I'm working on a Ubuntu 18.04.3 LTS x86_64 machine (fully patched). The machine has a GNOME3 desktop. Sometimes I sit at the workstation, and other times I SSH into the workstation.

When sitting at the workstation Git commit signing works. I use git commit -S ... -m ..., and things work as expected. I get a UI prompt for my GnuPG password and the work flows as usual.

When I work remotely on the same workstation over SSH I have to forgo commit signing because:

$ git commit -S log.h -m "Remove unneeded header"
error: gpg failed to sign the data
fatal: failed to write commit object

I'm using a "standard" configuration for SSH, Git and GnuPG. I am not aware of any special configurations for this setup. However, the repo is located on my local LAN (and not GitHub, GitLab, etc):

$ cat .git/config 
    repositoryformatversion = 0
    filemode = true
    bare = false
    logallrefupdates = true
[remote "origin"]
    url = ssh://git@callmaster:/var/callboot-src
    fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
    remote = origin
    merge = refs/heads/master

There is no specialized GnuPG conf file in $HOME/.gnupg:

$ ls -A ~/.gnupg/
3F537D88ADBC1677-private-key.asc  pubring.kbx
private-keys-v1.d                 trustdb.gpg

Search is not finding the issue. I'm getting a lot about Git signing failures, but not results for this particular situation.

What configuration option am I missing so signing works locally and over SSH?

Here is pinentry on the machine:

$ ls -Al /usr/bin/pinentry-*
-rwxr-xr-x 1 root root 63992 Feb  5  2018 /usr/bin/pinentry-curses
-rwxr-xr-x 1 root root 72184 Feb  5  2018 /usr/bin/pinentry-gnome3
lrwxrwxrwx 1 root root    30 Sep  2 19:14 /usr/bin/pinentry-x11 -> /etc/alternatives/pinentry-x11

And then:

$ ls -Al /etc/alternatives/pinentry-*
lrwxrwxrwx 1 root root 24 Sep  2 19:14 /etc/alternatives/pinentry-x11 -> /usr/bin/pinentry-gnome3
lrwxrwxrwx 1 root root 40 Sep  2 19:14 /etc/alternatives/pinentry-x11.1.gz -> /usr/share/man/man1/pinentry-gnome3.1.gz
  • Which /usr/bin/pinentry-* programs do you have installed, and what is /usr/bin/pinentry symlinked to? – user1686 Nov 15 '19 at 6:11
  • @grawity - The information was added to the question. I don't recall doing anything special for pinentry. It was probably installed as part of gnupg or git-core or ssh. Or maybe it is part of the base-os. I don't recall the order I installed the packages (if order matters). – jww Nov 15 '19 at 6:31
  • Now open in Ubuntu Issue Tracker: pinentry does not work for both desktop login and SSH login – jww Nov 15 '19 at 7:05

Make sure your shell startup files (.bashrc or .zshrc) set the $GPG_TTY environment variable:

export GPG_TTY=$(tty)

There are several layers of indirection in the way GnuPG shows password prompts. It doesn't show them directly, and it doesn't even launch the "pinentry" UI directly – instead it passes a few relevant environment variables to a gpg-agent daemon (which is shared across all of your sessions), and then gpg-agent tries to start "pinentry" on the correct TTY or the right X11 display.

For some yet unexplained reason, when gpg sends the session information to gpg-agent, it doesn't bother looking up the real TTY by itself (or even passing it as file descriptor); it always expects the $GPG_TTY environment variable to be present and contain the information.

As an alternative, you can kind of avoid this by enabling the "loopback pinentry" option, where gpg-agent's passphrase requests travel back to gpg instead of starting a pinentry UI.

To do so, add the option pinentry-mode loopback to ~/.gnupg/gpg.conf.

(In older (outdated) GnuPG versions, you might also need the option allow-loopback-pinentry in ~/.gnupg/gpg-agent.conf, and after adding it you'll need to update with gpg-connect-agent reloadagent /bye. Latest GnuPG already allows loopback mode by default.)

  • Thanks @grawity. No joy using GPG_TTY. I added the variable to .bashrc, logged out over SSH, logged in over SSH, and verified with an echo: /dev/pts/1. Signing experienced the same error. – jww Nov 15 '19 at 6:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.