[Feature]: Support new keyboxd gpg pubring format
#54
Comments
|
Many thanks for letting me know! I'll try to get to this soon, but if you are eager to try something, I suspect and hope that simply adjusting the path here to the new file will do the trick. yubikey-touch-detector/main.go Line 81 in 3b3aaaf And if this works, we can update that part of the code to initialize |
|
Yeah, unfortunately this doesn't work :^( Firstly, I've tried just to symlink the ln -s ~/.gnupg/public-keys.d/pubring.db ~/.gnupg/pubring.kbxAnd executing the ❯ yubikey-touch-detector -v
DEBU[2024-03-13T19:31:11Z] Starting YubiKey touch detector
DEBU[2024-03-13T19:31:11Z] HMAC watcher on '/dev' is successfully established
DEBU[2024-03-13T19:31:11Z] U2F watcher on '/dev' is successfully established
DEBU[2024-03-13T19:31:11Z] GPG watcher is successfully established
DEBU[2024-03-13T19:31:11Z] SSH watcher is successfully established However, signing/encrypting echo test | gpg -se -u "$KEYID" -r "$KEYID" | gpg -sadly doesn't output anything :( With your suggestion, I've adjusted diff --git a/main.go b/main.go
index 3b2d0c4..d697169 100644
--- a/main.go
+++ b/main.go
@@ -78,7 +78,7 @@ func main() {
} else if ctx.SetProtocol(gpgme.ProtocolAssuan) != nil {
log.Debugf("Cannot initialize Assuan IPC: %v. Disabling GPG and SSH watchers.", err)
} else {
- gpgPubringPath := path.Join(gpgme.GetDirInfo("homedir"), "pubring.kbx")
+ gpgPubringPath := path.Join(gpgme.GetDirInfo("homedir"), "public-keys.d/pubring.db")
if _, err := os.Stat(gpgPubringPath); err == nil {
requestGPGCheck := make(chan bool)And recompiled binary with ❯ ps | grep keybox
5845 sh │ 0.0 0.0 00:00:00 │ keyboxd --homedir /home/sh/.gnupg --daemon |
|
I've tried to kill all pkill -9 gpg-agent; pkill -9 scdaemon; pkill -9 keyboxdThen, I've executed echo test | gpg -se -u "$KEYID" -r "$KEYID" | gpg -And finally events are being printed: DEBU[2024-03-13T19:45:42Z] Starting YubiKey touch detector
DEBU[2024-03-13T19:45:42Z] U2F watcher on '/dev' is successfully established
DEBU[2024-03-13T19:45:42Z] HMAC watcher on '/dev' is successfully established
DEBU[2024-03-13T19:45:42Z] SSH watcher is successfully established
DEBU[2024-03-13T19:45:42Z] GPG watcher is successfully established
DEBU[2024-03-13T19:45:45Z] [notifiers/debug] GPG_1
DEBU[2024-03-13T19:45:49Z] AssuanSend/status: PROGRESS, learncard k 0 0
DEBU[2024-03-13T19:45:49Z] AssuanSend/status: PROGRESS, learncard k 0 0
DEBU[2024-03-13T19:45:49Z] AssuanSend/status: PROGRESS, learncard k 0 0
DEBU[2024-03-13T19:45:49Z] [notifiers/debug] GPG_0 But that worked only once. After that, encrypting/signing |
|
I see... Thanks for your experiments! While I don't have the setup yet to reproduce this, I can speculate based on your findings. I think you would appreciate to know these details first: the way Based on your latest log, it looks like We'll need to think how to handle this 🤔 It was clear from the beginning that this whole logic is based on a dirty hack, and that one day gpg might change how it internally works with regards to opening keyring file. Today is that day, it seems 😁 cc @mochaaP you might find this thread curious, since you contributed recently to improving |
|
A few questions:
If the lock could be detected in our process, we could use that |
|
Here is a gpg-agent trace: here is a strace from keyboxd: Here is a test about db lock: |
|
seems great, will try to implement this after I finish my work on some Win32 drivers 😅 |
|
done that. will look at it later this weekend |
|
seems this is quite trivial: we just need to poll |
|
By linking to sqlite3, would we be able to be "notified" about the lock, instead of constantly polling? |
|
to my knowledge, no. the underlying syscall is the same after all. |
|
But it would be easier to find the offset to lock instead of reading the database ourselves |
|
I'd really love us to first explore some other ways which can be event-based, instead of poll-based... For example, although inotify's It looks like if we simply back up our |
|
I already poked around using inotify, unfortunately, with no avail. 😿 |
Hey 👋
New
gpginstallations doesn't usepubring.kbxformat since2.4.1, and instead usekeyboxd(aka sqlite db) with the$HOME/.gnupg/public-keys.d/pubring.dbpath.Would be really awesome if
yubikey-touch-detectorgained support forkeyboxdformat, since newer installations are stuck without gpg detection 🥲Thanks!
The text was updated successfully, but these errors were encountered: