epa.texi: Emacs and GnuPG pinentry

epa.texi: Emacs and GnuPG pinentry

[Jens Schmidt]

Hi.

I currently try to extend epa.texi based on my own experience with
GnuPG and Emacs setup.  (Bug#64154 tracks that, but it does not contain
anything overly interesting so far.)

What puzzled me during my first-time setup were the different modes of
Emacs as GnuPG Pinentry.  Basically you can have for GnuPG >= 2.1:

1. Use Emacs only for GnuPG requests that are triggered by Emacs itself
    (aka loopback pinentry),

2. use Emacs for *all* GnuPG requests (also non-Emacs ones), or

3. use Emacs for all GnuPG requests with some other non-Emacs Pinentry
    as fallback.

The latter two alternatives require pinentry.el, which was present in
Emacs core only in versions [25, ..., 27] (see
https://lists.gnu.org/archive/html/emacs-devel/2018-01/msg00233.html).
Plus they are not supported on Debian.

While some users may consider alternatives 2. and 3. desirable I'm not
sure whether I should describe their setup in detail in epa.texi.  I
could just mention them and that "they are not recommended for use".  Or
whatever.

WDYT?

Re: epa.texi: Emacs and GnuPG pinentry

[Filipp Gunbin]

Hi Jens,

On 05/07/2023 00:13 +0200, Jens Schmidt wrote:

[...]

> What puzzled me during my first-time setup were the different modes of
> Emacs as GnuPG Pinentry.  Basically you can have for GnuPG >= 2.1:
>
> 1. Use Emacs only for GnuPG requests that are triggered by Emacs itself
>    (aka loopback pinentry),
>
> 2. use Emacs for *all* GnuPG requests (also non-Emacs ones), or
>
> 3. use Emacs for all GnuPG requests with some other non-Emacs Pinentry
>    as fallback.
>
> The latter two alternatives require pinentry.el, which was present in
> Emacs core only in versions [25, ..., 27] (see
> https://lists.gnu.org/archive/html/emacs-devel/2018-01/msg00233.html).
> Plus they are not supported on Debian.
>
> While some users may consider alternatives 2. and 3. desirable I'm not
> sure whether I should describe their setup in detail in epa.texi.  I
> could just mention them and that "they are not recommended for use".  Or
> whatever.
>
> WDYT?

I think that putting (setq epg-pinentry-mode 'loopback) into .emacs is
all that should be needed.  BTW, we could think of making this value the
default.

Filipp

Re: epa.texi: Emacs and GnuPG pinentry

[Björn Bidar]

I'm not 100% sure but I think not all pinentry's support loopback.
The user has to make sure that his does support it.

Re: epa.texi: Emacs and GnuPG pinentry

[Jens Schmidt]

On 2023-08-14  12:13, Björn Bidar wrote:

> I'm not 100% sure but I think not all pinentry's support loopback.
> The user has to make sure that his does support it.

Hm ... that let me worry a bit, since I updated the documentation
in epa.texi some time ago already.  So I tested, all running from an
Emacs 27 -Q:

*** epg-pinentry-mode == nil

echo RELOADAGENT | gpg-connect-agent
# only pinentry executable on my system
sudo chmod a-x /usr/bin/pinentry-gnome3

(setq epg-pinentry-mode nil)

C-x C-f ~/tmp/test/xxx.pgp

=>

  Error while decrypting with "/usr/bin/gpg":

  gpg: encrypted with 3072-bit RSA key, ID D0EB77D91C0802D6, created 2022-12-03
        "test-key"
  gpg: public key decryption failed: No pinentry
  gpg: decryption failed: No secret key

So far so expected.

*** epg-pinentry-mode == 'loopback

echo RELOADAGENT | gpg-connect-agent
sudo chmod a-x /usr/bin/pinentry-gnome3

(setq epg-pinentry-mode 'loopback)

C-x C-f ~/tmp/test/xxx.pgp

=> file gets found and decrypted without problems

From that test I'd conclude that loopback pinentry works even if no
pinentry executable is available at all, so I somewhat doubt that
some pinentry executables would not support it.

Or did I misunderstand you here?  Or do you have further information?

Thanks!