# Commit signing and pinentry problems 4 messages from 2019-11-20 to 2020-03-02. Participants: Jeffrey Walton, Randall S. Becker, brian m. carlson. Thread: https://gitlist.dev/t/52299 ## Jeffrey Walton, 2019-11-20 12:41 Subject: Commit signing and pinentry problems Message-ID: URL: https://gitlist.dev/e/CAH8yC8n%2Bta4BSAE4rEfhKxe3T9poVdc94HvSk%3D6PEA4YbmwVyA%40mail.gmail.com ``` Hi Everyone, I'm having an annoying problem that I can't figure out. I hope Git has a setting to fix it. I have a desktop workstation where I sit at the keyboard about 1/3 of the time. Git signing works as expected. About 2/3 of the time I SSH into the machine. Git signing does not work when SSH'd in. When Git signing fails over SSH an error looks like: $ git commit -S log.h -m "Remove unneeded header" error: gpg failed to sign the data fatal: failed to write commit object I just noticed this today (but it makes sense)... - Go to desktop workstation, log in - Go to remote machine, log in - Sign at remote machine over SSH - Desktop workstation will open GUI password prompt - Remote machine sign operation will hang until GUI prompt times-out The problem was reported to Ubuntu but no activity: https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 . Does anyone know how to use Git to work around pinentry brain-dead-ness? Thanks in advance. ``` ## Randall S. Becker, 2019-11-20 15:15 Subject: RE: Commit signing and pinentry problems Message-ID: <02c601d59fb5$60dfbbf0$229f33d0$@nexbridge.com> URL: https://gitlist.dev/e/02c601d59fb5%2460dfbbf0%24229f33d0%24%40nexbridge.com In-Reply-To: ``` On November 20, 2019 7:41 AM, Jeffrey Walton wrote: > I'm having an annoying problem that I can't figure out. I hope Git has a > setting to fix it. > > I have a desktop workstation where I sit at the keyboard about 1/3 of the > time. Git signing works as expected. About 2/3 of the time I SSH into the > machine. Git signing does not work when SSH'd in. > > When Git signing fails over SSH an error looks like: > > $ git commit -S log.h -m "Remove unneeded header" > error: gpg failed to sign the data > fatal: failed to write commit object > > I just noticed this today (but it makes sense)... > > - Go to desktop workstation, log in > - Go to remote machine, log in > - Sign at remote machine over SSH > - Desktop workstation will open GUI password prompt > - Remote machine sign operation will hang until GUI prompt times-out > > The problem was reported to Ubuntu but no activity: > https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 . I would refer you to the GnuPG project lists for answers to this issue. However, AFAIK, gpg requires a real terminal from which to obtain a password with the intent of not allowing malicious code to capture the password by a man-in-the-middle attack. Depending on the platform, stdin is not acceptable. Check the GnuPG project common/ttyio.c module. It may be that your setup is not providing an apparent terminal so the prompt may actually be happening elsewhere than where you expect. I have had a similar issue with Jenkins when not running fully headless, and the password prompt was on the tty where Jenkins was started. This is unlikely a "hang" per se. Good luck, Randall ``` ## brian m. carlson, 2019-11-21 00:48 Subject: Re: Commit signing and pinentry problems Message-ID: <20191121004831.GB6430@camp.crustytoothpaste.net> URL: https://gitlist.dev/e/20191121004831.GB6430%40camp.crustytoothpaste.net In-Reply-To: ``` On 2019-11-20 at 12:41:23, Jeffrey Walton wrote: > Hi Everyone, > > I'm having an annoying problem that I can't figure out. I hope Git has > a setting to fix it. > > I have a desktop workstation where I sit at the keyboard about 1/3 of > the time. Git signing works as expected. About 2/3 of the time I SSH > into the machine. Git signing does not work when SSH'd in. > > When Git signing fails over SSH an error looks like: > > $ git commit -S log.h -m "Remove unneeded header" > error: gpg failed to sign the data > fatal: failed to write commit object > > I just noticed this today (but it makes sense)... > > - Go to desktop workstation, log in > - Go to remote machine, log in > - Sign at remote machine over SSH > - Desktop workstation will open GUI password prompt > - Remote machine sign operation will hang until GUI prompt times-out This isn't really a Git problem, so much as a GnuPG one. You probably want to use the curses pinentry input instead of the GUI one. If you're using Ubuntu, you can set "pinentry-program /usr/bin/pinentry-curses" in ~/.gnupg/gpg-agent.conf, kill all of the gpg-agent processes, and then attempt to sign again. You may also need to set GPG_TTY and/or kill the gpg-agent process when logging in remotely. See gpg-agent(1) for details on configuration and use. -- brian m. carlson: Houston, Texas, US OpenPGP: https://keybase.io/bk2204 ``` ## Jeffrey Walton, 2020-03-02 14:09 Subject: Re: Commit signing and pinentry problems Message-ID: URL: https://gitlist.dev/e/CAH8yC8km9k3sWKpjuj%3D69Y8SC%3DVHcDkBk%3D8O9RuCDOGtWGyqQQ%40mail.gmail.com In-Reply-To: ``` On Wed, Nov 20, 2019 at 7:41 AM Jeffrey Walton wrote: > > I'm having an annoying problem that I can't figure out. I hope Git has > a setting to fix it. > > I have a desktop workstation where I sit at the keyboard about 1/3 of > the time. Git signing works as expected. About 2/3 of the time I SSH > into the machine. Git signing does not work when SSH'd in. > > When Git signing fails over SSH an error looks like: > > $ git commit -S log.h -m "Remove unneeded header" > error: gpg failed to sign the data > fatal: failed to write commit object > > I just noticed this today (but it makes sense)... > > - Go to desktop workstation, log in > - Go to remote machine, log in > - Sign at remote machine over SSH > - Desktop workstation will open GUI password prompt > - Remote machine sign operation will hang until GUI prompt times-out > > The problem was reported to Ubuntu but no activity: > https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 . > > Does anyone know how to use Git to work around pinentry brain-dead-ness? This fellow's answer fixed this problem: https://stackoverflow.com/a/53641081 Jeff ```