can't sign email, key ... not found or not valid
OpenPGP addon for Mozilla Thunderbird
Brought to you by:
pbrunschwig
Menu
▾
▴
I can't get the Thunderbird Enigmail OpenPGP extension using gnupg2 to work under KDE in Linux, Mageia 4.
Trying to send a signed email fails before displaying the passphrase prompt with the message:
With gnupg2 installed and Enigmail enabled in Thunderbird and OpenPGP preferences set to find /usr/bin/gpg2, all of the pieces appear to be in place. KDE starts the gpg-agent daemon and sets the environment variable GPG_AGENT_INFO and ~/.gnupg/gpg-agent-info to point to its socket, ~/.gnupg/gpg.conf specifies only the default gpg key and keyserver, ~/.gnupg/gpg-agent.conf contains "pinentry-program /usr/bin/pinentry-qt no-grab default-cache-ttl 1800" and /usr/bin/pinentry-qt is a symlink to /usr/bin/pinentry-qt4.
The default key exists in ~/.gnupg and is valid and not expired; I can view it with the command "gpg2 --list-keys" and it works if I uninstall gpg2 and fall back to using gpg.
After the error occurs, the OpenPGP Console shows:
Apparently gpg-agent never calls pinentry-qt because the passphrase prompt is not shown, so the OpenPGP Log file contains:
Is something missing or misconfigured? Or is this a bug in either Enigmail or gnupg2?
You need to install a graphical version of pinentry, such as pinentry-qt or pinentry-gtk. And you need to ensure that pinentry is a symlink to the graphical version of pinentry-xxx.
If these two are already set up correctly, then your ~/.gnupg/gpg-agent.conf contains a reference to a wrong pinentry tool.
Here's what I've got:
Are you seriously suggesting that gpg-agent doesn't honor the gpg-agent.conf pinentry-program directive to call /usr/bin/pinentry-qt instead of pinentry? Are you really sure of this?
If so, that's a bug in gnupg2, and someone like you should file a bug report.
I hesitate to uninstall pinentry, since apparently a lot of KDE depends on it and uninstalling it would remove all of those KDE packages too. I'd also rather not just hack this by renaming pinentry and substituting a symlink to pinentry-qt4, as some programs might use pinentry and that could break those.
what does the following command list concerning pinentry-program? (Note: it doesn't report anything on my Mac, but that could be Mac-specific)
Here is everything I can find out through gpgconf.
That's the default, the same as running "gpgconf --list-components".
The entries default-key and encrypt-to are set to my primary key-id, and keyserver is set to "pgp.mit.edu", as specified in my ~/.gnupg/gpg.conf file.
There's no pinentry-program entry in the gpg-agent parameters maintained by gpgconf, although that's one thing you'd think gnupg2 would want to record.
It didn't complain about anything here, and even created an S/MIME keyring.
No complaints.
Hmmm. I checked the gnupg and gnupg2 packages, and the gpgconf.conf file is not included in either of them. There is no ~/.gnupg/gpgconf.conf file.
Last edit: Robert Munro 2014-02-12
Below is my entire enigdbug.txt file. I would have attached the file instead, but "add attachments" apparently doesn't work here at Sourceforge in forums.
I'm sorry, but the only thing I can see is:
[GNUPG:] NEED_PASSPHRASE FAA60C21490D242C FAA60C21490D242C 17 0
gpg: problem with the agent: No pinentry
This line in the log file tells you about gpg-agent:
2014-02-12 17:34:47.049 [DEBUG] enigmail.js: detectGpgAgent: GPG_AGENT_INFO='/tmp/gpg-GvDCox/S.gpg-agent:1932:1'
You could try this in a shell:
You should then be prompted for your passphrase or get an error about pinentry.
I got an error about pinentry, suggesting that gpg-agent isn't calling it.
That's already in my environment variables, so no need to export it again, and doing that doesn't help.
It appears that gpg-agent is not calling /usr/bin/pinentry-qt but instead fails, and gpg2 returns the passphrase prompt to the caller, which is the bash shell here.
Why isn't gpg-agent using the "pinentry-program /usr/bin/pinentry-qt [...]" directive that is in my ~/.gnupg/gpg-agent.conf file?
Here is what ps displays about gpg-agent:
Last edit: Robert Munro 2014-02-13
I'm not sure, but it may be that either gpg-agent was started before you modified gpg-agent.conf, or gpg-agent is simply ignoring the config option.
I'd suggest you start with symlinking pinentry-qt -> pinentry
I've solved the problem. Here is my modified ~/.gnupg/gpg-agent.conf without the parameter "no-grab":
I'm looking into how "no-grab" was added to gpg-agent.conf, but that's definitely what was preventing pinentry-qt from requesting the passphrase.
The parameter "keep-display" is also required by gpg-agent for pinentry-qt to work, but my Linux distribution passes "--keep-display" as a command-line parameter when it starts gpg-agent.
Thanks for helping me figure this out.
Last edit: Robert Munro 2014-02-15