14

I understand that there are problems with getting pinentry-curses to work with emacs (see some of the comments on http://emacswiki.org/emacs/EasyPG), and so using emacs in a terminal isn't compatible with gpg-agent because of this.

I can't use a graphical pinentry tool in this case as this is over an ssh connection to a remote machine.

However, is it possible to feed the gpg-agent the passphrase beforehand and then have emacs use this, but not to prompt for a passphrase if the agent doesn't already have this info?

What settings would allow this to work with notmuch.el and EasyPG?

Or, are there alternative methods of caching the passphrase which would achieve the same effect, but may have security problems (which is the reason gpg-agent exists in the first place)?

Improve this question
2
  • 1
    should this be moved to emacs.stackexchange.com ?
    – unhammer
    Apr 25, 2016 at 8:04
  • 2
    Sure -- It's on here because I don't think emacs.stackexchange.com existed when I asked the question :)
    – David Gardner
    Apr 27, 2016 at 8:23

3 Answers 3

Reset to default
5

THIS! -> https://github.com/ecraven/pinentry-emacs

You'll have to do some wrenching, but using this thing worked for me. Put the script there into a directory in your PATH and then add the following entry to ~/.gnupg/gpg-agent.conf:

pinentry-program <path-to-pinentry-emacs>/pinentry-emacs

Then reload the agent:

$ echo RELOADAGENT | gpg-connect-agent

Works like a dream for me :)

Improve this answer
2
  • What happens if you're outside of emacs and need to enter a pin? (Is there a way to use pinentry-curses when asked from outside emacs, and pinentry-emacs when asked from inside emacs?)
    – unhammer
    Apr 25, 2016 at 7:25
  • gpg is supposed to be able to fall back to other pinentries if it can't access emacs pinentry, but I have emacs running on a daemon, so it never falls back for me :( When I use this, I must either not run emacs as a daemon (something I haven't tried), or I must have an emacs window open so I can put in my password
    – djhaskin987
    Apr 25, 2016 at 16:51
3

An alternative, if you have a fairly recent pinentry/gpg2 (tested with 0.9.7 and 2.1.11 respectively on Arch Linux), is to use http://elpa.gnu.org/packages/pinentry.html.

Install pinentry from M-x list-packages, then put 

allow-emacs-pinentry

in your .gnupg/gpg-agent.conf and put 

(setenv "INSIDE_EMACS" (format "%s,comint" emacs-version))
(pinentry-start)

in your .emacs.d/init.el. I had to put the setenv in there because, although INSIDE_EMACS is set when running M-x shell, it's not set when simply opening a .gpg file.

Now gpg-agent uses the regular curses version from the terminal, and from within Emacs it uses read-passwd (which hides the characters from prompt and from view-lossage).

EDIT: It seems the Debian package has a patch to remove Emacs support, so for now this solution only works for other distros / people prepared to compile pinentry themselves.

Improve this answer
4
  • The pinentry package help says: "NOTE: As of June 2015, this feature requires newer versions of GnuPG (2.1.5+) and Pinentry (not yet released, possibly 0.9.5+). For details, see the discussion on gnupg-devel mailing list: <lists.gnupg.org/pipermail/gnupg-devel/2015-May/029875.html>." So I've not managed to get this to work yet but shall try again soon!
    – David Gardner
    Apr 27, 2016 at 8:41
  • yeah, you'd need Ubuntu Xenial or Debian Stretch it seems (or Arch of course)
    – unhammer
    Apr 27, 2016 at 12:35
  • Edited answer; it seems Debian's pinentry package removed the Emacs support (which is included in Arch and Fedora, however). See bugs.gnupg.org/gnupg/msg6623 (and note that github.com/ecraven/pinentry-emacs confusingly is a completely different program).
    – unhammer
    Apr 27, 2016 at 21:04
  • 1
    Using GuixSD 0.11.0 with gpg 2.1.13 and emacs 25.1.1, the pinentry emacs package is "built-in". Also, there is no need to set the INSIDE_EMACS variable anymore, it just works, after setting the "allow-emacs-pinentry" option and pkill gpg-agent so that it restarts with the new setting the next time!
    – user30747
    Nov 17, 2016 at 6:32
3

In 2021, you can use the setting pinentry-mode loopback in ~/.gnupg/gpg.conf after setting up your gpg-agent and using allow-loopback-entry in ~/.gnupg/gpg-agent.conf

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.