threads / discuss / 52299

Commit signing and pinentry problems

Subject: Commit signing and pinentry problems

## tl;dr

4 messages between Nov 20, 2019 and Mar 2, 2020.

replies: 3people: 3as markdown or json

Jeffrey Walton· Nov 20, 2019, 12:41 UTC · lore

Hi Everyone,

I'm having an annoying problem that I can't figure out. I hope Git has a setting to fix it.

I have a desktop workstation where I sit at the keyboard about 1/3 of the time. Git signing works as expected. About 2/3 of the time I SSH into the machine. Git signing does not work when SSH'd in.

When Git signing fails over SSH an error looks like:

   $ git commit -S log.h -m "Remove unneeded header"
   error: gpg failed to sign the data
   fatal: failed to write commit object

I just noticed this today (but it makes sense)...

    - Go to desktop workstation, log in
    - Go to remote machine, log in
    - Sign at remote machine over SSH
      - Desktop workstation will open GUI password prompt
      - Remote machine sign operation will hang until GUI prompt times-out

The problem was reported to Ubuntu but no activity: https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 .

Does anyone know how to use Git to work around pinentry brain-dead-ness?

Thanks in advance.

Randall S. Becker· Nov 20, 2019, 15:15 UTC · re: Jeffrey Walton · lore

RE: Commit signing and pinentry problems

On November 20, 2019 7:41 AM, Jeffrey Walton wrote:

Show 23 quoted lines

> I'm having an annoying problem that I can't figure out. I hope Git has a
> setting to fix it.
> 
> I have a desktop workstation where I sit at the keyboard about 1/3 of the
> time. Git signing works as expected. About 2/3 of the time I SSH into the
> machine. Git signing does not work when SSH'd in.
> 
> When Git signing fails over SSH an error looks like:
> 
>    $ git commit -S log.h -m "Remove unneeded header"
>    error: gpg failed to sign the data
>    fatal: failed to write commit object
> 
> I just noticed this today (but it makes sense)...
> 
>     - Go to desktop workstation, log in
>     - Go to remote machine, log in
>     - Sign at remote machine over SSH
>       - Desktop workstation will open GUI password prompt
>       - Remote machine sign operation will hang until GUI prompt times-out
> 
> The problem was reported to Ubuntu but no activity:
> https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 .

I would refer you to the GnuPG project lists for answers to this issue. However, AFAIK, gpg requires a real terminal from which to obtain a password with the intent of not allowing malicious code to capture the password by a man-in-the-middle attack. Depending on the platform, stdin is not acceptable. Check the GnuPG project common/ttyio.c module. It may be that your setup is not providing an apparent terminal so the prompt may actually be happening elsewhere than where you expect. I have had a similar issue with Jenkins when not running fully headless, and the password prompt was on the tty where Jenkins was started. This is unlikely a "hang" per se.

Good luck, Randall

brian m. carlson· Nov 21, 2019, 00:48 UTC · re: Jeffrey Walton · lore

Re: Commit signing and pinentry problems

On 2019-11-20 at 12:41:23, Jeffrey Walton wrote:

Show 22 quoted lines

> Hi Everyone,
> 
> I'm having an annoying problem that I can't figure out. I hope Git has
> a setting to fix it.
> 
> I have a desktop workstation where I sit at the keyboard about 1/3 of
> the time. Git signing works as expected. About 2/3 of the time I SSH
> into the machine. Git signing does not work when SSH'd in.
> 
> When Git signing fails over SSH an error looks like:
> 
>    $ git commit -S log.h -m "Remove unneeded header"
>    error: gpg failed to sign the data
>    fatal: failed to write commit object
> 
> I just noticed this today (but it makes sense)...
> 
>     - Go to desktop workstation, log in
>     - Go to remote machine, log in
>     - Sign at remote machine over SSH
>       - Desktop workstation will open GUI password prompt
>       - Remote machine sign operation will hang until GUI prompt times-out

This isn't really a Git problem, so much as a GnuPG one. You probably want to use the curses pinentry input instead of the GUI one. If you're using Ubuntu, you can set "pinentry-program /usr/bin/pinentry-curses" in ~/.gnupg/gpg-agent.conf, kill all of the gpg-agent processes, and then attempt to sign again.

You may also need to set GPG_TTY and/or kill the gpg-agent process when logging in remotely. See gpg-agent(1) for details on configuration and use.

-- 
brian m. carlson: Houston, Texas, US
OpenPGP: https://keybase.io/bk2204

Jeffrey Walton· Mar 2, 2020, 14:09 UTC · re: Jeffrey Walton · lore

Re: Commit signing and pinentry problems

On Wed, Nov 20, 2019 at 7:41 AM Jeffrey Walton <noloader@gmail.com> wrote:

Show 26 quoted lines

>
> I'm having an annoying problem that I can't figure out. I hope Git has
> a setting to fix it.
>
> I have a desktop workstation where I sit at the keyboard about 1/3 of
> the time. Git signing works as expected. About 2/3 of the time I SSH
> into the machine. Git signing does not work when SSH'd in.
>
> When Git signing fails over SSH an error looks like:
>
>    $ git commit -S log.h -m "Remove unneeded header"
>    error: gpg failed to sign the data
>    fatal: failed to write commit object
>
> I just noticed this today (but it makes sense)...
>
>     - Go to desktop workstation, log in
>     - Go to remote machine, log in
>     - Sign at remote machine over SSH
>       - Desktop workstation will open GUI password prompt
>       - Remote machine sign operation will hang until GUI prompt times-out
>
> The problem was reported to Ubuntu but no activity:
> https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 .
>
> Does anyone know how to use Git to work around pinentry brain-dead-ness?

This fellow's answer fixed this problem: https://stackoverflow.com/a/53641081

Jeff