.conf

kazimir · 2015-12-12 14:03:45

-edit-

Sorry, somehow I forgot my manners. So before all, thank you! This is exactly why pinentry is suddenly broken and I was able to work around the issue on my box.

-/edit-

I upgraded again and I can confirm that the upgrade renames pinentry-qt4 to pinentry-qt. A simple soft-link of /usr/bin/pinentry-qt to /usr/bin/pinentry-qt4 fixes the issue, pointing to the binary renaming not being taken into account for the default when nothing is specified in gpg-agent.conf

I disagree that the change needs to be done in gpg-agent.conf, the upgrade breaks something that was working. The solution is to fix the default value to reflect the renaming.

I don't know where to report this for an upstream fix, can someone help ?

Last edited by kazimir (2015-12-12 14:41:48)

The Infinity · 2015-12-12 14:16:16

I've just had the same issue (pinentry not showing).
However, I think changing the gpg-agent.conf is the right way fix it. It makes no sense to have a binary called "pinentry-qt4" which is actually using Qt 5.

kazimir · 2015-12-12 14:45:44

I agree that having a link to pinentry-qt4 is not the way to fix this, it was simply a way to test if as I suspected the issue was a bad default in gpg-agent.

The correct way is to fix the broken default in gpg-agent upstream.

The Infinity · 2015-12-12 17:29:35

I've just updated the Wiki section about pinentry.

I suspected the issue was a bad default in gpg-agent

Is the Qt version really the default? I think the default is the GTK version.

(https://wiki.archlinux.org/index.php/GnuPG#pinentry)

CarlEitsger · 2015-12-12 21:27:03

arojas wrote:

pinentry-qt4 has been renamed to pinentry-qt. You need to change it in gpg-agent.conf

Thank you, I've tried to set this explicitly in gpg-agent.conf but it seems not to change anything for me. I will look into it again in some days - maybe tomorrow after ditching my beloved plasma4 ;-) (thanks for your news about it, Antonio)

The Infinity · 2015-12-12 22:49:59

Very strange. Using pinentry-qt instead of pinentry-qt4 works for me. Did you reload the agent? Are you sure you didn't edited the wrong file (eg. by calling vim ~/.gnupg/gpg-agent.conf accidentally as root/wrong user)? Does creating a symlink (as kazimir described) work for you?

Last edited by The Infinity (2015-12-12 22:51:13)

CarlEitsger · 2015-12-13 11:14:59

yes, I have definitely set "pinentry-program /usr/bin/pinentry-qt" in the ~/.gnupg/gpg-agent.conf with the right user. I simply restart the whole system after each change, so, yes, the agent would be reloaded.

creating a link (ln -s pinentry-qt pinentry-qt4) in /usr/bin works: "pinentry-qt" shows a dialog.

So it seems that the ~/.gnupg/gpg-agent.conf is not read (or read and later overwritten) - whyever. Okay, it is running with this command (as indicated by "ps"): "/usr/bin/gpg-agent -s --daemon --pinentry-program /usr/bin/pinentry-qt4 --write-env-file". That makes it clear why the entry in the conf file is not respected. But I could not yet find out what starts it like this.

kazimir · 2015-12-13 16:45:08

The Infinity wrote:

Is the Qt version really the default? I think the default is the GTK version.

My recent forray into this made me wonder about this.

man gpg-agent

Please  make sure that a proper pinentry program has been installed under the default filename (which is system depen-
dent) or use the option pinentry-program to specify the full name of that program.  It is often useful  to  install  a
symbolic  link from the actual used pinentry (e.g. `/usr/bin/pinentry-gtk') to the expected one (e.g. `/usr/bin/pinen-
try').

Looking into /usr/bin shows that the expected pinentry is linked to gtk version:

ll /usr/bin/pinentry
/usr/bin/pinentry -> pinentry-gtk-2

It could be that kwallet ignores system default, doesn't use the expected pinentry but calls directly on the pinentry-qt4 instead.

Anyways the window title is a dead giveaway that pinentry-qt4 is used and not pinentry-gtk-2

@CarlEitsger>

My ~/.gnupg/gpg-agent.conf contains a warning about some parts of the file being ignored:

 
###+++--- GPGConf ---+++### 
# GPGConf edited this configuration file.
# It will disable options before this marked block, but it will
# never change anything below these lines.

arojas · 2015-12-13 17:58:24

kazimir wrote:

It could be that kwallet ignores system default, doesn't use the expected pinentry but calls directly on the pinentry-qt4 instead.

There is no occurrence of the 'pinentry-qt4' string anywhere in the entire KDE source, so that can't be the issue
http://lxr.kde.org/search?_filestring=& … try-qt4%22

kazimir · 2015-12-14 06:42:00

I grepped through /etc and here it is:

/etc/kde/env/gpg-agent-startup.sh: eval "$(${GPG_AGENT} -s --daemon --pinentry-program /usr/bin/pinentry-qt4 --write-env-file)"

This config file belongs to kde-agent.

pacman -Qo /etc/kde/env/gpg-agent-startup.sh
/etc/kde/env/gpg-agent-startup.sh is owned by kde-agent 20140102-1

Last edited by kazimir (2015-12-14 06:50:19)

The Infinity · 2015-12-14 13:03:13

I don't have a package called kde-agent installed. It is no official package. Where does it come from?

kazimir · 2015-12-14 15:05:47

It comes from the official pacman repository but has been removed since, you can find it in the arch linux archive.

A little further research lead me to these:
[SOLVED] ssh-agent support removed from kde-agent
upgpkg: kde-agent 20140102-1 Get rid of the SSH agent, is not needed by KDE since years (archive.org mirror)
AUR Package Details: kde-agent-ssh 0.2-1 (archive.org mirror)
Remove kde-agent, it's been broken since gnupg 2.1 and nobody cares enough to fix it
FS#44689 - [kde-agent] Package has become useless

I also found a mention of kde-agent in the wiki article about ssh keys.

mpausch · 2015-12-15 17:34:52

had the same issue with Thunderbird/Enigmail not firing up pinentry dialogue.
removing kde-agent resolved this for me. Now gpg-agent gets started this way:

$ ps -ef | grep -i gpg
user1    993     1  0 18:30 ?        00:00:00 gpg-agent --homedir /home/user1/.gnupg --use-standard-socket --daemon

CarlEitsger · 2015-12-15 18:49:24

because I wrote above "But I could not yet find out what starts it like this." - yes, I also had the "kde-agent" package installed. Solved for me now. Looking more often for orphaned packages ("pacman -Qdt") would have paid off in this case, for me.

Thanks, all who worked on this!

Arch Linux

#1 2015-12-11 00:26:57

[solved]kwallet complains about gpg after update/pinentry not starting

#2 2015-12-11 07:22:20

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#3 2015-12-12 08:18:35

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#4 2015-12-12 11:32:31

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#5 2015-12-12 11:48:11

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#6 2015-12-12 14:03:45

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#7 2015-12-12 14:16:16

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#8 2015-12-12 14:45:44

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#9 2015-12-12 17:29:35

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#10 2015-12-12 21:27:03

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#11 2015-12-12 22:49:59

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#12 2015-12-13 11:14:59

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#13 2015-12-13 16:45:08

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#14 2015-12-13 17:58:24

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#15 2015-12-14 06:42:00

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#16 2015-12-14 13:03:13

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#17 2015-12-14 15:05:47

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#18 2015-12-15 17:34:52

Re: [solved]kwallet complains about gpg after update/pinentry not starting

#19 2015-12-15 18:49:24

Re: [solved]kwallet complains about gpg after update/pinentry not starting

Board footer