Split gpg does not on Fedora 23 template-based qube as gpg backend

[marmarek]

[user@personal ~]$ qubes-gpg-client test-enc.asc 
gpg: encrypted with 2048-bit RSA key, ID D755AC2A, created 2016-01-16
      "Real name (Comment) <Email@address>"
gpg: decryption failed: No secret key

It works fine after switching backend qube back to Fedora 21 template.

[marmarek]

cc @rootkovska

[marmarek]

cc @rootkovska

[marmarek]

Interesting, it works fine after just listing keys in the backend:

[user@vault ~]$ gpg2 -K
gpg: starting migration from earlier GnuPG versions
gpg: porting secret keys from '/home/user/.gnupg/secring.gpg' to gpg-agent
gpg: key A67A3024: secret key imported
gpg: migration succeeded
/home/user/.gnupg/pubring.gpg
-----------------------------
sec   rsa2048/A67A3024 2016-01-16
uid         [ultimate] Real name (Comment) <Email@address>
ssb   rsa2048/D755AC2A 2016-01-16

Apparently automatic key migration is done on listing keys, but not decryption. Also listing keys through split-gpg (qubes-gpg-client -K) is enough. This is why on my email VM I haven't such problem - mutt first list available keys.

I guess Thunderbird also list the keys, so also shouldn't be a problem there too. And ultimately, this isn't exactly split-gpg problem - the same happens when you try to decrypt a message directly using gpg2, without listing keys first (which would trigger keys migration).
Can we close this issue @rootkovska ? Or some action here is needed?

[marmarek]

Interesting, it works fine after just listing keys in the backend:

[user@vault ~]$ gpg2 -K
gpg: starting migration from earlier GnuPG versions
gpg: porting secret keys from '/home/user/.gnupg/secring.gpg' to gpg-agent
gpg: key A67A3024: secret key imported
gpg: migration succeeded
/home/user/.gnupg/pubring.gpg
-----------------------------
sec   rsa2048/A67A3024 2016-01-16
uid         [ultimate] Real name (Comment) <Email@address>
ssb   rsa2048/D755AC2A 2016-01-16

Apparently automatic key migration is done on listing keys, but not decryption. Also listing keys through split-gpg (qubes-gpg-client -K) is enough. This is why on my email VM I haven't such problem - mutt first list available keys.

I guess Thunderbird also list the keys, so also shouldn't be a problem there too. And ultimately, this isn't exactly split-gpg problem - the same happens when you try to decrypt a message directly using gpg2, without listing keys first (which would trigger keys migration).
Can we close this issue @rootkovska ? Or some action here is needed?