GPG: No pinentry

[ysndr]

Issue description

Changing pinentry-program to an alternative pinentry in ~/.gnupg/gpg-agent.conf results in gpg not being able to find the pinentry.
I specifically tried with pinentry-kwallet and pinentry-qt

Steps to reproduce

add

...
pinentry-program /home/<user>/.nix-profile/bin/pinentry-kwallet
...

to ~/.gnupg/gpg-agent.conf

(I don't really know which of these is actually necessary)

$ gpgconf --reload gpg-agent
$ gpg-connect-agent /bye

$ gpg-connect-agent <<EOT
GET_CONFIRMATION Hello
EOT

> ERR 67108949 No pinentry <GPG Agent>

Technical details

• system: "x86_64-linux"
• host os: Linux 4.9.82, NixOS, 17.09.3031.d09e425aea3 (Hummingbird)
• multi-user?: yes
• sandbox: no
• version: nix-env (Nix) 1.11.16
• channels(root): "nixos-unstable-18.03pre127921.9b25b9347d9, nixos-17.09.3031.d09e425aea3"
• nixpkgs: /nix/var/nix/profiles/per-user/root/channels/nixos/nixpkgs

[rnhmjoj]

Are you sure the path of the executable is correct?
I have pinentry-program /run/current-system/sw/bin/pinentry-curses in my config and it's working; I tried also pinentry-qt and pinentry-gtk and they all work ok.

[ysndr]

I have pinentry and kwalletcli (for pinentry-kwallet) installed to my user profile in contrast to having it declared in configuration.nix... I'll try changing this and report back.

[ysndr]

actually I recognized that if I stop the gpg-agent socket manually (systemctl --user stop gpg-agent.socket) the gpg-agent starts itself up again using the correct pinentry. Yet, after a reboot or even login it breaks again but can be resolved the same way..

[rnhmjoj]

gpgconf --reload gpg-agent was enough for it to change the pinentry program. I don't use the user service but start the agent from the shell, the old way. That must be the cause or related at least.

[bfortz]

My experience is that the gpg-agent socket launched at session start by systemd does not play well with user-set agents in gpg-agent.conf. If you have programs.gnupg.agent = true; in your configuration.nix file, removing it should solve your problem. (If you use nixpkgs on another linux distribution, systemctl disable gpg-agent.socket should do the trick).

[ysndr]

Hmm interesting
I actually got it kinda working by using the override of the gnupg package so everything else can be set using options

[bburdette]

This is still broken for me; the gpgconf --reload gpg-agent trick works but that shouldn't be necessary.

[rnhmjoj]

Are you using NixOS? What's your configuration?
There have been some changes to how the gpg-agent is set up, see #72597.

[bburdette]

Yes I'm using nixos. What do you mean by configuration? I use xmonad and I don't have gnome, if that's what you mean. I haven't set programs.gnupg.agent.enable = true in my configuration.nix. I installed gpg, pinentry, pinentry-curses, and gnupg1 by putting them in my environment.systemPackages. I'm on nixos-20.03. I wasn't aware that gpg required a gpg-agent so I didn't look that up in the nixos options.

[rnhmjoj]

I haven't set programs.gnupg.agent.enable = true

Ok, that's what I was asking.

I wasn't aware that gpg required a gpg-agent so I didn't look that up in the nixos options.

No, it's not, or at least it's shouldn't be.

Since I'm using that module myself I'm not sure, I'll have to try it out.
In any case gnupg is built with pinentry (pinentry-gtk I think) support so it should work. However I'm not sure about setting the pinentry-program from the configuration.

[rnhmjoj]

So, I did a little bit of research and figured that yes, in the past it was possible to use gnupg without an agent but starting with 2.0 is mandatory. See here for an explanation.

What's happening here is that gpg check if an agent is already running; if not it spawns a new one, which proceeds to check if pinetry is available but fails because it can't find the binary on NixOS. The solution is to either let NixOS manage the agent or start the agent manually.

[srid]

Has anyone figured a solution to this problem? Is gpg-agent entirely broken in nixpkgs? What the heck is "pinentry" anyway?