{"thread":{"id":"46699","subject":"signing commits using gpg2","startedAt":"2017-09-02T21:12:21Z","lastAt":"2017-09-05T18:35:35Z","messageCount":4,"participants":["shawn wilson","Santiago Torres","Michael J Gruber"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"327531","messageId":"CAH_OBieqSY8To9okRTL-z5dnjW=_NLzA+n5-7=eou=Lx33hBdQ@mail.gmail.com","threadId":"46699","inReplyTo":null,"subject":"signing commits using gpg2","fromName":"shawn wilson","fromEmail":"ag4ve.us@gmail.com","sentAt":"2017-09-02T21:11:50Z","receivedAt":"2017-09-02T21:12:21Z","isPatch":false,"sender":{"key":"ag4ve.us@gmail.com","avatar":null},"body":"tl;dr - how do I get git to use gpg2 to sign things?\n\nI'm using gpg2 (so no agent options are configured but an agent is\nrunning) which is configured w/ a Nitrokey (Pro if it matters):\n\n % git commit -m \"Initial.\"\n\n gits/bash-libs (master ⚡) localhost\ngpg: detected reader `Nitrokey Nitrokey Pro (000034670000000000000000) 00 00'\ngpg: pcsc_connect failed: sharing violation (0x8010000b)\ngpg: apdu_send_simple(0) failed: locking failed\nPlease insert the card and hit return or enter 'c' to cancel:\ngpg: pcsc_connect failed: sharing violation (0x8010000b)\ngpg: pcsc_connect failed: sharing violation (0x8010000b)\ngpg: apdu_send_simple(0) failed: locking failed\nPlease insert the card and hit return or enter 'c' to cancel: c\ngpg: selecting openpgp failed: general error\ngpg: signing failed: general error\ngpg: signing failed: general error\nerror: gpg failed to sign the data\nfatal: failed to write commit object\n\nThis works with gpg and ssh:\n % touch foo\n\n ~ localhost\n % gpg2 --sign foo\n\n ~ localhost\ngpg: using \"846FF490\" as default secret key for signing\n % cat foo*\n\n ~ localhost\n-----BEGIN PGP MESSAGE-----\nVersion: GnuPG v2\n\nowEBuQFG/pANAwAKAYwdY7SEb/SQAcsJYgNmb29ZqxfviQGcBAABCgAGBQJZqxfv\nAAoJEIwdY7SEb/SQAcEL/jonw+HymnlmfebtEwlvfx2Gl1Sbuw0xWWPpQ2Dtjljz\nHtpD+LWczjpOSMTHFNK9xPR2kcs1WNY+mO8M45QI7iDgFkKRzaxEqeNUJkoyF/+I\n81VMmXDQMXFs4+8jy00b+UxTdvwdXaHMsOtu+6YCtmCR5Bzohg07ADsnXnGGn3Sd\nWTjVMzV6Dlh8LRF+coGJ8JuErBsRAI6vdNgJRVHYBULGNXci4uF/4a+58uiTL4/U\nPvC4ruXCNxCKi89nMERhwlnOvglseX3TDR5ldrc4Hzb+pLsj/l6N4sBW0Zmb8UcE\n9BG3WjOs4eZvnLmk5XHrwisD2CXuHvyWMl0yH7LTrg+m4Itj0PJ4Px4H9E5t/zfs\nC1vcB/okcigeIyXnO06um02a5oZAYOKadB+6NRnBjULz5GvP2yxj/AO1VPmZprpt\nbudMuHZcA0zNE3uBmcnQY5+1tdkyTrlTxsL58lQrn/U3wvgah3AXMEvjRGqbYWHj\njDikQVJ7ESoevNqlfLPj8Q==\n=hV6v\n-----END PGP MESSAGE-----\n\nHowever, if I try this w/ the old gpg:\n\n % gpg -ae -o foo.gpg foo\n\n ~ localhost\n % gpg -d foo.gpg\n\n ~ localhost\ngpg: detected reader `Nitrokey Nitrokey Pro (000034670000000000000000) 00 00'\ngpg: pcsc_connect failed: sharing violation (0x8010000b)\ngpg: apdu_send_simple(0) failed: locking failed\nPlease insert the card and hit return or enter 'c' to cancel: c\ngpg: selecting openpgp failed: general error\ngpg: encrypted with 3072-bit RSA key, ID 41826CFB, created 2017-03-13\n \"Shawn Wilson \"\ngpg: public key decryption failed: general error\ngpg: decryption failed: secret key not available\n % gpg2 -d foo.gpg\n\n ~ localhost\ngpg: encrypted with 3072-bit RSA key, ID E27FA0B841826CFB, created 2017-03-13\n \"Shawn Wilson \"\nfoo\n\n(yeah I added data to the file)\n\nAnd just to prove basic competency checking:\n\n % git config --global -l | grep sign\n\n ~ localhost\nuser.signingkey=846FF490\nfilter.gitconfig-rmuser.clean=sed -e \"s/^\\( *email =\\).*/\\1 /\" -e \"s/^\\( *name =\\).*/\\1 /\" -e \"s/^\\(\n*signingkey =\\).*/\\1 /\"\nfilter.gitconfig-rmuser.smudge=egrep \"^ *(email|name|signingkey) = \"\ncommit.gpgsign=true\n"},{"id":"327532","messageId":"20170903182053.fnyxly5537zjkktc@LykOS.localdomain","threadId":"46699","inReplyTo":"CAH_OBieqSY8To9okRTL-z5dnjW=_NLzA+n5-7=eou=Lx33hBdQ@mail.gmail.com","subject":"Re: signing commits using gpg2","fromName":"Santiago Torres","fromEmail":"santiago@nyu.edu","sentAt":"2017-09-03T18:20:54Z","receivedAt":"2017-09-03T18:20:32Z","isPatch":false,"sender":{"key":"santiago@nyu.edu","avatar":"https://avatars.githubusercontent.com/u/3579933?v=4"},"body":"On Sat, Sep 02, 2017 at 05:11:50PM -0400, shawn wilson wrote:\n> tl;dr - how do I get git to use gpg2 to sign things?\n> \n> I'm using gpg2 (so no agent options are configured but an agent is\n> running) which is configured w/ a Nitrokey (Pro if it matters):\n> \n> % git commit -m \"Initial.\"\n> \n> gits/bash-libs (master ⚡) localhost\n> gpg: detected reader `Nitrokey Nitrokey Pro (000034670000000000000000) 00 00'\n> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n> gpg: apdu_send_simple(0) failed: locking failed\n> Please insert the card and hit return or enter 'c' to cancel:\n> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n> gpg: apdu_send_simple(0) failed: locking failed\n> Please insert the card and hit return or enter 'c' to cancel: c\n> gpg: selecting openpgp failed: general error\n> gpg: signing failed: general error\n> gpg: signing failed: general error\n> error: gpg failed to sign the data\n> fatal: failed to write commit object\n\nThis seems to be an issue with your gpg agent configuration (even if\nthere is none). \n\nI can't seem to reproduce, although I don't have a nitrokey, so this is\nmost likely an issue with either:\n\n- the PIV/CCID interface of the nitrokey using gpg2. I\"m not familiar\n enough with nitrokeys to debug this, but keys are usually super\n paranoid when signing arbitrary buffers.\n- the fork call within git on gpg2. \n\nI think the second one is rather unlikely, but it's worth giving it a\ntry...\n\n ~ localhost\n> -----BEGIN PGP MESSAGE-----\n> Version: GnuPG v2\n> [SNIPPED]\n> -----END PGP MESSAGE-----\n> \n\nI noticed you didn't try gpg2 -d foo.gpg? Am I missing something?\n\n> However, if I try this w/ the old gpg:\n> \n> % gpg -ae -o foo.gpg foo\n> \n> ~ localhost\n> % gpg -d foo.gpg\n> \n> ~ localhost\n> gpg: detected reader `Nitrokey Nitrokey Pro (000034670000000000000000) 00 00'\n> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n> gpg: apdu_send_simple(0) failed: locking failed\n> Please insert the card and hit return or enter 'c' to cancel: c\n> gpg: selecting openpgp failed: general error\n> gpg: encrypted with 3072-bit RSA key, ID 41826CFB, created 2017-03-13\n> \"Shawn Wilson \"\n> gpg: public key decryption failed: general error\n> gpg: decryption failed: secret key not available\n\nThis feels like an issue with the interface to the key itself. Can you\nstart a non-detached agent with --verbose to see exactly where it blows up?\n\nWe probably want to continue this offlist as this seems more of a gpg\nissue rather than git. We can always come back if we figure out this is\nsomething git related :)\n\nCheers!\n-Santiago.\n"},{"id":"327580","messageId":"0e626914-05b1-651c-9c61-b1ef0b6c190a@grubix.eu","threadId":"46699","inReplyTo":"CAH_OBieqSY8To9okRTL-z5dnjW=_NLzA+n5-7=eou=Lx33hBdQ@mail.gmail.com","subject":"Re: signing commits using gpg2","fromName":"Michael J Gruber","fromEmail":"git@grubix.eu","sentAt":"2017-09-05T13:40:39Z","receivedAt":"2017-09-05T13:40:52Z","isPatch":false,"sender":{"key":"git@grubix.eu","avatar":"https://avatars.githubusercontent.com/u/233215?v=4"},"body":"shawn wilson venit, vidit, dixit 02.09.2017 23:11:\n> tl;dr - how do I get git to use gpg2 to sign things?\n> \n> I'm using gpg2 (so no agent options are configured but an agent is\n> running) which is configured w/ a Nitrokey (Pro if it matters):\n> \n> % git commit -m \"Initial.\"\n> \n> gits/bash-libs (master ⚡) localhost\n> gpg: detected reader `Nitrokey Nitrokey Pro (000034670000000000000000) 00 00'\n> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n> gpg: apdu_send_simple(0) failed: locking failed\n> Please insert the card and hit return or enter 'c' to cancel:\n> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n> gpg: apdu_send_simple(0) failed: locking failed\n> Please insert the card and hit return or enter 'c' to cancel: c\n> gpg: selecting openpgp failed: general error\n> gpg: signing failed: general error\n> gpg: signing failed: general error\n> error: gpg failed to sign the data\n> fatal: failed to write commit object\n> \n> This works with gpg and ssh:\n\nNot really...\n\n> % touch foo\n> \n> ~ localhost\n> % gpg2 --sign foo\n\n... because you're using gpg2, not gpg.\n\n> \n> ~ localhost\n> gpg: using \"846FF490\" as default secret key for signing\n> % cat foo*\n> \n> ~ localhost\n> -----BEGIN PGP MESSAGE-----\n> Version: GnuPG v2\n> \n> owEBuQFG/pANAwAKAYwdY7SEb/SQAcsJYgNmb29ZqxfviQGcBAABCgAGBQJZqxfv\n> AAoJEIwdY7SEb/SQAcEL/jonw+HymnlmfebtEwlvfx2Gl1Sbuw0xWWPpQ2Dtjljz\n> HtpD+LWczjpOSMTHFNK9xPR2kcs1WNY+mO8M45QI7iDgFkKRzaxEqeNUJkoyF/+I\n> 81VMmXDQMXFs4+8jy00b+UxTdvwdXaHMsOtu+6YCtmCR5Bzohg07ADsnXnGGn3Sd\n> WTjVMzV6Dlh8LRF+coGJ8JuErBsRAI6vdNgJRVHYBULGNXci4uF/4a+58uiTL4/U\n> PvC4ruXCNxCKi89nMERhwlnOvglseX3TDR5ldrc4Hzb+pLsj/l6N4sBW0Zmb8UcE\n> 9BG3WjOs4eZvnLmk5XHrwisD2CXuHvyWMl0yH7LTrg+m4Itj0PJ4Px4H9E5t/zfs\n> C1vcB/okcigeIyXnO06um02a5oZAYOKadB+6NRnBjULz5GvP2yxj/AO1VPmZprpt\n> budMuHZcA0zNE3uBmcnQY5+1tdkyTrlTxsL58lQrn/U3wvgah3AXMEvjRGqbYWHj\n> jDikQVJ7ESoevNqlfLPj8Q==\n> =hV6v\n> -----END PGP MESSAGE-----\n> \n> However, if I try this w/ the old gpg:\n> \n> % gpg -ae -o foo.gpg foo\n> \n> ~ localhost\n> % gpg -d foo.gpg\n> \n> ~ localhost\n> gpg: detected reader `Nitrokey Nitrokey Pro (000034670000000000000000) 00 00'\n> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n> gpg: apdu_send_simple(0) failed: locking failed\n> Please insert the card and hit return or enter 'c' to cancel: c\n> gpg: selecting openpgp failed: general error\n> gpg: encrypted with 3072-bit RSA key, ID 41826CFB, created 2017-03-13\n> \"Shawn Wilson \"\n> gpg: public key decryption failed: general error\n> gpg: decryption failed: secret key not available\n> % gpg2 -d foo.gpg\n> \n> ~ localhost\n> gpg: encrypted with 3072-bit RSA key, ID E27FA0B841826CFB, created 2017-03-13\n> \"Shawn Wilson \"\n> foo\n> \n> (yeah I added data to the file)\n> \n> And just to prove basic competency checking:\n> \n> % git config --global -l | grep sign\n> \n> ~ localhost\n> user.signingkey=846FF490\n> filter.gitconfig-rmuser.clean=sed -e \"s/^\\( *email =\\).*/\\1 address>/\" -e \"s/^\\( *name =\\).*/\\1 /\" -e \"s/^\\(\n> *signingkey =\\).*/\\1 /\"\n> filter.gitconfig-rmuser.smudge=egrep \"^ *(email|name|signingkey) = \"\n> commit.gpgsign=true\n> \n\nSo, gpg2 works and gpg does not. This is typical for the way in which\nthe gpg upgrade path is broken, and your distro installs gpg because it\nstill relies on it.\n\ngit sees two executables gpg and gpg2 and uses the first, so as to not\nmigrate your secrete key store inadvertently.\n\nShort answer: Use\n\ngit config --global gpg.program gpg2\n\nto make git use gpg2 which apparantly is your working gnupg setup.\n\nMichael\n"},{"id":"327596","messageId":"CAH_OBickeYBWE-ygQY=pjh33_mFMXYqcwvVieRTA2cuCwzXcHA@mail.gmail.com","threadId":"46699","inReplyTo":"0e626914-05b1-651c-9c61-b1ef0b6c190a@grubix.eu","subject":"Re: signing commits using gpg2","fromName":"shawn wilson","fromEmail":"ag4ve.us@gmail.com","sentAt":"2017-09-05T18:34:52Z","receivedAt":"2017-09-05T18:35:35Z","isPatch":false,"sender":{"key":"ag4ve.us@gmail.com","avatar":null},"body":"Apparently you need to set the GPG_TTY for git to work (I also set the\ngpg.program so I know it shouldn't /need/ that variable set)\nhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840687#10\n\nI'm not sure if there's anything that has or can be done upstream to\nmake this easier (I feel this was a bigger PITA than it needed to be),\nI'm on git 2.7.5 from Fedira.\n\nOn Tue, Sep 5, 2017 at 9:40 AM, Michael J Gruber wrote:\n> shawn wilson venit, vidit, dixit 02.09.2017 23:11:\n>> tl;dr - how do I get git to use gpg2 to sign things?\n>>\n>> I'm using gpg2 (so no agent options are configured but an agent is\n>> running) which is configured w/ a Nitrokey (Pro if it matters):\n>>\n>> % git commit -m \"Initial.\"\n>>\n>> gits/bash-libs (master ⚡) localhost\n>> gpg: detected reader `Nitrokey Nitrokey Pro (000034670000000000000000) 00 00'\n>> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n>> gpg: apdu_send_simple(0) failed: locking failed\n>> Please insert the card and hit return or enter 'c' to cancel:\n>> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n>> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n>> gpg: apdu_send_simple(0) failed: locking failed\n>> Please insert the card and hit return or enter 'c' to cancel: c\n>> gpg: selecting openpgp failed: general error\n>> gpg: signing failed: general error\n>> gpg: signing failed: general error\n>> error: gpg failed to sign the data\n>> fatal: failed to write commit object\n>>\n>> This works with gpg and ssh:\n>\n> Not really...\n>\n>> % touch foo\n>>\n>> ~ localhost\n>> % gpg2 --sign foo\n>\n> ... because you're using gpg2, not gpg.\n>\n>>\n>> ~ localhost\n>> gpg: using \"846FF490\" as default secret key for signing\n>> % cat foo*\n>>\n>> ~ localhost\n>> -----BEGIN PGP MESSAGE-----\n>> Version: GnuPG v2\n>>\n>> owEBuQFG/pANAwAKAYwdY7SEb/SQAcsJYgNmb29ZqxfviQGcBAABCgAGBQJZqxfv\n>> AAoJEIwdY7SEb/SQAcEL/jonw+HymnlmfebtEwlvfx2Gl1Sbuw0xWWPpQ2Dtjljz\n>> HtpD+LWczjpOSMTHFNK9xPR2kcs1WNY+mO8M45QI7iDgFkKRzaxEqeNUJkoyF/+I\n>> 81VMmXDQMXFs4+8jy00b+UxTdvwdXaHMsOtu+6YCtmCR5Bzohg07ADsnXnGGn3Sd\n>> WTjVMzV6Dlh8LRF+coGJ8JuErBsRAI6vdNgJRVHYBULGNXci4uF/4a+58uiTL4/U\n>> PvC4ruXCNxCKi89nMERhwlnOvglseX3TDR5ldrc4Hzb+pLsj/l6N4sBW0Zmb8UcE\n>> 9BG3WjOs4eZvnLmk5XHrwisD2CXuHvyWMl0yH7LTrg+m4Itj0PJ4Px4H9E5t/zfs\n>> C1vcB/okcigeIyXnO06um02a5oZAYOKadB+6NRnBjULz5GvP2yxj/AO1VPmZprpt\n>> budMuHZcA0zNE3uBmcnQY5+1tdkyTrlTxsL58lQrn/U3wvgah3AXMEvjRGqbYWHj\n>> jDikQVJ7ESoevNqlfLPj8Q==\n>> =hV6v\n>> -----END PGP MESSAGE-----\n>>\n>> However, if I try this w/ the old gpg:\n>>\n>> % gpg -ae -o foo.gpg foo\n>>\n>> ~ localhost\n>> % gpg -d foo.gpg\n>>\n>> ~ localhost\n>> gpg: detected reader `Nitrokey Nitrokey Pro (000034670000000000000000) 00 00'\n>> gpg: pcsc_connect failed: sharing violation (0x8010000b)\n>> gpg: apdu_send_simple(0) failed: locking failed\n>> Please insert the card and hit return or enter 'c' to cancel: c\n>> gpg: selecting openpgp failed: general error\n>> gpg: encrypted with 3072-bit RSA key, ID 41826CFB, created 2017-03-13\n>> \"Shawn Wilson \"\n>> gpg: public key decryption failed: general error\n>> gpg: decryption failed: secret key not available\n>> % gpg2 -d foo.gpg\n>>\n>> ~ localhost\n>> gpg: encrypted with 3072-bit RSA key, ID E27FA0B841826CFB, created 2017-03-13\n>> \"Shawn Wilson \"\n>> foo\n>>\n>> (yeah I added data to the file)\n>>\n>> And just to prove basic competency checking:\n>>\n>> % git config --global -l | grep sign\n>>\n>> ~ localhost\n>> user.signingkey=846FF490\n>> filter.gitconfig-rmuser.clean=sed -e \"s/^\\( *email =\\).*/\\1 > address>/\" -e \"s/^\\( *name =\\).*/\\1 /\" -e \"s/^\\(\n>> *signingkey =\\).*/\\1 /\"\n>> filter.gitconfig-rmuser.smudge=egrep \"^ *(email|name|signingkey) = \"\n>> commit.gpgsign=true\n>>\n>\n> So, gpg2 works and gpg does not. This is typical for the way in which\n> the gpg upgrade path is broken, and your distro installs gpg because it\n> still relies on it.\n>\n> git sees two executables gpg and gpg2 and uses the first, so as to not\n> migrate your secrete key store inadvertently.\n>\n> Short answer: Use\n>\n> git config --global gpg.program gpg2\n>\n> to make git use gpg2 which apparantly is your working gnupg setup.\n>\n> Michael\n"}]}