3

I'm trying to use Enigmail with Thunderbird on Linux. GPG itself is set up, keys imported and I already can use the key management functions (including signing of keys) from kgpg.

But Mail encryption still fails, because seemingly the gpg-agent hangs on the passphrase entry.

According to the Enigmail console it falls back to not using gpg-agent (as kgpg does), but fails again because gpg doesn't allow passphrase entry in batch mode, which Enigmail uses.

error - signature verification failed

gpg command line and output:
gpg: /usr/bin/gpg --charset utf-8 --display-charset utf-8 --batch --no-tty --status-fd 2 --decrypt --use-agent
gpg: problem with the agent - disabling agent use
gpg: can't query passphrase in batch mode
gpg: Invalid passphrase; please try again ...

When repeating the command sent by Enigmail on the command line, I get a more detailed error message from gpg:

usr/bin/gpg --charset utf-8 --display-charset utf-8 --batch --no-tty --status-fd 2 --decrypt --use-agent test.txt
[GNUPG:] ENC_TO ...
[GNUPG:] USERID_HINT ...
[GNUPG:] NEED_PASSPHRASE 058D6157A587CB0E 7CE559F6FF6E7567 1 0
gpg-agent[12712]: handler 0x7f6d725bf6c0 for fd 6 started
gpg-agent[12712]: starting a new PIN Entry
gpg-agent[12712]: command get_passphrase failed: End of file
gpg: problem with the agent - disabling agent use
gpg: can't query passphrase in batch mode
[GNUPG:] MISSING_PASSPHRASE
gpg-agent[12712]: handler 0x7f6d725bf6c0 for fd 6 terminated
[GNUPG:] BAD_PASSPHRASE 058D6157A587CB0E
gpg: Invalid passphrase; please try again ...

I've already tried with gpg2 instead of gpg, with purging and re-installing gpg-agent, with specifying pinentry-program "/usr/bin/pinentry-qt4" in gpg-agent.conf (also with other variants like pinentry-X11), with removing use-agent in gpg.conf and the enigmail options (gives gpg: can't query passphrase in batch mode immediatly).

I tried to start pinentry from the command line but I don know the syntax to its commands.

I've found only bug reports for Macs on the net, which mostly got resolved by installing newer versions of their meta-packages.

Update: After switching to gpg2 again, stopping the gpg-agent and adding --no-batch to the custom command options on enigmail I was able to encrypt mails. Seems like without gpg-agent, the pinentry(-qt4) works fine. Looking at gpg-agents source code I can only assume that it has problems querying the cache for the password. But the caching architecture of gpg-agent seems non-trivial to me.

1
  • It is non-trivial and it's as flakey as all Hell on OS X, especially on earlier versions of the OS (Leopard, Snow Leopard). Still, you can compile GPG 1.4.14 without gpg-agent enabled and just make sure Enigmail calls that instead of gpg2.
    – Ben
    Sep 29, 2013 at 22:52

0

You must log in to answer this question.

Browse other questions tagged .