Change pinentry program temporarily with gpg-agent

Question

I use gpg-agent sometimes with no X display or over ssh, so my config file contains:

pinentry-program /usr/bin/pinentry-curses

This way, the gpg passphrase is requested in curses.

That said, in some graphical scripts, I wish to use the GTK pinentry instead. How to call gpg and temporarily use a different pinentry?

Answer 1

You can use the PINENTRY_USER_DATA environment variable to give gpg information to pass to the pinentry command. You then need to set pinentry-program to a custom wrapper such as this that will run the curses or the GTK pinentry depending on that variable.

Note that this only seems to work with GPG 2.x, contrary to what the documentation of GPG 1.x says.

So with that script, you use gpg2 to use pinentry-curses and PINENTRY_USER_DATA="gtk" gpg2 to use pinentry-gtk-2.

Answer 2

Looking at man pinentry-gnome3, I see this:

   pinentry-gnome3  implements  a PIN entry dialog based on GNOME 3, which
   aims to follow the GNOME Human Interface Guidelines as closely as  pos‐
   sible.   If the X Window System is not active then an alternative text-
   mode dialog will be used.  There are other flavors that  implement  PIN
   entry dialogs using other tool kits.

Unfortunately, this text-mode fallback doesn't work for me. It seems others have the same issue. However, this comment spurred my to try a different GUI pin-entry program: pinentry-gtk2. You can switch like this:

> sudo update-alternatives --config pinentry
There are 3 choices for the alternative pinentry (providing /usr/bin/pinentry).

  Selection    Path                      Priority   Status
------------------------------------------------------------
* 0            /usr/bin/pinentry-gnome3   90        auto mode
  1            /usr/bin/pinentry-curses   50        manual mode
  2            /usr/bin/pinentry-gnome3   90        manual mode
  3            /usr/bin/pinentry-gtk-2    85        manual mode

Press <enter> to keep the current choice[*], or type selection number: 3
update-alternatives: using /usr/bin/pinentry-gtk-2 to provide /usr/bin/pinentry (pinentry) in manual mode

Once I switched, it worked perfectly for me! In a terminal on the desktop, it will use the GUI password entry, but when I ssh into my machine, it will use a text-mode password entry.