4

I'm having trouble using gpg (actually, the gpg-agent) on my Debian Bullseye (Stable) system. More precisely, I use the following:

gpg --version | head -n2
gpg (GnuPG) 2.2.27
libgcrypt 1.8.8

uname -v
#1 SMP Debian 5.10.46-4 (2021-08-03)

lsb_release -a 2> /dev/null
Distributor ID: Debian
Description:    Debian GNU/Linux 11 (bullseye)
Release:    11
Codename:   bullseye

I haven't rebooted my machine for approx 3 months. During that time I was able to use gpg without difficulties (encrypting, decrypting, signing, verifying, key management). I made multiple updates during the last months, none of which created any problems for me (in addition I'm using needrestart). I didn't change anything in the relevant config files (I know of, being ~/.gnupg/gpg.conf, ~/.gnupg/gpg-agent.conf, ~/.gnupg/dirmngr.conf) in the last 3 months.

Today I restarted my machine and suddenly I wasn't able to use my gpg-agent for anything, where secret keys are involved. While gpg -k [1] and gpg --search-keys DEADBEEF lead to results, gpg -K as well as gpg -d /PATH/TO/ENCRYPTED/FILE hangs indefinitely. Similarly, gpg-connect-agent reloadagent /bye and gpgconf --kill gpg-agent as well as systemctl --user start gpg-agent leads to hanging. Similarly, my systemd-unit-file is not out of the ordenary:

systemctl --user cat gpg-agent | grep -Ev '^#|^$'
[Unit]
Description     = gpg-agent (password store for gpg-keys)
[Service]
Type            = forking
ExecStart       = /usr/bin/gpg-agent --daemon
ExecStop        = /usr/bin/gpg-connect-agent /bye
Restart         = on-abort
[Install]
WantedBy        = default.target

I'm aware that this problem has already been described by others (see e.g. here but the mentioned solution (pkill -9 gpg-agent) does not apply to me, since this is happening eventhough no other process containing the string gpg (read: the gpg-agent) is running.

ps -ef | grep gpg && echo " " && gpg --verbose --debug-level guru -K
MYUSERNAME     59248 59247  0 17:17 pts/1    00:00:00 grep --color=auto gpg
 
gpg: enabled debug flags: packet mpi crypto filter iobuf memory cache memstat trust hashing ipc clock lookup extprog
gpg: DBG: [not enabled in the source] start
gpg: DBG: [not enabled in the source] keydb_new
gpg: DBG: [not enabled in the source] keydb_search_reset
gpg: DBG: keydb_search: reset  (hd=0x000055c04a474cd0)
gpg: DBG: [not enabled in the source] keydb_search enter
gpg: DBG: keydb_search: 1 search descriptions:
gpg: DBG: keydb_search   0: FIRST
gpg: DBG: keydb_search: searching keybox (resource 0 of 1)
gpg: DBG: keydb_search: searched keybox (resource 0 of 1) => Success
gpg: DBG: [not enabled in the source] keydb_search leave (found)
gpg: DBG: [not enabled in the source] keydb_get_keybock enter
gpg: DBG: parse_packet(iob=1): type=6 length=51 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=12 length=12 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=13 length=19 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=12 length=12 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=2 length=150 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=12 length=6 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=2 length=150 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=12 length=6 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=14 length=56 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=2 length=126 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=12 length=6 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=14 length=51 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=2 length=245 (parse.../../g10/keydb.c.1242)
gpg: DBG: parse_packet(iob=1): type=12 length=6 (parse.../../g10/keydb.c.1242)
gpg: DBG: iobuf-1.0: underflow: buffer size: 924; still buffered: 0 => space for 924 bytes
gpg: DBG: iobuf-1.0: close '?'

<<< HERE HANGING INDEFINITELY >>>

^C
gpg: signal Interrupt caught ... exiting

Also my variables GPG_AGENT_INFO and GPG_TTY are set.

echo -e "$GPG_AGENT_INFO\n$GPG_TTY"
/run/user/1000/gnupg/S.gpg-agent:0:1
/dev/pts/1

Rebooting btw. didn't change anything. Any ideas?


edit1: reinstalling gpg, gpg-agent and dirmngr doesn't fix the issue. Additionally, removing the files ~/.gnupg/gpg.conf, ~/.gnupg/gpg-agent.conf and ~/.gnupg/dirmngr.conf doesn't solve it.


edit2: in the meantime I upgraded from PureOS Amber to Debian Stable (Bullseye) and reinstalled a new version of gpg, gpg-agent, dirmngr and libgcrypt20 (and changed the text above to reflect the new version), but the problem is still present.


[1] technically speaking gpg -k also hung, but I assume this was because I enabeled the option with-secret in my gpg.conf-file. After commenting that out this problem disappeared.

2 Answers 2

1

I finally found a solution, although I'm not sure I understand it.

Somehow the version of gpg-agent started by systemd was the issue. When performing systemctl --user mask gpg-agent and then restarting the gpg-agent manually, the problem disappeared. I'll try to understand why that was the case and then write an update here.

3
  • What are the Private* and Protect* rules in the SystemD unit file(s)?
    – xebeche
    Commented Sep 19, 2021 at 14:43
  • @xebeche: I'm unfamiliar with those terms, what exactly to you mean? I masked the gpg-agent systemd-service, the other ones relevant for working with gpg don't have that string present (when running systemctl --user cat gpg* | grep -E -i 'private|protect' I don't get any output).
    – n0542344
    Commented Sep 19, 2021 at 21:15
  • So my guess was wrong. About Private* etc. see e.g. systemd.exec(5)
    – xebeche
    Commented Sep 20, 2021 at 17:50
0

Usually if you reinstall gnupg, the problem will be solved. Unless the cause of the problem is something else.

1
  • I'm afraid that wasn't it - after running ` sudo apt install --reinstall gpg gpg-agent dirmngr` with a subsequent killall -9 gpg2 gpg-agent the command gpg -K still hangs.
    – n0542344
    Commented Sep 14, 2021 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .