3

Having a hard time figuring out the debugging steps for this behavior.

I'll run some gpg command and, typically, about 20 seconds later a GUI Pinentry window will pop up where I type in my password and the command proceeds.

Occasionally though, the prompt instantaneously appears in my terminal (without me changing any config). On other rare occasions, the GUI Pinentry will be instant.

One time I noticed the GUI Pinentry was instant was when I was running on a single monitor. I typically have an external monitor connected to my laptop over HDMI.

Another time I noticed I was getting prompted in my terminal was when my window manager had crashed, I killed the Xorg server process from a seperate TTY, then re-started my window manager.

I'm running Manjaro Linux with StumpWM as the window manager. I'm not sure what other pieces of software or config are relevant to this.

Eric Ihli
  • 211
  • 1
  • 8
  • See https://serverfault.com/questions/214605/gpg-does-not-have-enough-entropy – Clarus Jan 08 '21 at 00:52
  • Thanks for the tip. I don't think that applies since I'm not trying to generate a key. My keys are already generated. I'm just being asked for my password to unlock them. – Eric Ihli Jan 08 '21 at 16:32

2 Answers2

2

TLDR: I needed to pass the --daemonize flag to gnome-keyring-daemon.

I had /usr/bin/gnome-keyring-daemon --start --components=gpg,pkcs11,secrets,ssh in my .xinitrc.

Adding the --daemonize argument appears to have resolved this. /usr/bin/gnome-keyring-daemon --daemonize --start --components=gpg,pkcs11,secrets,ssh

Below is a hodge-podge of troubleshooting steps I took to resolve this in case you're experiencing a similar problem but not quite exactly the same.

I started with a bag of keywords that I figured were relevant: gpg, keyring, gpg-agent, pinentry, gpg password prompt.

Search the output of journalctl -xe for relevant-looking information. In this case, I saw:

Failed to lookup password for key <...> with secret service: Error calling StartServiceByName for org.freedesktop.secrets...>

That gave me another keyword to search for: org.freedesktop.secrets. Looking in journalctl output for that led me to another entry:

dbus-daemon[2210]: [session uid=1000 pid=2208] Failed to activate service 'org.freedesktop.secrets': timed out (service_start_timeout=120000ms)

That gave me another keyword... dbus-daemon.

I used dbus-monitor to see what was being sent over DBus and read any error output.

I also sent a message to DBus to see if org.freedesktop.secrets was running. (https://rtfm.co.ua/en/what-is-linux-keyring-gnome-keyring-secret-service-and-d-bus/)

dbus-send --session --dest=org.freedesktop.DBus --type=method_call --print-reply /org/freedesktop/DBus org.freedesktop.DBus.ListNames
...
string "org.freedesktop.secrets"
...

Everything pointed to the org.freedesktop.secrets service not running.

How are gpg-agent, org.freedesktop.secrets, and dbus-daemon connected?

gpg-agent talks to a "keyring" over "DBus". In my case, my keyring was gnome-keyring-daemon.

Eric Ihli
  • 211
  • 1
  • 8
1

I also had that problem. I had to wait 25 secs every time until the pinentry pops up.

Learning from Eric Ihli's answer that the problem was the keyring, I was able to turn the feature off with:

# ~/.gnupg/gpg-agent.conf
...

# Don't ask gnome-keyring for password
no-allow-external-cache

...
0xlee
  • 11
  • 1