gpg starting gpg-agent on demand?

Question

The man page of gpg-agent states:

   The agent is usualy started on demand by gpg,  gpgsm,  gpgconf  or
   gpg-connect-agent.   Thus there is no reason to start it manually.
   In case you want to use the included Secure Shell  Agent  you  may
   start the agent using:

     gpg-connect-agent /bye

   The usual way to run the agent is from the ~/.xsession file:

     eval $(gpg-agent --daemon)

This on the one hand tells me that "there is no reason to start it manually" and on the other hand tells me how to start it manually. -- Did I misunderstand anything here?

On my system it seems like I definitely have to start it manually. Otherwise for example gpg-connect-agent complains: can't connect to the agent: IPC connect call failed. - Do I need to configure anything to make gpg-connect-agent start the agent as stated in the man page?

Also the man page of gpg-connect-agent says:

   --agent-program file
          Specify the agent program to be started if none is running.

However gpg-connect-agent --help does not list this option and the command also complains if I try to use it.

Seems like the man page describes a different command, or did I miss anything important?

My system is a current Arch Linux. (Same situation on another debian box.)

Requested details:

$ gpg --version
gpg (GnuPG) 2.0.22
libgcrypt 1.5.3
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ?, ?
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2
$ gpg-connect-agent --version
gpg-connect-agent (GnuPG) 2.0.22
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: ~/.gnupg
$ man gpg-connect-agent |grep -A1 agent-program
       --agent-program file
              Specify the agent program to be started if none is running.
$ gpg-connect-agent --agent-program foo
gpg-connect-agent: invalid option "--agent-program"
$ gpg-connect-agent /bye
gpg-connect-agent: can't connect to the agent: IPC connect call failed

Which version of gpg-agent and gpg-connect-agent are you using? — Jenny D, Dec 27 '13 at 13:20
Also note that there are other gpg keyring daemons. For example, gnome has the gnome keyring, which handles gpg, ssh, and general passwords. These are often much better to work with as you can have one password unlock them all, and they can be automatically unlocked when you login. — phemmer, Dec 27 '13 at 13:39
I added concrete details above. I am aware of the gnome-keyring-daemon, however I don't run gnome on that box. - The question currently is, whether gpg is able to start its own daemon on demand, or not. — michas, Dec 27 '13 at 16:28

score 5 · Answer 1 · answered Dec 28 '13 at 15:05

That is bad wording in the man page. I guess it is meant as: "You are not forced to start gpg-agent manually." This makes sense because GnuPG 2.x requires gpg-agent whereas it is optional in 1.x

So: "Thus there is no reason to start it manually" "...in order to get the tools running".

But: If you want the caching feature then gpg-agent must run as a daemon and thus be started before the tools i.e. manually or from ~/.xsession because the tools look for the environment variable GPG_AGENT_INFO in order to find the (right) running gpg-agent. If the tools start gpg-agent then gpg-agent exits when the tool exits.

gpg-connect-agent /bye may be a real bug in the man page. AFAIK this is used for testing whether gpg-agent is running but not for starting it. It cannot even work that way as you mandatorily need the shell (more precise: the parent process to the tools to be started) for setting GPG_AGENT_INFO.

gpg starting gpg-agent on demand?

1 Answers1