2016-03-17 GPG Agent and Emacs

I updated Gmail, Gnus and GPG on a Mac, on Emacs Wiki, with the information I discovered below.

In my Gmail Gnus GPG Guide I don’t mention gpg-agent because I never managed to set it up correctly for OSX.

Well, perhaps things will change. I followed the instructions on this blog post, I think, and it works on the command line. I can encrypt a text to myself, when I decrypt it, I’m asked for my passphrase, and when I decrypt it again, I’m not asked for my passphrase because the agent handles it.

This requires my gpg-agent.conf file to contain the line pinentry-program /usr/local/bin/pinentry which is the equivalent to pinentry-curses.

It used to say pinentry-program /usr/local/bin/pinentry-mac, however!

If I use pinentry-mac:

alex@Megabombus:~$ gpg -d test.txt.gpg 

You need a passphrase to unlock the secret key for
user: "Alex Schroeder <>"
8192-bit RSA key, ID 4529A45C, created 2015-03-01 (main key ID ACECFEAE)

gpg: problem with the agent: No pinentry
gpg: encrypted with 8192-bit RSA key, ID 4529A45C, created 2015-03-01
      "Alex Schroeder <>"
gpg: public key decryption failed: Operation cancelled
gpg: decryption failed: No secret key

If I use pinentry-curses:

alex@Megabombus:~$ echo RELOADAGENT | gpg-connect-agent 
alex@Megabombus:~$ gpg -d test.txt.gpg 
   │ Please enter the passphrase to unlock the secret key for the OpenPGP  │
   │ certificate:                                                          │
   │ "Alex Schroeder <>"                               │
   │ 8192-bit RSA key, ID 4529A45C,                                        │
   │ created 2015-03-01 (main key ID ACECFEAE).                            │
   │                                                                       │
   │                                                                       │
   │ Passphrase __________________________________________________________ │
   │                                                                       │
   │          <OK>                                         <Cancel>        │

Within Emacs

Without the agent running, and with pinentry-mac, it would work from within Emacs (which is what I want to get working). When the agent is running, no matter what the pinentry-program line says, it won’t work.

This is what the *Messages* buffer says:

Decrypting /Users/alex/test.txt.gpg...done
epa-file--find-file-not-found-function: Opening input file: Decryption failed, 

I’m guessing this is a pinentry problem. Not exactly the same string, though. So… Any ideas? What’s wrong? Should I be setting GPG_TTY? The problem appears to be that if I don’t use gpg-agent, Emacs using gpg knows how to call pinentry-mac. If I do use the gpg-agent, then the gpg-agent tries to call pinentry-mac and fails.

Currently the environment for my Emacs session has the following, as determined by running printenv in *eshell*:

GPG_TTY=not a tty

That looks wrong… I’m surprised that GPG_TTY is set in the first place. I’m setting it in my .bashrc file! So starting Emacs uses a shell? I don’t know how Emacs does that.

alex@Megabombus:~$ ps -fx|grep emacs
  502 42011     1   0  7:34am ??         0:02.88 /usr/local/Cellar/emacs-mac/emacs-24.5-z-mac-5.15/

My Config

In ~/Library/LaunchAgents/org.gnupg.gpg-agent.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
<plist version="1.0">

In ~/bin/

# ${HOME}/.gpg-agent-info is the default filename
if test -f $HOME/.gpg-agent-info && \
	kill -0 `cut -d: -f 2 $HOME/.gpg-agent-info` 2>/dev/null; then
    GPG_AGENT_INFO=`cat $HOME/.gpg-agent-info`
    export GPG_AGENT_INFO
    eval `/usr/local/bin/gpg-agent --daemon --write-env-file`

In ~/.bashrc, which is also sourced from ~/.bash_profile:

if [ -f "${HOME}/.gpg-agent-info" ]; then
    . "${HOME}/.gpg-agent-info"
    export GPG_AGENT_INFO
    export SSH_AUTH_SOCK
export GPG_TTY

In ~/.gnupg/gnu-agent.conf:

pinentry-program /usr/local/bin/pinentry-mac


OK, this is weird.

In a terminal, it works, if I provide --pinentry-program=/usr/local/bin/pinentry-mac as a startup parameter to gpg-agent.

In Emacs, it works, if I use pinentry-program /usr/local/bin/pinentry-mac in my gpg-agent.conf file.

One would think that the two affect the same thing, but not so. I have no idea why that is so. I’ll have to test this.

Log out and log back in. Nope, nothing works. So, at least I know that there is a way to fix this, even if I don’t know what it is!

gpg: problem with the agent: No pinentry

So here’s how I managed to “fix” it again, in a terminal:

  1. use ps aux | grep gpg to determine the process id of gpg-agent
  2. use kill to kill it
  3. run bin/ again
  4. run source ~/.gpg-agent-info to set the environment variables again
  5. try gpg -d test.txt.gpg to decrypt my test file – and the GUI pinentry opens!

So. What changed? I have no idea.

Within Emacs, I used setenv to set the GPG_AGENT_INFO to the new value, and it worked: I could open my test file, got asked for my passphrase, killed the buffer, reopened it, and was no longer asked for a passphrase.

So now I’m going to revert the addition of --pinentry-program to the script, and see whether simply killing and restarting it from a terminal also “fixes” it. And then we’ll start worrying about the difference between all this stuff.

OK, so restarting this Mac apparently “fixed” all the issues I was having.


Comments on 2016-03-17 GPG Agent and Emacs

I recently stumbled over this somewhere:

Works great for me (especilly when ssh’ing with X-forwarding) - might be worth trying as well.

Adam 2016-03-18 20:08 UTC

Haha, “This is probably totally insecure, and your passphrase may be leaked! Use at your own risk!” Also, what happens when you’re in a terminal and use gpg – does it start Emacs, or the Emacs Client, and thus you need to be running Emacs somewhere?

– Alex Schroeder 2016-03-18 21:32 UTC

There is also an ELPA package called “pinentry”; as the note in the package description says, it works “with GnuPG (2.1.5+) and Pinentry (not yet released, possibly 0.9.5+)”. It works here.

– Sam 2016-03-19 10:21 UTC

Is that the same pinentry-emacs as ? I see a pinentry-emacs is installed by pinentry 0.9.7 on my Arch box.

I have the same question about what happens when if using that when outside emacs (would prefer having both possibilities).

– Kevin Unhammer 2016-04-25 07:28 UTC

pinentry.el works for me :)

– Kevin Unhammer 2016-04-25 08:04 UTC

Add Comment

2016-01-23 Testing Encrypted Mail Setup

I’ve updated my guide, the Gmail Gnus GPG Guide (GGGG) to incorporate the latest addition to the FSF’s Email Self-Defense guide to free software-powered encryption. They even have a guide on how to help your friends and family, including talking points if want to make your case.

Anyway, the thing I added to the guide is how to initiate communication with the bot:

  1. send him your Public key
  2. get his public key from a keyserver
  3. how to set up a keyserver in order to achieve step #2
  4. send him an encrypted mail


Comments on 2016-01-23 Testing Encrypted Mail Setup

The public (not private) key should be sent in point 1. Best regards, A.

– A. 2016-01-23 16:01 UTC


– Alex Schroeder 2016-01-23 16:36 UTC


By the way, what’s the reason to use gpg instead of gpg2?

– AlexDaniel 2016-01-23 22:44 UTC

Also, it looks like it has to be ~/.gnus.el instead of ~/.gnus.

– AlexDaniel 2016-01-24 00:07 UTC

Hm, I think ~/.gnus is fine, according to the manual: “… and gnus-init-file (‘~/.gnus’ by default)”

As for the GPG version, I am using gpg. Perhaps on Debian version 2 is only available as gpg2?

alex@Megabombus:~$ gpg --version
gpg (GnuPG) 2.0.29
libgcrypt 1.6.4
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: ~/.gnupg
Supported algorithms:
Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

– Alex Schroeder 2016-01-24 00:15 UTC

Interesting. Also it would be great to know how to make gnus sort things in the right order by default…

– AlexDaniel 2016-01-24 00:35 UTC

Oh well. It seems like the idea is to have only unread messages visible by default. If you keep it this way then there’s no reason to change the order. Hmmmm.

– AlexDaniel 2016-01-24 01:37 UTC

I’m not sure if this approach is really useful. Gmail sorts messages into three tabs – Primary, Social and Promotions. Obviously I never read Social and Promotions, and I even ignore some messages in Primary. That’s the result:

In such case default settings in gnus are so alien. But I thought that it is how all people read their emails? Is there any way to get this Primary/Social/Promotions distinction in gnus?

– AlexDaniel 2016-01-24 01:40 UTC

Not unless Gmail makes the tabs available via IMAP, i.e. via folders (like it does for labels). I don’t think this is happening. Apparently you can search for them but I don’t understand how you would use this from Gnus. [1]

– Alex Schroeder 2016-01-27 20:26 UTC

Add Comment

2016-01-02 Let’s Encrypt

I decided to give Let’s Encrypt a try. I’m still running Debian Wheezy:

alex@kallobombus:~$ lsb_release -a
No LSB modules are available.
Distributor ID:	Debian
Description:	Debian GNU/Linux 7.9 (wheezy)
Release:	7.9
Codename:	wheezy

I followed their instructions for letsencrypt-auto:

git clone
cd letsencrypt

And then I picked the Webroot plugin:

./letsencrypt-auto certonly --webroot -w ~/ -d

I had to provide my email address and agree to their terms and conditions and that seemed to work. I added the necessary config parameters myself. The site’s config file was /etc/apache2/sites-available/ and the two important parts are the following two points:

  1. The virtual host on port 80 does nothing but redirect to the secured version
  2. The virtual host on port 443 refers to the files created in /etc/letsencrypt/live/

As I’m using Debian Wheezy this means I’m using Apache/2.2.22 (Debian) mod_ssl/2.2.22 OpenSSL/1.0.1e.

<VirtualHost *:80>
    Redirect permanent /
<VirtualHost *:443>
    <Directory />
        Options None
        AllowOverride None
        Order Deny,Allow
        Deny from all
    DocumentRoot /home/alex/
    <Directory /home/alex/>
        Options ExecCGI Includes Indexes MultiViews SymLinksIfOwnerMatch
        AddHandler cgi-script .pl
        AllowOverride All
        Order Allow,Deny
        Allow from all

    SSLEngine on
    SSLCertificateFile      /etc/letsencrypt/live/
    SSLCertificateKeyFile   /etc/letsencrypt/live/
    SSLCertificateChainFile /etc/letsencrypt/live/
    SSLVerifyClient None



  1. cron job (see forum)
  2. more sites (I’m waiting for their current SSH certificates to expire in the coming years)

For the cron job, it seems that we cannot just run letsencrypt-auto, we need to specify all the stuff we used in previous calls. If we don’t, we’re told: «No installers seem to be present and working on your system; fix that or try running letsencrypt with the “certonly” command.» If we use the certonly command, then we’re asked for domain names…

So, these commands all need to be run because I use a different certificate for every domain:

~/src/letsencrypt/letsencrypt-auto certonly --webroot -w ~/    -d    -d
~/src/letsencrypt/letsencrypt-auto certonly --webroot -w ~/ -d -d
~/src/letsencrypt/letsencrypt-auto certonly --webroot -w ~/    -d    -d
~/src/letsencrypt/letsencrypt-auto certonly --webroot -w ~/   -d   -d
~/src/letsencrypt/letsencrypt-auto certonly --webroot -w ~/          -d          -d
~/src/letsencrypt/letsencrypt-auto certonly --webroot -w ~/         -d         -d
~/src/letsencrypt/letsencrypt-auto certonly --webroot -w ~/   -d   -d
sudo service apache2 graceful

And, elsewhere:

/home/nicferrier/src/letsencrypt/letsencrypt-auto certonly --webroot -w /home/nicferrier/ -d

Ignoring SNIMissingWarning on this Ubuntu 14.04.1 LTS…

Also, calling letsencrypt-auto requires root privileges. Yikes!


Comments on 2016-01-02 Let’s Encrypt

Hi Alex

Do I need to git installed doing this?


– Ben 2016-04-28 17:17 UTC

Maybe? If you’re running a new operating system, your package manager might know how to install everything. If you are running Debian Wheezy, then you do need it. See the Getting Started page.

– Alex Schroeder 2016-04-28 22:09 UTC

Well thanks, but my question was about, if I would need to install git first (and which version, backport or normal) on wheezy to “git clone” the letsencrypt package. No one really says this clearly enough for me… :)

– Ben 2016-04-29 13:33 UTC

Add Comment

2014-01-23 Verschlüsselung

Auf Google+ lese ich immer gerne die Beiträge von Kristian Köhntopp. Heute einen geteilten Artikel von Stefan Münz, in dem dieser schrieb:

NSA, Millionen Mail-Zugangsdaten in Botnets … nein, das ist nicht das Ende des Internet. Es ist nur das Ende überholter bürgerlicher Vorstellungen von Privatsphäre, die in Zukunft so nicht mehr haltbar sein werden (und auch übrigens vor hundert oder zweihundert Jahren in dieser Form auch nicht existierten). Kurzum: es geht um jenen Abschied von gepflegter Heimlichkeit, den die Spackeria schon vor ein paar Jahren propagiert hat. […] Das Netz ist ein Forum, eine Fußgängerzone. We are public. – Stefan Münz

Darauf haben einige Leute in Kristian Köhntopps Kommentaren die Möglichkeiten und Grenzen der Kryptographie diskutiert. Ich selber meinte dazu allerdings:

Es ist nichts dagegen einzuwenden, die “gepflegte Heimlichkeit” zu wollen, egal ob die “Spackeria” das auch will oder sie “vor hundert oder zweihundert Jahren in dieser Form auch nicht existierten”. Der Ist-Zustand ist nicht unveränderlich.

Manchmal wirft man der Justiz vor, mit veralteten Gesetzen neue Tatsachen beurteilen zu wollen. In diesem Fall will ich aber genau mit meiner (veralteten Spackeria-?) Moralvorstellung die alten Gesetze (oder Wunschvorstellungen) beibehalten. Die Privatsphäre, den Schutz der Kommunikation, den Schutz derjenigen, die Missstände aufdecken, den Schutz der Journalisten, den Schutz ihrer Quellen, und so weiter. Und ich will hierfür die moderne Technik verwenden können.

Wenn das Netz eine “Fußgängerzone” ist, dann heisst das ja noch lange nicht, dass keine Regeln gilt, dass wir keine Erwartungen an unsere Mitbürger haben. Deswegen muss man halt an vielen Strängen gleichzeitig ziehen. Nur auf der Machbarkeit der Verschlüsselung herum zu reiten ist nicht zielführend.

Eine andere Welt ist möglich. Die Gegenwart als unveränderlich zu beschreiben ist konservativ.

Meinen öffentlichen Schlüssel gibt es über die üblichen Schlüsselserver.

pub   1024D/353AEFEF 2002-07-10 [expires: 2014-11-01]
      Key fingerprint = 92F1 9F7D D289 D4D8 CEAE  0427 7573 68E7 353A EFEF


Add Comment

2014-01-15 Crypto-Gram

I recommend you all subscribe to Bruce Schneier’s Crypto-Gram newsletter if you aren’t subscribed to his blog. Today’s Crypto-Gram, for example, has this excellent passage:

Not only is ubiquitous surveillance ineffective, it is extraordinarily costly. I don’t mean just the budgets, which will continue to skyrocket. Or the diplomatic costs, as country after country learns of our surveillance programs against their citizens. I’m also talking about the cost to our society. It breaks so much of what our society has built. It breaks our political systems, as Congress is unable to provide any meaningful oversight and citizens are kept in the dark about what government does. It breaks our legal systems, as laws are ignored or reinterpreted, and people are unable to challenge government actions in court. It breaks our commercial systems, as US computer products and services are no longer trusted worldwide. It breaks our technical systems, as the very protocols of the Internet become untrusted. And it breaks our social systems; the loss of privacy, freedom, and liberty is much more damaging to our society than the occasional act of random violence. – Bruce Schneier, How the NSA Threatens National Security


Add Comment

2013-08-20 Public Key Fiasco

I got my first encrypted email in years. I use GnuPG.

  1. I didn’t have the necessary secret key available. I found it in an old backup I still had available.
  2. I didn’t know the passphrase required to use the secret key I just found. I tried guessing for a while, to no avail.
  3. I wanted to revoke the secret key or change it’s expiry. That requires the unknown passphrase.

This is stupid. #fail

Sad story from the distant past: In 2005 my old keys appeared not to work when I tried sending email to a friend. When we don’t use these tools every now and then, we won’t be able to use them when it’s required of us.

As I considered my setup, I decided I might want to upgrade my !GnuPG 1.4.9 installation. Building it myself… it requires libassuan, libksba, the GNU Portable Threads Library, iconv, and libgpg-error. Starting all the jobs and realizing that iconv doesn’t install. Fuuuuuu!

I think I will do a Backup of the system and install Homebrew. And then, at last, after many hours, no doubt, I’ll brew gpg.

As the backup is being made, I discover an old revocation certificate for the damn key without a passphrase. And it works!

On the key servers:

gpg: suche nach "kensanata" auf hkp-Server
(1)	Alex Schroeder <>
	Alex Schroeder <>
	Alex Schroeder <>
	Alex Schroeder <>
	  1024 bit DSA key 89D0FBCC, erzeugt: 2006-06-26 (widerrufen)
(2)	Alex Schroeder <>
	Alex Schroeder <>
	Alex Schroeder <>
	  1024 bit DSA key 353AEFEF, erzeugt: 2002-07-10
(3)	Alex Schroeder (Kensanata) <>
	  1024 bit DSA key 23AAC850, erzeugt: 2001-04-12

Key status:

pub   1024D/353AEFEF 2002-07-10 [verfällt: 2015-08-20]
uid                  Alex Schroeder <>
uid                  Alex Schroeder <>
uid                  Alex Schroeder <>
uid                  [jpeg image of size 5665]
sub   4096R/363A61EE 2013-08-20 [verfällt: 2015-08-20]

pub   1024D/89D0FBCC 2006-06-26 [widerrufen: 2006-06-26]
uid                  Alex Schroeder <>
uid                  Alex Schroeder <>
uid                  Alex Schroeder <>
uid                  Alex Schroeder <>

pub   1024D/23AAC850 2001-04-12 [verfallen: 2002-04-12]
uid                  Alex Schroeder (Kensanata) <>

353AEFEF and 363A61EE are the ones to use. :) 👌

Tags: RSS

Add Comment

2008-05-15 Regenerate Keys

DSA-1571 openssl – the bug that forces you to regenerate all your keys. Gah!


Add Comment