gnupg: No secret key (gpg-agent / pinentry interaction issue)

[Horst Schirmeier]

Since migration from gnupg 1.x to 2.1.15, gpg cannot decrypt my files anymore:

$ gpg -d < foo.gpg
gpg: encrypted with 4096-bit ELG key, ID XXXXXXXXX, created XXXX-XX-XX
      "XXX <xxx>"
gpg: public key decryption failed: Operation cancelled
gpg: decryption failed: No secret key

Increasing the gpg-agent loglevel reveals the following (note that in the whole process I was never prompted for my passphrase):

gpg-agent[11397] DBG: chan_5 -> INQUIRE PINENTRY_LAUNCHED 11477
gpg-agent[11397] DBG: chan_5 <- END
gpg-agent[11397] DBG: chan_6 -> SETKEYINFO n/XXXXXXXXXXXXXXXXX
gpg-agent[11397] DBG: chan_6 <- OK
gpg-agent[11397] DBG: chan_6 -> SETDESC Please enter the passphrase to unlock the OpenPGP secret key: ......
gpg-agent[11397] DBG: chan_6 <- OK
gpg-agent[11397] DBG: chan_6 -> SETPROMPT Passphrase:
gpg-agent[11397] DBG: chan_6 <- OK
gpg-agent[11397] DBG: chan_6 -> [[Confidential data not shown]]
gpg-agent[11397] DBG: chan_6 <- [[Confidential data not shown]]
gpg-agent[11397] DBG: error calling pinentry: Operation cancelled <Pinentry>
gpg-agent[11397] DBG: chan_6 -> BYE
gpg-agent[11397] failed to unprotect the secret key: Operation cancelled
gpg-agent[11397] failed to read the secret key
gpg-agent[11397] command 'PKDECRYPT' failed: Operation cancelled <Pinentry>
gpg-agent[11397] DBG: chan_5 -> ERR 83886179 Operation cancelled <Pinentry>
gpg-agent[11397] DBG: chan_5 <- [eof]

This looks a lot like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839547 -- which has a fix in pinentry/0.9.7-6 but hasn't made it to Ubuntu 16.10 yet.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Alejandro R. Mosteo (mosteo)]

Same here since upgrade to 16.10, working in the command line.

I've tried installing pinentry-gnome3 1.0.0-1 from the Z release without success.

When encrypting, no default recipient is detected due to a supposed missing private key. I can still encrypt when asked for recipients in the command line, giving my ID:

$ touch x
$ gpg -e x
gpg: Oops: keyid_from_fingerprint: no pubkey
You did not specify a user ID. (you may use "-r")

Current recipients:

Enter the user ID. End with an empty line:

When decrypting I'm not asked for any keys, just getting this error:

$ gpg -d x.gpg
gpg: encrypted with 4096-bit ELG key, ID XXXXXXXXXXXXXXXX, created 2016-09-15
      (personal info removed here)
gpg: decryption failed: No secret key

Everything works normally in a Trusy schroot in the same machine, using the same .gnupg folder.

I hadn't heard about pinentry until reading this bug report, anyway. Never used it.

[Alejandro R. Mosteo (mosteo)]

Just to report that the bug is still present in 17.04, and still using the 16.04 jail as workaround.

[Horst Schirmeier (horst)]

Cannot reproduce in 17.10 anymore, seems to be fixed. Can the other commenters confirm this?