Bug 805342

Description of problem:

pinentry-gtk-2 fails to drop down to pinentry-curses if no X display is available.  Instead, it consumes all available CPU and must be -KILLed.

If an X display is available via ssh port forwarding, pinentry-gtk-2 fails to use the forwarded display.

The combination of factors means that it is impossible to use gpg2 over a remote connection (e.g., via ssh).

Version-Release number of selected component (if applicable):

* Fedora 16 XFCE spin
* 3.2.10-3.fc16.x86_64
* gpg2 (GnuPG) 2.0.18
* gpg-agent (GnuPG) 2.0.18
* pinentry-gtk2 0.8.1
* pinentry-curses (pinentry) 0.8.1
* All updates applied as of 20-Mar-2012


How reproducible:

Attempt to decrypt a PGP encrypted file from a non-X terminal session, e.g., a console login or ssh session with X11 forwarding disabled.


Steps to Reproduce:
1. Create or obtain a PGP-encrypted file, encrypted with a public key for
   which you have the private key (on your GPG secret keyring).

   For example:
   $ ls -l | gpg2 --encrypt -a >pinentry.test.asc

   (Select an appropriate public key when prompted.)

2. From an Xterminal shell, decrypt the file:

   $ echo $DISPLAY
   :0.0
   $ gpg2 --decrypt <pinentry.test.asc

3. Either wait until the cache has timed out (default 10 minutes) or kill
   the gpg-agent.

4. From a console terminal (e.g., press Ctrl+Alt+F3, or so), decrypt the file:

   $ echo $DISPLAY

   $ gpg2 --decrypt <pinentry.test.asc

   Anything you type at this point will appear on the screen, but it is not
   taken as input by the pinentry program.

5. Run 'top -i'

  
Actual results:

top - 17:48:31 up  1:44,  4 users,  load average: 0.90, 0.33, 0.16
Tasks: 178 total,   2 running, 176 sleeping,   0 stopped,   0 zombie
Cpu(s): 19.2%us,  5.9%sy,  0.0%ni, 74.8%id,  0.0%wa,  0.2%hi,  0.0%si,  0.0%st
Mem:   4015444k total,  1553796k used,  2461648k free,    58964k buffers
Swap:  4194300k total,        0k used,  4194300k free,   707244k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND            
 2763 crh       20   0  100m 2724 2208 R 99.4  0.1   1:47.22 pinentry-gtk-2     
 2765 crh       20   0 15260 1268  908 R  0.0  0.0   0:00.03 top                


When run from a console terminal (with no cached passphrase), the pinentry-gtk-2 program does not fall back to pinentry-curses as it should.
It consumes CPU resources until killed with -KILL.

Expected results:

1) The pinentry-gtk-2 module should fall back to pinentry-curses if there is
   no $DISPLAY value.

2) If gpg2 is run from a terminal window (Xterminal, ssh, or otherwise), the
   pinentry-curses module should be used to accept input whether $DISPLAY is
   defined or not.  All other input to the program is via the text terminal.
   The passphrase input should not be an exception.

3) The gpg2 and gpg-agent documentation included with the XFCE Spin
   installation provides a great deal of information about default
   configuration file names and locations, as well as script file
   pathnames, and such-like.  XFCE does things differently, and finding
   the information is difficult making debugging harder and all attempts
   to fix the problem by hand more difficult.

Additional info:

gpg-agent is started by /etc/xdg/xfce4/xinitrc at X login or, if the user logs in at a console (e.g. tty3) and no gpg-agent is running, gpg-agent will be started by gpg2.  The only difference between the two is the location of the listening socket and whether or not a gpg-agent-info file is written in $HOME/.cache/.  Testing shows no behavioural difference.

Removal of the package pinentry-gtk-0.8.1-4.fc16 results in the following error messages from gpg2:

gpg: problem with the agent: No pinentry
:
:
gpg: public key decryption failed: Operation cancelled
gpg: decryption failed: No secret key

...indicating that gpg-agent (or possibly the /usr/bin/pinentry script) truly has no clue how to fall back to pinentry-ncurses.