I'm trying to use Enigmail with Thunderbird on Linux. GPG itself is set up, keys imported and I already can use the key management functions (including signing of keys) from kgpg.
But Mail encryption still fails, because seemingly the gpg-agent hangs on the passphrase entry.
According to the Enigmail console it falls back to not using gpg-agent (as kgpg does), but fails again because gpg doesn't allow passphrase entry in batch mode, which Enigmail uses.
error - signature verification failed gpg command line and output: gpg: /usr/bin/gpg --charset utf-8 --display-charset utf-8 --batch --no-tty --status-fd 2 --decrypt --use-agent gpg: problem with the agent - disabling agent use gpg: can't query passphrase in batch mode gpg: Invalid passphrase; please try again ...
When repeating the command sent by Enigmail on the command line, I get a more detailed error message from gpg:
usr/bin/gpg --charset utf-8 --display-charset utf-8 --batch --no-tty --status-fd 2 --decrypt --use-agent test.txt [GNUPG:] ENC_TO ... [GNUPG:] USERID_HINT ... [GNUPG:] NEED_PASSPHRASE 058D6157A587CB0E 7CE559F6FF6E7567 1 0 gpg-agent: handler 0x7f6d725bf6c0 for fd 6 started gpg-agent: starting a new PIN Entry gpg-agent: command get_passphrase failed: End of file gpg: problem with the agent - disabling agent use gpg: can't query passphrase in batch mode [GNUPG:] MISSING_PASSPHRASE gpg-agent: handler 0x7f6d725bf6c0 for fd 6 terminated [GNUPG:] BAD_PASSPHRASE 058D6157A587CB0E gpg: Invalid passphrase; please try again ...
I've already tried with gpg2 instead of gpg, with purging and re-installing gpg-agent, with specifying
pinentry-program "/usr/bin/pinentry-qt4" in gpg-agent.conf (also with other variants like
pinentry-X11), with removing
use-agent in gpg.conf and the enigmail options (gives
gpg: can't query passphrase in batch mode immediatly).
I tried to start pinentry from the command line but I don know the syntax to its commands.
I've found only bug reports for Macs on the net, which mostly got resolved by installing newer versions of their meta-packages.
Update: After switching to gpg2 again, stopping the gpg-agent and adding
--no-batch to the custom command options on enigmail I was able to encrypt mails. Seems like without gpg-agent, the
pinentry(-qt4) works fine.
Looking at gpg-agents source code I can only assume that it has problems querying the cache for the password. But the caching architecture of gpg-agent seems non-trivial to me.