No pinentry prompt for PGP signing

[krempel-pt]

Perhaps this is connected to #12.

The problem is, that I do not get a password prompt when trying to PGP sign or encrypt with a passphrase protected key. In the GUI it says: "Secret key not found".

My observation is, that if there is a gpg-agent running, it never works and if not it is kind of random, it worked once in ten tries. Didn't manage to detect a course.

Here I found a workaround by setting socket=gpg-agent permission to false, but I think this not a real solution.

I tried to play around with

LANG=C CAMEL_DEBUG=gpg flatpak run org.gnome.Evolution

but cannot see anything enlightening in the output.

Any advice how to get closer to the problem here?

Version used for latest tests:

$> flatpak info org.gnome.Evolution 

Evolution - Ihre E-Mails, Kontakte und Terminplanung verwalten

         Kennung: org.gnome.Evolution
             Ref: app/org.gnome.Evolution/x86_64/stable
     Architektur: x86_64
           Zweig: stable
         Version: 3.48.4
          Lizenz: GPL-2.0+ and GFDL-1.3
        Ursprung: flathub
        Sammlung: org.flathub.Stable
    Installation: system
     Installiert: 61,8 MB
Laufzeitumgebung: org.gnome.Platform/x86_64/44
             Sdk: org.gnome.Sdk/x86_64/44

          Commit: 45cacdba238ad33c9e69f85a35fe73e631a2ce797322050a9ed545685aab4c59
          Parent: 18b94f8428db3edbb8dc1f0e45e83445867ff35c0b13de01f30ca4bb7520e99a
         Betreff: Update to 3.48.4 (ee1be398)
           Datum: 2023-07-24 13:11:49 +0000

[johanbove]

The specific message you mentioned "Secret key not found" - could have multiple causes. The Evolution Help pages, on "Setting up GPG for your mail account", state this "Your key ID is an eight-character string with random numbers and letters." - when you use the full key id in the Evolution it does not find it. Additionally, remove all the spaces as well, because multiple keys are separated through a space between them.

My issue is related to the "pinentry" prompt. It does not happen on my system. Trying to resolve that.

[mcrha]

There is a similar downstream report:
https://gitlab.gnome.org/GNOME/evolution/-/issues/2536

The gpg claims an error:

gpg: WARNING: The server 'gpg-agent' is older than us (version 2.2.40 < 2.2.41)

which feels related.

I tried it here, to sign and encrypt a message with a key stored on the host system with an ancient gpg 2.2.20 and the latest Evolution from Flathub (3.50.0), which has gpg 2.2.41, and I am asked for the password for the key and when I provide it the message is properly signed and encrypted (the password is needed only for the signing), thus it looks like the incompatibility of the versions is truly only a warning.

The "Secret key not found" can be from libsecret, when it's trying to read a password stored in the keyring and it cannot find it. As the password prompt allows to "Save in password manager" I enabled it and verified the key is read from the keyring. After that I opened seahorse and deleted the GPG key from it. Starting Evolution I'm asked for the password again, I do not get the "Secret key not found" error.

The evolution-data-server sources contain only one occurrence of the "Secret key not found" message, but only together with "Failed to decrypt MIME part: Secret key not found", which is not your case, I suppose. I guess there is missing private key for the gpg key used in the encrypted mail, if it's the time you see this error at. Why gpg cannot locale it I do not know.

@Sesivany it looks like the socket=gpg-agent is kinda problematic for some users. Maybe the flatpak should switch back to its own pinentry build.

[madbehaviorus]

In ralation to the bug https://gitlab.gnome.org/GNOME/evolution/-/issues/2536, I can confirm that does no difference between the using kwallet and pam_kwallet_5 or gnome-keyring and pam_gnome-keyring on an Debian 11 system.
In both variants, it checks the Nitrokey bit after it, it gives the issue waring.

With kwallet and pam_kwallet_5

gpg: enabled compatibility flags:
gpg: WARNING: The server 'gpg-agent' is older than us (version 2.2.40 < 2.2.41)
gpg: Note: Important security fixes may be missing in outdated servers.
gpg: Note: The command "gpgconf --kill all" restarts these servers.
gpg: the subkey $0xkey_id is used instead of the master key $0xkey_id
gpg: write to '-'
gpg: pinentry launched (6588 gnome3 1.2.1 - xterm-256color :0.0 - 1000/1000 -)
gpg: authentication failed: error in pinentry
gpg: signing failed: Error in the pinentry

gnome-keyring and pam_gnome-keyring

PGP/MIME message could not be parsed: Output from gpg:
gpg: enabled compatibility flags:
gpg: public key is $key_id
gpg: WARNING: The server 'gpg-agent' is older than we are (version 2.2.40 < 2.2.41)
gpg: Note: Important security fixes may be missing in outdated servers.
gpg: Note: The command "gpgconf --kill all" restarts these servers.
gpg: the subkey $key_id is used instead of the master key $key_id
gpg: pinentry launched (149016 gnome3 1.2.1 - xterm-256color :0.0 - 1000/1000 -)
gpg: subkey $key_id is used instead of the master key $key_id
gpg: encrypted with 4096-bit RSA key, ID $key_id, generated 2022-*-*
"$email>"
gpg: decryption with public key method failed: error in pinentry
gpg: Decryption failed: No secret key

One point is interesting on my second testdevice with gnome-keyring:

If I unlock my Nitrokey with the local installation from evolution, close evolution but keep the stick inside and run the flatpak gnome.org.evolution it can decrypt all messages.
If I pull out the key and insert it again, I get the same issue from above .
I think it's not dependent from the chosen keymanager. It seems to be the call for the PIN question is not right, use a false command or, how "mcrha" is written If it not get the "key answer" directly, it false back to its own penetry build.
I don't know the specific mechanism here.

[Sesivany]

I wonder: can you also reproduce it with 3.50? What distribution and version of flatpak and xdg-desktop-portal are you using? I don't mind going back to building our own pinentry, but first I would like to find out how many users could be possibly affected by this and if it's the only way to prevent the problem.

[krempel-pt]

I wonder: can you also reproduce it with 3.50? What distribution and version of flatpak and xdg-desktop-portal are you using? I don't mind going back to building our own pinentry, but first I would like to find out how many users could be possibly affected by this and if it's the only way to prevent the problem.

Is that question for be or for @madbehaviorus ?

From my side I use xdg-desktop-portal 1.16.0-2 from Debian stable.

I just tried it again with 3.50 and it seems to be still the same as described above: With socket=gpg-agent activated it says "Key not found" and not asking for the passphrase, but with it deactivated everything is working as expected.

[Sesivany]

I've just pushed a new update with its own pinentry to the beta channel. I'd appreciate if someone could test it if it fixes the issue. I can't reproduce it either.

[madbehaviorus]

@Sesivany
I can confirm, that the new version 3.50.1 updated from the flathub beta channel also doesn't work with the same warning from above.
I use xdg-desktop-portal from debian 11 (stable) in version 1.16.0-2 amd64.
If I use 3.50.1 without the permission for socket=gpg-agent the question window for the nitrokey appears and aks to insert this one with the specific ID, but doesn't detect the plugged nitrokey.

I also checked it with my other device and updated on the stable channel to 3.50.0 and I have the same issue there.

[mcrha]

I'm wondering, is the problem with the Flatpak sandbox or with the gpg configuration? It could be checked when you install package-based Evolution, not Flatpak-based.

The thing is, the gpg runs in the Flatpak sandbox, but the sandbox has opened access to the gpg home on the host machine, thus the keys can be shared between the Flatpak Evo and the host system. How it works with the key cards I've no idea, I'm sorry.

[madbehaviorus]

My GPG configuration works like a charm with all other programs.
If I installed the evolution apt package from Debian 11 with hardcoded Dependencies to the gnome-keyring, it works also.
However, I don't want to use gnome-keyring, so the only other way to use evolution without the linked dependencies is use the flapak or build it it from source. Build evolution from source is very special...

I don't know witch action open the password querry window for checking smartcards.
I must take a closer look at scdaemon and pcsc lite:
https://wiki.archlinux.org/title/GnuPG#Smartcards

[mcrha]

However, I don't want to use gnome-keyring, so the only other way to use evolution without the linked dependencies is use the flapak or build it it from source.

It's not directly connected to this issue, I'm only wondering where libsecret connects to in your case then, because there is one implementation of its D-Bus interface, and it's the gnome-keyring. There could be something for KDE Wallet too, but I do not follow it, I do not know what state they are in.

Evolution itself doesn't talk to gnome-keyring, it doesn't have a dependency on it, it just uses libsecret. The libsecret is used to save your credentials for the configured accounts. Whether gpg has anything to do with libsecret I do not know, though my guess is it does not (I can be wrong).