How to get gpg-agent to choose an appropriate variant of the pinentry program?

176 views Asked by At

I set up the email client program known as NeoMutt to use OAuth 2.0. When I launch NeoMutt from a Gnome session, gpg-agent invokes pinentry-gnome3, and when I launch NeoMutt from a virtual terminal, gpg-agent still invokes pinentry-gnome3 over on my other session (the graphical session) whereas it should be invoking pinentry-tty here on this very session (the virtual terminal session). This causes me to have to move from my virtual terminal session over to my graphical session in order to supply pinentry with my passphrase there and then come back to my virtual terminal session where I first launched NeoMutt. Only when I launch NeoMutt from a virtual terminal AND I am not logged into a Gnome session or my screen is locked on my graphical session, does gpg-agent know to invoke a proper pinentry variant, namely pinentry-tty or pinentry-curses.

I just want gpg-agent to prompt me for a passphrase via pinentry program from the same session where I am launching NeoMutt. Namely, gpg-agent should invoke pinentry-gnome3 when I launch NeoMutt from Gnome, and it should invoke pinentry-tty when I launch NeoMutt from a virtual terminal.

At the moment I do not have a ~/.gnupg/gpg-agent.conf configuration file defined, and ideally I would prefer not to force gpg-agent to always use the same pinentry program with a directive such as the following on my gpg-agent.conf file:

pinentry-program /usr/bin/pinentry-tty

I know that I am supposed to define a certain environment variable as follows:

export GPG_TTY=$(tty)

which variable I made sure that it is persistent by adding the directive to the .profile file on my home directory. This variable is supposed to make is to that gpg-agent knows to ask for a passphrase from the same terminal where NeoMutt was launched, but this did not work.

And also someone pointed out that I should run the following command, which is supposed to refresh the TTY and lock the pinentry program to pop up at the tty where I have started the agent, but this does not work either:

gpg-connect-agent UPDATESTARTUPTTY /bye

Using the following program is not a solution that makes me feel comfortable:

sudo update-alternatives --config pinentry

I would rather not force gpg-agent to always select a specific pinentry variant. And I would like to be able to access my email from all sorts of sessions, rather than graphical session exclusively or virtual terminal session exclusively...

Some people have suggested writing a bash script capable of making a smart selection and including a directive on my gpg-agent.conf file, I will look into that next.

1

There are 1 answers

1
Rafael X Villalobos On BEST ANSWER

So I got the following script from the Internet:

#!/bin/sh
set -eu
PINENTRY_TERMINAL='/usr/bin/pinentry-curses'
PINENTRY_GNOME='/usr/bin/pinentry-gnome3'
if [ -n "${DISPLAY-}" -a -z "${TERM-}" ]; then
    exec "$PINENTRY_GNOME" "$@"
else
    exec "$PINENTRY_TERMINAL" "$@"
fi

And I added the following directive to my gpg-agent.conf file:

pinentry-program /path/to/executable/script

This solution works. An appropriate variant of the pinentry program is invoked from the current session (whether Gnome or TTY) which is actually capable of executing on that kind of session.