Yubikey stopped working after noble upgrade

[Mario Limonciello]

In Ubuntu 22.04 I used by GPG key stored on a Yubikey smart card, but since upgrading to Noble I get the following trying to access it.

$ gpg --card-status
gpg: selecting card failed: No such device
gpg: OpenPGP card not available: No such device

If I run this as root it works:

$ sudo gpg --card-status
Reader ...........: 1050:0407:X:0
Application ID ...: D2760001240100000006090826160000
Application type .: OpenPGP
Version ..........: 2.1
Manufacturer .....: Yubico
Serial number ....: XXXXXXXX
Name of cardholder: [not set]
Language prefs ...: [not set]
Salutation .......:
URL of public key : [not set]
Login data .......: [not set]
Signature PIN ....: not forced
Key attributes ...: rsa4096 rsa4096 rsa2048
Max. PIN lengths .: 127 127 127
PIN retry counter : 10 0 10
Signature counter : 1172
UIF setting ......: Sign=off Decrypt=off Auth=off
Signature key ....: <redacted>
      created ....: <redacted>
Encryption key....: <redacted>
      created ....: <redacted>
Authentication key: [none]
General key info..: [none]

If I manually run pcscd.service then it stops working both as root and a user.

$ sudo pkill -9 scdaemon
$ sudo systemctl start pcscd.service
$ gpg --card-status
gpg: selecting card failed: No such device
gpg: OpenPGP card not available: No such device
$ sudo gpg --card-status
gpg: selecting card failed: No such device
gpg: OpenPGP card not available: No such device

It might be worth mentioning I'm accessing the machine over SSH, so I also did experiment with a polkit rule like this:

polkit.addRule(function(action, subject) {
    if (action.id == "org.debian.pcsc-lite.access_card" &&
        subject.isInGroup("sudo")) {
        return polkit.Result.YES;
    }
});
polkit.addRule(function(action, subject) {
    if (action.id == "org.debian.pcsc-lite.access_pcsc" &&
        subject.isInGroup("sudo")) {
        return polkit.Result.YES;
    }
});

Added into /etc/polkit-1/rules.d/99-pcscd.rules and then reloading polkit.service in case this was a polkit issue, but this didn't do anything.

Versions in noble:
pcscd: 2.0.3-1build1
libpcslite1: 2.0.3-1build1
gnupg: 2.4.4-2ubuntu17
scdaemon: 2.4.4-2ubuntu17

[Mario Limonciello (superm1)]

I managed to get it working as a user by manually starting pcscd.service and with the following to force scdaemon to use it.

# cat ~/.gnupg/scdaemon.conf
card-timeout 5
disable-ccid

To me this seems to be a regression in behavior from 2.2.27-3ubuntu2.1 to 2.4.4-2ubuntu17.

[Mario Limonciello (superm1)]

According to the upstream bug, this appears to be a new intended behavior with newer gnupg2:

https://dev.gnupg.org/T6871

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Julian Andres Klode (juliank)]

I don't recommend running with pcscd, it's much more stable to run with direct access, but I do not know why it doesn't seem to work for you, it certainly does for me.

It failing with pcscd is nice, it not telling us why and how to fix it is bad UX though.

[Ludovic Rousseau (ludovic-rousseau-gmail)]

https://blog.apdu.fr/posts/2024/04/gnupg-and-pcsc-conflicts-episode-2/

I do not use GnuPG with a smartcard. So I don't know which configuration is more stable.