RE: Commit signing and pinentry problems

From: Randall S. Becker <rsbecker@nexbridge.com>
Date: Nov 20, 2019, 15:15 UTC
Message-ID: <02c601d59fb5$60dfbbf0$229f33d0$@nexbridge.com>
In-Reply-To: <CAH8yC8n+ta4BSAE4rEfhKxe3T9poVdc94HvSk=6PEA4YbmwVyA@mail.gmail.com>

On November 20, 2019 7:41 AM, Jeffrey Walton wrote:

Show 23 quoted lines

> I'm having an annoying problem that I can't figure out. I hope Git has a
> setting to fix it.
> 
> I have a desktop workstation where I sit at the keyboard about 1/3 of the
> time. Git signing works as expected. About 2/3 of the time I SSH into the
> machine. Git signing does not work when SSH'd in.
> 
> When Git signing fails over SSH an error looks like:
> 
>    $ git commit -S log.h -m "Remove unneeded header"
>    error: gpg failed to sign the data
>    fatal: failed to write commit object
> 
> I just noticed this today (but it makes sense)...
> 
>     - Go to desktop workstation, log in
>     - Go to remote machine, log in
>     - Sign at remote machine over SSH
>       - Desktop workstation will open GUI password prompt
>       - Remote machine sign operation will hang until GUI prompt times-out
> 
> The problem was reported to Ubuntu but no activity:
> https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 .

I would refer you to the GnuPG project lists for answers to this issue. However, AFAIK, gpg requires a real terminal from which to obtain a password with the intent of not allowing malicious code to capture the password by a man-in-the-middle attack. Depending on the platform, stdin is not acceptable. Check the GnuPG project common/ttyio.c module. It may be that your setup is not providing an apparent terminal so the prompt may actually be happening elsewhere than where you expect. I have had a similar issue with Jenkins when not running fully headless, and the password prompt was on the tty where Jenkins was started. This is unlikely a "hang" per se.

Good luck, Randall