GPGMail with unmounted key drive
I keep my private GPG keys on an encrypted disk image, for safety's sake. Running the latest nightly GPGMail (downloaded this morning), GPGmail doesn't acknowledge when the keys are available.
Steps to reproduce:
1) Place private key on disk image
2) Unmount disk image
3) Start Mail.app with GPGMail (no error message now! Yay!)
4) Compose a message
At this point, although the buttons are visible, both encrypt and sign are greyed out. Expected, as there's no key.
5) Mount your private key image
Still, both buttons are visible, but both greyed out and unclickable.
6) Quit Mail.app
7) Reopen Mail.app
8) Compose a message
There the buttons are. Now GPGMail functions as usual, and encryption/signing works as expected.
Thanks!
Will
Comments are currently closed for this discussion. You can start a new one.
Keyboard shortcuts
Generic
| ? | Show this help |
|---|---|
| ESC | Blurs the current field |
Comment Form
| r | Focus the comment reply box |
|---|---|
| ^ + ↩ | Submit the comment |
You can use Command ⌘ instead of Control ^ on Mac
Support Staff 1 Posted by Luke Le on 02 Mar, 2012 04:38 PM
Hi Will,
could you please try to create a symlink to the .gnupg folder on your USB key?
Basically you create a symlink to .gnupg in ~/
After that, GPGMail should do exactly what you want, without restarting.
If you want even more control, you can try to simply symlink the secring.gpg file to be able to write new encrypted messages (not sign though) and only decrypt and sign messages if the usb key is mounted.
Let me know if that works!
2 Posted by Will Styler on 02 Mar, 2012 04:50 PM
Luke,
.gnupg is actually in ~ already, the only file on the other drive is secring.gpg, which I'd pointed to in gpg.conf.
That said, after symlinking secring.gpg into ~/.gnupg and changing gpg.conf to point to ~/.gnupg/secring.gpg, I still need to restart mail to get GPG signing or decrypt as an option.
So, still an open issue. Sorry :(
WIll
Support Staff 3 Posted by Luke Le on 02 Mar, 2012 04:53 PM
I think the setup is not entirely as it should be.
Could you post the output of:
ls -ld ~/.gnupg
ls -l ~/.gnupg/
And the content of gpg.conf so I can further check and test with your environment?
4 Posted by Will Styler on 02 Mar, 2012 05:02 PM
Luke,
That may well be. Here's the info you requested.
username: ~/.gnupg $ ls -ld
drwx------@ 12 username staff 408 Mar 2 09:48 .
drwx------@ 12 username staff 408 Mar 2 09:48 .
username: ~/.gnupg $ ls -la
total 2904
drwx------@ 12 username staff 408 Mar 2 09:48 .
drwxr-xr-x@ 31 username staff 1054 Mar 2 09:46 ..
-rw-------@ 1 username staff 6148 Mar 1 22:27 .DS_Store
srwxr-xr-x 1 username staff 0 Mar 2 09:09 S.gpg-agent
-rw-r--r--@ 1 username staff 90 Mar 2 09:07 gpg-agent.conf
-rw-------@ 1 username staff 9431 Mar 2 09:46 gpg.conf
drwx------@ 2 username staff 68 Mar 1 22:27 private-keys-v1.d
-rw------- 1 username staff 722476 Mar 1 22:29 pubring.gpg
-rw-------@ 1 username staff 722476 Mar 1 22:27 pubring.gpg~
-rw-------@ 1 username staff 600 Mar 1 22:27 random_seed
lrwxr-xr-x 1 username staff 36 Mar 2 09:44 secring.gpg -> /Volumes/Safekeeping/gpg/secring.gpg
-rw-------@ 1 username staff 1760 Mar 1 22:29 trustdb.gpg
more gpg.conf
# Options for GnuPG
# Copyright 1998, 1999, 2000, 2001, 2002, 2003,
# 2010 Free Software Foundation, Inc.
#
# This file is free software; as a special exception the author gives
# unlimited permission to copy and/or distribute it, with or without
# modifications, as long as this notice is preserved.
#
# This file is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
#
# Unless you specify which option file to use (with the command line
# option "--options filename"), GnuPG uses the file ~/.gnupg/gpg.conf
# by default.
#
# An options file can contain any long options which are available in
# GnuPG. If the first non white space character of a line is a '#',
# this line is ignored. Empty lines are also ignored.
#
# See the man page for a list of options.
# Uncomment the following option to get rid of the copyright notice
#no-greeting
# If you have more than 1 secret key in your keyring, you may want to
# uncomment the following option and set your preferred keyid.
#default-key 621CC013
# If you do not pass a recipient to gpg, it will ask for one. Using
# this option you can encrypt to a default key. Key validation will
# not be done in this case. The second form uses the default key as
# default recipient.
#default-recipient some-user-id
#default-recipient-self
# Use --encrypt-to to add the specified key as a recipient to all
# messages. This is useful, for example, when sending mail through a
# mail client that does not automatically encrypt mail to your key.
# In the example, this option allows you to read your local copy of
# encrypted mail that you've sent to others.
encrypt-to E7CADD8B
# By default GnuPG creates version 4 signatures for data files as
# specified by OpenPGP. Some earlier (PGP 6, PGP 7) versions of PGP
# require the older version 3 signatures. Setting this option forces
# GnuPG to create version 3 signatures.
#force-v3-sigs
# Because some mailers change lines starting with "From " to ">From "
# it is good to handle such lines in a special way when creating
# cleartext signatures; all other PGP versions do it this way too.
#no-escape-from-lines
# If you do not use the Latin-1 (ISO-8859-1) charset, you should tell
# GnuPG which is the native character set. Please check the man page
# for supported character sets. This character set is only used for
# metadata and not for the actual message which does not undergo any
# translation. Note that future version of GnuPG will change to UTF-8
# as default character set. In most cases this option is not required
# as GnuPG is able to figure out the correct charset at runtime.
#charset utf-8
# Group names may be defined like this:
# group mynames = paige 0x12345678 joe patti
#
# Any time "mynames" is a recipient (-r or --recipient), it will be
# expanded to the names "paige", "joe", and "patti", and the key ID
# "0x12345678". Note there is only one level of expansion - you
# cannot make an group that points to another group. Note also that
# if there are spaces in the recipient name, this will appear as two
# recipients. In these cases it is better to use the key ID.
#group mynames = paige 0x12345678 joe patti
# Lock the file only once for the lifetime of a process. If you do
# not define this, the lock will be obtained and released every time
# it is needed, which is usually preferable.
#lock-once
# GnuPG can send and receive keys to and from a keyserver. These
# servers can be HKP, email, or LDAP (if GnuPG is built with LDAP
# support).
#
# Example HKP keyserver:
# hkp://keys.gnupg.net
# hkp://subkeys.pgp.net
#
# Example email keyserver:
# mailto:[email blocked]
#
# Example LDAP keyservers:
# ldap://keyserver.pgp.com
#
# Regular URL syntax applies, and you can set an alternate port
# through the usual method:
# hkp://keyserver.example.net:22742
#
# Most users just set the name and type of their preferred keyserver.
# Note that most servers (with the notable exception of
# ldap://keyserver.pgp.com) synchronize changes with each other. Note
# also that a single server name may actually point to multiple
# servers via DNS round-robin. hkp://keys.gnupg.net is an example of
# such a "server", which spreads the load over a number of physical
# servers. To see the IP address of the server actually used, you may use
# the "--keyserver-options debug".
#keyserver wwwkeys.at.pgp.net
keyserver pgp.mit.edu
#keyserver hkp://keys.gnupg.net
#keyserver mailto:[email blocked]
#keyserver ldap://keyserver.pgp.com
no-default-keyring
keyring ~/.gnupg/pubring.gpg
secret-keyring ~/.gnupg/secring.gpg
# Common options for keyserver functions:
#
# include-disabled : when searching, include keys marked as "disabled"
# on the keyserver (not all keyservers support this).
#
# no-include-revoked : when searching, do not include keys marked as
# "revoked" on the keyserver.
#
# verbose : show more information as the keys are fetched.
# Can be used more than once to increase the amount
# of information shown.
#
# use-temp-files : use temporary files instead of a pipe to talk to the
# keyserver. Some platforms (Win32 for one) always
# have this on.
#
# keep-temp-files : do not delete temporary files after using them
# (really only useful for debugging)
#
# http-proxy="proxy" : set the proxy to use for HTTP and HKP keyservers.
# This overrides the "http_proxy" environment variable,
# if any.
#
# auto-key-retrieve : automatically fetch keys as needed from the keyserver
# when verifying signatures or when importing keys that
# have been revoked by a revocation key that is not
# present on the keyring.
#
# no-include-attributes : do not include attribute IDs (aka "photo IDs")
# when sending keys to the keyserver.
keyserver-options auto-key-retrieve
# Display photo user IDs in key listings
# list-options show-photos
# Display photo user IDs when a signature from a key with a photo is
# verified
# verify-options show-photos
# Use this program to display photo user IDs
#
# %i is expanded to a temporary file that contains the photo.
# %I is the same as %i, but the file isn't deleted afterwards by GnuPG.
# %k is expanded to the key ID of the key.
# %K is expanded to the long OpenPGP key ID of the key.
# %t is expanded to the extension of the image (e.g. "jpg").
# %T is expanded to the MIME type of the image (e.g. "image/jpeg").
# %f is expanded to the fingerprint of the key.
# %% is %, of course.
#
# If %i or %I are not present, then the photo is supplied to the
# viewer on standard input. If your platform supports it, standard
# input is the best way to do this as it avoids the time and effort in
# generating and then cleaning up a secure temp file.
#
# If no photo-viewer is provided, GnuPG will look for xloadimage, eog,
# or display (ImageMagick). On Mac OS X and Windows, the default is
# to use your regular JPEG image viewer.
#
# Some other viewers:
# photo-viewer "qiv %i"
# photo-viewer "ee %i"
#
# This one saves a copy of the photo ID in your home directory:
# photo-viewer "cat > ~/photoid-for-key-%k.%t"
#
# Use your MIME handler to view photos:
# photo-viewer "metamail -q -d -b -c %T -s 'KeyID 0x%k' -f GnuPG"
# Passphrase agent
#
# We support the old experimental passphrase agent protocol as well as
# the new Assuan based one (currently available in the "newpg" package
# at ftp.gnupg.org/gcrypt/alpha/aegypten/). To make use of the agent,
# you have to run an agent as daemon and use the option
#
# use-agent
#
# which tries to use the agent but will fallback to the regular mode
# if there is a problem connecting to the agent. The normal way to
# locate the agent is by looking at the environment variable
# GPG_AGENT_INFO which should have been set during gpg-agent startup.
# In certain situations the use of this variable is not possible, thus
# the option
#
# --gpg-agent-info=<path>:<pid>:1
#
# may be used to override it.
# Automatic key location
#
# GnuPG can automatically locate and retrieve keys as needed using the
# auto-key-locate option. This happens when encrypting to an email
# address (in the "[email blocked]" form), and there are no
# [email blocked] keys on the local keyring. This option takes the
# following arguments, in the order they are to be tried:
#
# cert = locate a key using DNS CERT, as specified in RFC-4398.
# GnuPG can handle both the PGP (key) and IPGP (URL + fingerprint)
# CERT methods.
#
# pka = locate a key using DNS PKA.
#
# ldap = locate a key using the PGP Universal method of checking
# "ldap://keys.(thedomain)". For example, encrypting to
# [email blocked] will check ldap://keys.example.com.
#
# keyserver = locate a key using whatever keyserver is defined using
# the keyserver option.
#
# You may also list arbitrary keyservers here by URL.
#
# Try CERT, then PKA, then LDAP, then hkp://subkeys.net:
#auto-key-locate cert pka ldap hkp://subkeys.pgp.net
comment GPGTools - http://gpgtools.org
Support Staff 5 Posted by Luke Le on 02 Mar, 2012 05:05 PM
Looks fine so far, only thing I last need is:
ls -ld ~/.gnupg
6 Posted by Will Styler on 02 Mar, 2012 05:09 PM
Luke,
username: ~ $ ls -ld .gnupg/
drwx------@ 12 username staff 408 Mar 2 09:48 .gnupg/
Support Staff 7 Posted by Luke Le on 02 Mar, 2012 05:12 PM
Ok, setup seems fine. Disappointing :)
We'll look into this. I'll let you know.
8 Posted by Will Styler on 02 Mar, 2012 05:13 PM
I'm sorry for you, glad for me :)
Will
9 Posted by Will Styler on 03 Mar, 2012 09:20 PM
In response to your twitter query, this is not resolved in the latest nightly. Sorry :(
10 Posted by Alex on 05 Mar, 2012 03:27 PM
@Luke: any idea what the issue might be?
Support Staff 11 Posted by Luke Le on 05 Mar, 2012 03:43 PM
It might be related to our GPG Key Watcher not recognizing changes to the symlink which in fact do not occur, i think.
We'll have to test that
Support Staff 12 Posted by Steve on 09 Apr, 2012 02:25 PM
Hi Will,
I have created a ticket for this feature request. Feel free to subscribe to the following ticket in order to stay up-to-date and receive notifications when this is being worked on.
All the best,
steve
Steve closed this discussion on 09 Apr, 2012 02:25 PM.
Will Styler re-opened this discussion on 09 Apr, 2012 04:04 PM
13 Posted by Will Styler on 09 Apr, 2012 04:04 PM
Thanks so much, Steve!
Support Staff 14 Posted by Steve on 09 Apr, 2012 04:14 PM
Not done much - so far ;)
But you are very welcome. And thanks for your input.
Steve closed this discussion on 09 Apr, 2012 04:14 PM.