Description of problem: In freeIPA we generate an encrypted file that is used to store replica configuration information. This breaks in F-13 because gpg2 now requires an agent to be running and we encrypt this file something like this: I'm using gpgtest as an example, we use python's tempfile.mkdtemp() to come up with a random name. # mkdir -p /tmp/gpgtest/.gnupg # /usr/bin/gpg --homedir /tmp/gpgtest/.gnupg --passphrase-fd 0 --yes --no-tty -o /path/to/outfile -c /path/to/infile This hangs forever. If you remove the --no-tty arg you get: can't connect to `/tmp/gpgtest/.gnupg/S.gpg-agent': No such file or directory gpg-agent[16283]: command get_passphrase failed: Operation cancelled gpg: cancelled by user gpg: error creating passphrase: Operation cancelled gpg: symmetric encryption of `infile' failed: Operation cancelled The --no-use-agent argument is disabled, I'm not sure if this was an upstream choice or not. I'm not to keen on firing up an agent on something that will rarely be run. Is there some other option, or can the --use-no-agent be re-enabled?
It seems this is related to the tty permissions. If I chmod o+rw $(tty) prior to running gpg it works. This is of course very ugly. Even then I have to go through the pin entry program. I used to be able to pass in the passphrase over stdin.
And to round things out seems I need the --batch argument for --passphrase* to work. This is at least a problem in the man page. It is also very different behavior from F-12.
Yes, this is right. You need to use the --batch. GNUPG behavior is different because of change from gnupg-1.x to gnupg-2.0. The upstream chose to require --batch for cases when input should not use tty or X.
This message is a reminder that Fedora 13 is nearing its end of life. Approximately 30 (thirty) days from now Fedora will stop maintaining and issuing updates for Fedora 13. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '13'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 13's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 13 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora please change the 'version' of this bug to the applicable version. If you are unable to change the version, please add a comment here and someone will do it for you. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Still affects F-14, F-15 likely as well since the n-v-r are similar. I think the --passphrase options in the man page should mention that batch is required for them to work.
It is fixed in Fedora 15 and 16 with gnupg2-2.0.18-1 In both `man gpg2' and `info gpg2' there is written: Note that this passphrase is only used if the option --batch has also been given. This is different from gpg. for each in --passphrase, --passphrase-fd, and --passphrase-file.