|
Size: 1572
Comment: New page.
|
Size: 1854
Comment: Add link to solution by Gniibe.
|
| Deletions are marked like this. | Additions are marked like this. |
| Line 14: | Line 14: |
| # provide a pretty dialog for requesting the user's password # save the user's pass phrase in Gnome Keyring so that the user doesn't need to enter the pass phrase. |
# provide a pretty dialog for requesting the user's passphrase # save the user's passphrase in Gnome Keyring's storage so that the user doesn't need to enter the pass phrase. |
| Line 28: | Line 28: |
| For one way to work around this issue, see [[http://blog.josefsson.org/2015/01/02/openpgp-smartcards-and-gnome/|this blog by Simon Josefsson]]. | The easiest way to avoid this problem is to uninstall Gnome Keyring. If that is not an option it is possible to prevent Gnome Keyring from hijacking gpg-agent. # For Gnome on Debian, see [[http://blog.josefsson.org/2015/01/02/openpgp-smartcards-and-gnome/|this blog by Simon Josefsson]]. # For a general solution, see: [[http://www.gniibe.org/memo/notebook/gnome3-gpg-settings.html|this blog by Gniibe]]. |
Gnome Keyring hijacks the connection to GPG Agent (effectively performing a man-in-the-middle attack) by setting the GPG_AGENT_INFO environment variable to point to itself. It then filters all communication with gpg-agent. gpg detects this and issues the following warning:
gpg: WARNING: The GNOME keyring manager hijacked the GnuPG agent. gpg: WARNING: GnuPG will not work properly - please configure that tool to not interfere with the GnuPG system!
You can read more about the issue here according to both the GnuPG developpers and the Gnome Keyring developers. The motivation for hijacking the connection is that Gnome Keyring wants to:
- provide a pretty dialog for requesting the user's passphrase
- save the user's passphrase in Gnome Keyring's storage so that the user doesn't need to enter the pass phrase.
Unfortunately, Gnome Keyring's implementation of the protocol is incomplete. Thus although many operations work, in particular, working with smart cards results in errors that look like this:
$ echo | gpg2 --sign gpg: WARNING: The GNOME keyring manager hijacked the GnuPG agent. gpg: WARNING: GnuPG will not work properly - please configure that tool to not interfere with the GnuPG system! gpg: selecting openpgp failed: Unsupported certificate gpg: signing failed: Unsupported certificate
The easiest way to avoid this problem is to uninstall Gnome Keyring. If that is not an option it is possible to prevent Gnome Keyring from hijacking gpg-agent.
- For Gnome on Debian, see this blog by Simon Josefsson.
- For a general solution, see: this blog by Gniibe.