Commit signing and pinentry problems

Commit signing and pinentry problems

[Jeffrey Walton]

Hi Everyone,

I'm having an annoying problem that I can't figure out. I hope Git has
a setting to fix it.

I have a desktop workstation where I sit at the keyboard about 1/3 of
the time. Git signing works as expected. About 2/3 of the time I SSH
into the machine. Git signing does not work when SSH'd in.

When Git signing fails over SSH an error looks like:

   $ git commit -S log.h -m "Remove unneeded header"
   error: gpg failed to sign the data
   fatal: failed to write commit object

I just noticed this today (but it makes sense)...

    - Go to desktop workstation, log in
    - Go to remote machine, log in
    - Sign at remote machine over SSH
      - Desktop workstation will open GUI password prompt
      - Remote machine sign operation will hang until GUI prompt times-out

The problem was reported to Ubuntu but no activity:
https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 .

Does anyone know how to use Git to work around pinentry brain-dead-ness?

Thanks in advance.

RE: Commit signing and pinentry problems

[Randall S. Becker]

On November 20, 2019 7:41 AM, Jeffrey Walton wrote:
> I'm having an annoying problem that I can't figure out. I hope Git has a
> setting to fix it.
> 
> I have a desktop workstation where I sit at the keyboard about 1/3 of the
> time. Git signing works as expected. About 2/3 of the time I SSH into the
> machine. Git signing does not work when SSH'd in.
> 
> When Git signing fails over SSH an error looks like:
> 
>    $ git commit -S log.h -m "Remove unneeded header"
>    error: gpg failed to sign the data
>    fatal: failed to write commit object
> 
> I just noticed this today (but it makes sense)...
> 
>     - Go to desktop workstation, log in
>     - Go to remote machine, log in
>     - Sign at remote machine over SSH
>       - Desktop workstation will open GUI password prompt
>       - Remote machine sign operation will hang until GUI prompt times-out
> 
> The problem was reported to Ubuntu but no activity:
> https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 .

I would refer you to the GnuPG project lists for answers to this issue. However, AFAIK, gpg requires a real terminal from which to obtain a password with the intent of not allowing malicious code to capture the password by a man-in-the-middle attack. Depending on the platform, stdin is not acceptable. Check the GnuPG project common/ttyio.c module. It may be that your setup is not providing an apparent terminal so the prompt may actually be happening elsewhere than where you expect. I have had a similar issue with Jenkins when not running fully headless, and the password prompt was on the tty where Jenkins was started. This is unlikely a "hang" per se.

Good luck,
Randall

Re: Commit signing and pinentry problems

[brian m. carlson]

[-- Attachment #1: Type: text/plain, Size: 1455 bytes --]

On 2019-11-20 at 12:41:23, Jeffrey Walton wrote:
> Hi Everyone,
> 
> I'm having an annoying problem that I can't figure out. I hope Git has
> a setting to fix it.
> 
> I have a desktop workstation where I sit at the keyboard about 1/3 of
> the time. Git signing works as expected. About 2/3 of the time I SSH
> into the machine. Git signing does not work when SSH'd in.
> 
> When Git signing fails over SSH an error looks like:
> 
>    $ git commit -S log.h -m "Remove unneeded header"
>    error: gpg failed to sign the data
>    fatal: failed to write commit object
> 
> I just noticed this today (but it makes sense)...
> 
>     - Go to desktop workstation, log in
>     - Go to remote machine, log in
>     - Sign at remote machine over SSH
>       - Desktop workstation will open GUI password prompt
>       - Remote machine sign operation will hang until GUI prompt times-out

This isn't really a Git problem, so much as a GnuPG one.
You probably want to use the curses pinentry input instead of the GUI
one.  If you're using Ubuntu, you can set "pinentry-program
/usr/bin/pinentry-curses" in ~/.gnupg/gpg-agent.conf, kill all of the
gpg-agent processes, and then attempt to sign again.

You may also need to set GPG_TTY and/or kill the gpg-agent process when
logging in remotely.  See gpg-agent(1) for details on configuration and
use.
-- 
brian m. carlson: Houston, Texas, US
OpenPGP: https://keybase.io/bk2204

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 868 bytes --]

Re: Commit signing and pinentry problems

[Jeffrey Walton]

On Wed, Nov 20, 2019 at 7:41 AM Jeffrey Walton <noloader@gmail.com> wrote:
>
> I'm having an annoying problem that I can't figure out. I hope Git has
> a setting to fix it.
>
> I have a desktop workstation where I sit at the keyboard about 1/3 of
> the time. Git signing works as expected. About 2/3 of the time I SSH
> into the machine. Git signing does not work when SSH'd in.
>
> When Git signing fails over SSH an error looks like:
>
>    $ git commit -S log.h -m "Remove unneeded header"
>    error: gpg failed to sign the data
>    fatal: failed to write commit object
>
> I just noticed this today (but it makes sense)...
>
>     - Go to desktop workstation, log in
>     - Go to remote machine, log in
>     - Sign at remote machine over SSH
>       - Desktop workstation will open GUI password prompt
>       - Remote machine sign operation will hang until GUI prompt times-out
>
> The problem was reported to Ubuntu but no activity:
> https://bugs.launchpad.net/ubuntu/+source/pinentry/+bug/1852696 .
>
> Does anyone know how to use Git to work around pinentry brain-dead-ness?

This fellow's answer fixed this problem: https://stackoverflow.com/a/53641081

Jeff