bug#54014: guix home pinentry weirdness

[Andrew Tropin]

On 2022-07-17 00:44, Zacchaeus Scheffer wrote:

> On Mon, Jul 4, 2022 at 1:50 AM Andrew Tropin <andrew@trop.in> wrote:
>
>> On 2022-02-15 13:46, Zacchaeus Scheffer wrote:
>> > There seems to be some problem installing password-store + pinentry
>> > entirely via guix home.  When I have both installed as such, I get the
>> > following outputs:
>> >
>> > $ pinentry
>> > OK Pleased to meet you
>> > <C-c>
>> > $ gpg --import ...
>> > [prompts normally with pinentry, allows me to import]
>> > $ pass
>> > [my password entries]
>> > $ pass [entry name]
>> > gpg: decryption failed: No secret key
>> > $ guix package -i pinentry
>> > $ pass [entry name]
>> > [prompts with pinentry and works normally]
>> >
>> > So pinentry and pass seem to both be available, but don't work together
>> > unless I install pinentry via guix package.
>>
>> I suspect that the problem is that someone at some moment of time
>> doesn't have ~/.guix-home/profile/bin in its $PATH and thus it can't
>> find a pinentry.  Can you show `which gpg`, `which pass`, `which
>> pinentry`?
>>
> Before running "guix package -i pinentry"
> $ which -a pinentry
> /home/zacchae/.guix-home/profile/bin/pinentry
> $ which -a gpg
> /home/zacchae/.guix-home/profile/bin/gpg
> $ which -a pass
> /home/zacchae/.guix-home/profile/bin/pass
> After runing "guix package -i pinentry"
> $ which -a pinentry
> /home/zacchae/.guix-home/profile/bin/pinentry
> /home/zacchae/.guix-profile/bin/pinentry
> $ which -a gpg
> /home/zacchae/.guix-home/profile/bin/gpg
> $ which -a pass
> /home/zacchae/.guix-home/profile/bin/pass
>
> I can easily reproduce the behavior by removing or installing pinentry with
> guix package.  Paths behave as expected.

Probably there are some hardcoded PATHs for .guix-profile, but not for
.guix-home/profile. One of such examples, which can be unrelated to the
current issue:
https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/system.scm?h=7046e777212233b89df68379c270b448c45195ce#n1012

It will require investigation to find all the places, where and at what
time PATH (and maybe some other env vars) is/are set for all the
participants of the party to trace the root of the problem and properly
solve it =) Anyway, there is a workaround, which should help:

>
> The gnupg home service from rde project goes a slightly other way and
>> just sets pinentry-program to absolute path in the store.  Such approach
>> works with pass well, you can take a look at it for inspiration:
>>
>> https://git.sr.ht/~abcdw/rde/tree/master/item/gnu/home-services/gnupg.scm#L127
>>
>  I don't totally follow what's going on here, but maybe it will make more
> sense later.

Basically it adds the following content to gpg-agent.conf:

--8<---------------cut here---------------start------------->8---
enable-ssh-support 
pinentry-program 
/gnu/store/r5j2gmfv8akp8p746l6jqy5qwpz0zkhm-pinentry-qt-1.2.0/bin/pinentry-qt
--8<---------------cut here---------------end--------------->8---

You can try to set pinentry-program to
/home/zacchae/.guix-home/profile/bin/pinentry

Or better directly use gnupg home service.

-- 
Best regards,
Andrew Tropin

signature.asc
Description: PGP signature