Arch Linux

wetTshirt

Member

Registered: 2014-10-17

Posts: 20

[SOLVED] gpg secret key access not possible

Hi guys

I hope someone can help me or has the same issue and knows the solution. Since today I can not access my kwallet anymore. Assuming the issue in kwallet first I now already know that the issue is laying deeper in the gpg system. I broke the problem down to not be able to access the secret keys anymore. While all secret keys are listed in gpg the access is not possible. Trying via CLI to decrypt a message with a secret key I get following error message

[kk@excelsior]$ gpg -vvv --output test.txt.gpg.txt --decrypt test.txt.gpg 
gpg: using character set 'iso-8859-1'
# off=0 ctb=84 tag=1 hlen=2 plen=94
:pubkey enc packet: version 3, algo 18, keyid AXXXXXXXXXXXXXX
        data: [263 bits]
        data: [392 bits]
gpg: public key is AXXXXXXXXXXXXXX
gpg: using subkey AXXXXXXXXXXXXXX instead of primary key AXXXXXXXXXXXXXX
# off=96 ctb=d2 tag=18 hlen=2 plen=182 new-ctb
:encrypted data packet:
        length: 182
        mdc_method: 2
gpg: using subkey AXXXXXXXXXXXXXX instead of primary key AXXXXXXXXXXXXXX
gpg: encrypted with 255-bit ECDH key, ID AXXXXXXXXXXXXXX, created 2021-03-12
      "wetTshirt <AXXXXXXXXXXXXXX@AXXXXXXXXXXXXXX.com>"
gpg: public key decryption failed: No pinentry
gpg: decryption failed: No secret key

I tried to fix the missing pinentry by adjusting the ~/.gnupg/gpg-agent.conf as following:

default-cache-ttl 1
pinentry-program /usr/bin/pinentry-qt

###+++--- GPGConf ---+++###
debug-level basic
log-file socket:///home/kk/.gnupg/log-socket
###+++--- GPGConf ---+++### So 04 Okt 2020 22:33:36 CEST
# GPGConf edited this configuration file.
# It will disable options before this marked block, but it will
# never change anything below these lines.

I also reinstalled the pinentry package and ensured that the links are correct:

[kk@excelsior]$ ls -liah /usr/bin/pinentry*
45410269 -rwxr-xr-x 1 root root  369 Sep 19 20:53 /usr/bin/pinentry
45410270 -rwxr-xr-x 1 root root  75K Sep 19 20:53 /usr/bin/pinentry-curses
45410271 -rwxr-xr-x 1 root root  67K Sep 19 20:53 /usr/bin/pinentry-emacs
45410272 -rwxr-xr-x 1 root root  87K Sep 19 20:53 /usr/bin/pinentry-gnome3
45410273 -rwxr-xr-x 1 root root  95K Sep 19 20:53 /usr/bin/pinentry-gtk-2
45410274 -rwxr-xr-x 1 root root 159K Sep 19 20:53 /usr/bin/pinentry-qt
45410275 -rwxr-xr-x 1 root root  67K Sep 19 20:53 /usr/bin/pinentry-tty

Nevertheless no success. Still same error message. Does anyone has an idea?

Last edited by wetTshirt (2022-03-05 14:33:37)

danrees

Member

Registered: 2021-10-10

Posts: 4

Re: [SOLVED] gpg secret key access not possible

Did you reload the GPG agent?

gpg-connect-agent reloadagent /bye

https://superuser.com/questions/520980/ … -passwords

wetTshirt

Member

Registered: 2014-10-17

Posts: 20

Re: [SOLVED] gpg secret key access not possible

Yes, reloaded the agent, rebooted the system. Everything without success.

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,261

Re: [SOLVED] gpg secret key access not possible

Does any of the other pinentry programs (eg. gtk2) work?
Can you run "echo GETPIN | pinentry-qt"? If not, does it work if you use "regular" IO (run pinentry-qt and then enter GETPIN at its prompt)?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

wetTshirt

Member

Registered: 2014-10-17

Posts: 20

Re: [SOLVED] gpg secret key access not possible

Thanks for the hint. I think I found the solution:

[kk@excelsior ~]$ echo GETPIN | pinentry-qt
pinentry-qt: error while loading shared libraries: libtss2-esys.so.0: cannot open shared object file: No such file or directory

Looks like something is missing.

[kk@excelsior ~]$ sudo pacman -Fy
:: Synchronizing package databases...
[kk@excelsior ~]$ pacman -F libtss2-esys.so.0
community/tpm2-tss 3.2.0-1
    usr/lib/libtss2-esys.so.0
[kk@excelsior ~]$ sudo pacman -S tpm2-tss

And now finally it's working again. I'm not sure why and how this happened and if I am the only one but for me it looks like a dependency is missing in the gnupg package (or maybe somewhere else). Should I file a bug report for that?

merlock

Member

Registered: 2018-10-30

Posts: 262

Re: [SOLVED] gpg secret key access not possible

@wetTshirt:  when was the last time you did a proper (pacman -Syu) update?

tpm2-tss was a new dependency of libsecret; I pulled it in on an update, on/about 25 Feb 2022.

---

Eenie meenie, chili beanie, the spirits are about to speak -- Bullwinkle J. Moose
It's a big club...and you ain't in it -- George Carlin
Registered Linux user #149839
perl -e 'print$i=pack(c5,(41*2),sqrt(7056),(unpack(c,H)-2),oct(115),10); '

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,261

Re: [SOLVED] gpg secret key access not possible

Also please always remember to mark resolved threads by editing your initial posts subject - so others will know that there's no task left, but maybe a solution to find.
Thanks.

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

wetTshirt

Member

Registered: 2014-10-17

Posts: 20

Re: [SOLVED] gpg secret key access not possible

@merlock pacman -Syu is executed every day but this package was not installed automatically.

@seth Thanks for reminder, will do

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: [SOLVED] gpg secret key access not possible

Well pinentry depends on libsecret, which depends on tpm2-tss, so for it not to be pulled in pretty much comes down to partial updates. What does `pacman -Qi pinentry libsecret` return?

wetTshirt

Member

Registered: 2014-10-17

Posts: 20

Re: [SOLVED] gpg secret key access not possible

Partial updates are surprising because I always actively start a full system update. Would be interesting to find out the reason for this.

[kk@excelsior ~]$ sudo pacman -Qi pinentry libsecret
[sudo] password for kk: 
Name            : pinentry
Version         : 1.2.0-1
Description     : Collection of simple PIN or passphrase entry dialogs which utilize the Assuan protocol
Architecture    : x86_64
URL             : https://gnupg.org/related_software/pinentry/
Licenses        : GPL
Groups          : None
Provides        : None
Depends On      : glibc  ncurses  libcap  libassuan  libsecret  glib2  libsecret-1.so=0-64  libcap.so=2-64  libncursesw.so=6-64  libassuan.so=0-64  libglib-2.0.so=0-64
Optional Deps   : gtk2: gtk2 backend [installed]
                  qt5-base: qt backend [installed]
                  gcr: gnome3 backend [installed]
Required By     : gnupg
Optional For    : None
Conflicts With  : None
Replaces        : None
Installed Size  : 563.46 KiB
Packager        : Levente Polyak <anthraxx@archlinux.org>
Build Date      : Sun Sep 19 20:53:53 2021
Install Date    : Thu Feb 24 22:00:15 2022
Install Reason  : Installed as a dependency for another package
Install Script  : No
Validated By    : Signature

Name            : libsecret
Version         : 0.20.5-1
Description     : Library for storing and retrieving passwords and other secrets
Architecture    : x86_64
URL             : https://wiki.gnome.org/Projects/Libsecret
Licenses        : LGPL
Groups          : None
Provides        : libsecret-1.so=0-64
Depends On      : glib2  libgcrypt  tpm2-tss
Optional Deps   : org.freedesktop.secrets: secret storage backend [installed]
Required By     : darktable  gcr  gnome-disk-utility  gnome-online-accounts  pinentry  qtkeychain-qt5  vlc  webkit2gtk
Optional For    : git  system-config-printer
Conflicts With  : None
Replaces        : None
Installed Size  : 1191.17 KiB
Packager        : Jan Alexander Steffens (heftig) <heftig@archlinux.org>
Build Date      : Mon Feb 21 20:18:00 2022
Install Date    : Thu Feb 24 20:59:29 2022
Install Reason  : Installed as a dependency for another package
Install Script  : No
Validated By    : Signature

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: [SOLVED] gpg secret key access not possible

so they are up to date, and libsecret clearly depends on the package. How about `pacman -Qs tpm2`

wetTshirt

Member

Registered: 2014-10-17

Posts: 20

Re: [SOLVED] gpg secret key access not possible

[kk@excelsior ~]$ sudo pacman -Qs tpm2
[sudo] password for kk: 
local/tpm2-tss 3.2.0-1
    Implementation of the TCG Trusted Platform Module 2.0 Software Stack (TSS2)

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,261

Re: [SOLVED] gpg secret key access not possible

He installed/updated the package, see #5
COuld have been an out-of-sync mirror?

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: [SOLVED] gpg secret key access not possible

seth, I'm aware they installed it, I was wondering if they had anything else that provided it.

wetTshirt, that covers the easy things without an answer, so the only option left is going over your pacman log.

wetTshirt

Member

Registered: 2014-10-17

Posts: 20

Re: [SOLVED] gpg secret key access not possible

I can for sure provide the log if it helps. But if this is nothing severe of general interest I don't want to waste your time. On my system it's fixed, that was important for me and I couldn't fine anyone else with this problem.

If this is an mirror issue that it's one of the following:

[kk@excelsior ~]$ cat /etc/pacman.d/mirrorlist
# Server list generated by rankmirrors on 2022-02-14
################################################################################
################# Arch Linux mirrorlist generated by Reflector #################
################################################################################
# With:       reflector --verbose --latest 5 --country Germany --age 12 --protocol https --sort rate --save /etc/pacman.d/mirrorlist
# When:       2021-01-04 20:39:09 UTC
# From:       https://www.archlinux.org/mirrors/status/json/
# Retrieved:  2021-01-04 20:39:03 UTC
# Last Check: 2021-01-04 20:12:10 UTC
# Server = https://phinau.de/arch/$repo/os/$arch
Server = https://mirror.pkgbuild.com/$repo/os/$arch
Server = https://dist-mirror.fem.tu-ilmenau.de/archlinux/$repo/os/$arch
Server = https://mirror.f4st.host/archlinux/$repo/os/$arch
Server = https://ftp.halifax.rwth-aachen.de/archlinux/$repo/os/$arch

Last edited by wetTshirt (2022-03-05 14:57:45)

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,261

Re: [SOLVED] gpg secret key access not possible

The takeaway could be to revisit your mirror management (eg. running reflector once a day or so)

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

Scimmia

Fellow

Registered: 2012-09-01

Posts: 13,729

Re: [SOLVED] gpg secret key access not possible

I'm pretty sure this is something specific to your system, not something of general interest. I'd be willing to take a look at the log, but it's up to you.

This isn't something that can be caused by the mirrorlist. If it was, pacman would have errored out not being able to find the dep.