Bug 596396 - Requiring a gpg agent makes scripting difficult
Summary: Requiring a gpg agent makes scripting difficult
Alias: None
Product: Fedora
Classification: Fedora
Component: gnupg2
Version: 14
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Šimon Lukašík
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2010-05-26 17:33 UTC by Rob Crittenden
Modified: 2012-02-14 16:34 UTC (History)
5 users (show)

Fixed In Version: gnupg2-2.0.18-1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2012-02-14 16:34:04 UTC
Type: ---

Attachments (Terms of Use)

Description Rob Crittenden 2010-05-26 17:33:32 UTC
Description of problem:

In freeIPA we generate an encrypted file that is used to store replica configuration information.

This breaks in F-13 because gpg2 now requires an agent to be running and we encrypt this file something like this:

I'm using gpgtest as an example, we use python's tempfile.mkdtemp() to come up with a random name.

# mkdir -p /tmp/gpgtest/.gnupg
# /usr/bin/gpg --homedir /tmp/gpgtest/.gnupg --passphrase-fd 0 --yes --no-tty -o /path/to/outfile -c /path/to/infile

This hangs forever. If you remove the --no-tty arg you get:

can't connect to `/tmp/gpgtest/.gnupg/S.gpg-agent': No such file or directory
gpg-agent[16283]: command get_passphrase failed: Operation cancelled
gpg: cancelled by user
gpg: error creating passphrase: Operation cancelled
gpg: symmetric encryption of `infile' failed: Operation cancelled

The --no-use-agent argument is disabled, I'm not sure if this was an upstream choice or not.

I'm not to keen on firing up an agent on something that will rarely be run. Is there some other option, or can the --use-no-agent be re-enabled?

Comment 1 Rob Crittenden 2010-05-26 18:09:52 UTC
It seems this is related to the tty permissions. If I chmod o+rw $(tty) prior to running gpg it works. This is of course very ugly.

Even then I have to go through the pin entry program. I used to be able to pass in the passphrase over stdin.

Comment 2 Rob Crittenden 2010-05-26 18:17:43 UTC
And to round things out seems I need the --batch argument for --passphrase* to work. This is at least a problem in the man page.

It is also very different behavior from F-12.

Comment 3 Tomas Mraz 2010-05-26 18:21:12 UTC
Yes, this is right. You need to use the --batch.

GNUPG behavior is different because of change from gnupg-1.x to gnupg-2.0.

The upstream chose to require --batch for cases when input should not use tty or X.

Comment 4 Bug Zapper 2011-06-02 13:23:41 UTC
This message is a reminder that Fedora 13 is nearing its end of life.
Approximately 30 (thirty) days from now Fedora will stop maintaining
and issuing updates for Fedora 13.  It is Fedora's policy to close all
bug reports from releases that are no longer maintained.  At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '13'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 13's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 13 is end of life.  If you 
would still like to see this bug fixed and are able to reproduce it 
against a later version of Fedora please change the 'version' of this 
bug to the applicable version.  If you are unable to change the version, 
please add a comment here and someone will do it for you.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events.  Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

The process we are following is described here: 

Comment 5 Rob Crittenden 2011-06-02 15:57:06 UTC
Still affects F-14, F-15 likely as well since the n-v-r are similar.

I think the --passphrase options in the man page should mention that batch is required for them to work.

Comment 6 Šimon Lukašík 2012-02-14 16:34:04 UTC
It is fixed in Fedora 15 and 16 with gnupg2-2.0.18-1

In both `man gpg2' and `info gpg2' there is written:

    Note that this passphrase is only used if the option --batch
    has also been given. This is different from gpg.

for each in --passphrase, --passphrase-fd, and --passphrase-file.

Note You need to log in before you can comment on or make changes to this bug.