[MGPG-92] `--pinentry-mode error` cannot be used with gpg-agent "extra" socket

[jira-importer]

Nick Dimiduk opened MGPG-92 and commented

Over on HBASE-27312, we found an issue in our release automation, which relies on using this plugin and a GnuPG agent for performing builds inside of an isolated environment. With GPG version >= 2.1, the plugin will make use of --pinentry-mode error. This feature appears to not be available using the "extra" gpg-agent socket. We had to "upgrade" to using the "standard" socket, which probably exposes more gpg features to the isolated environment than we would like.

---

Issue Links:

• HBASE-27312 Update create-release to work with maven-gpg-plugin-3.0.1 and gnupg >= 2.1.x

[jira-importer]

Nick Dimiduk commented

I think that I filed this backwards. The extra socket has restricted permissions, and setting pinentry-mode is not permitted when connecting via the extra socket.

[jira-importer]

Tamas Cservenak commented

In isolated environment the "bc" signer (see MGPG-106) is recommended, without hoops and loops (and provide key and passphrase as env values).

[jira-importer]

Nick Dimiduk commented

I may be mistaken, but I think this is not possible when the signing material is stored on a hardware device. In this case, there is no password that can be provided, and the only option is forwarding the agent. Anyway, this use-case where this came up is not an "isolated" environment, though it is jumping through several hoops in order to sign in a container process running in a VM on the localhost (i.e., Docker Desktop + MacOS).

[jira-importer]

Tamas Cservenak commented

True, in case of HW device BouncyCastle signer will not help.

Am not quite educated with HW keys, could you maybe provide a PR or at least a "hint" what should be modified to make it work for you?

[jira-importer]

Nick Dimiduk commented

GPG appears to not permit the command line parameter --pinentry-mode when connecting to the agent via the extra socket. I suggest that the GPG plugin not hard-code this aspect of the command line. Maybe it exposes the command line arguments as a configurable from the plugin config xml? Or maybe it can detect which socket is in use and form its command line with this under consideration?

If you're interested to get started with hardware keys, this is a very thorough reference: https://github.com/drduh/YubiKey-Guide