Recent searches
Search options
Administered by:
#teardown and #bootstrap gpg-agent, pcscd to have a working configuration:
#!/usr/bin/env sh
# Copyright (c) Jarkko Sakkinen 2024
# Bootstrap gpg-agent and pcscd for Yubikey use.
GPG_AGENT_SOCKETS=(gpg-agent-ssh.socket
gpg-agent-browser.socket
gpg-agent-extra.socket
gpg-agent-ssh.socket
gpg-agent.socket)
systemctl --user disable --now "${GPG_AGENT_SOCKETS[@]}"
gpgconf --kill gpg-agent
sudo systemctl disable --now pcscd.socket
systemctl --user enable --now gpg-agent.socket gpg-agent-ssh.socket
sudo systemctl enable --now pcscd.socket
For gpg-agent I have the following entries in ~/.gnupg:
gpg-agent.conf
gpg-agent.conf.darwin
gpg-agent.conf.linux-gnu
In a new installation the correct configuration can be deployed as follows:
cp ~/.gnupg/gpg-agent.conf.$OSTYPE ~/.gnupg/gpg-agent.conf
At least in Fedora, also shared a access configuration needs to be defined in ~/.gnupg/scdaemon.conf:
# See for further information:
# https://github.com/OpenSC/OpenSC/wiki/GnuPG-and-OpenSC
card-timeout 5
disable-ccid
pcsc-shared
Otherwise, the earlier script needs to be run separately for each boot as a workaround. In OpenSUSE, I guess the defaults are different, given that everything just works without this extra configuration.
GitHubGnuPG and OpenSCOpen source smart card tools and middleware. PKCS#11/MiniDriver/Tokend - OpenSC/OpenSC
@jarkko wait, I never got gpg and pcscd (for yubi auth) working reliably together (in opensuse) so did things get finally fixed?
@vbabka I've tested these myself in OpenSUSE and Fedora. I'd try both #1 and #3 from previous. In Fedora after boot it was not otherwise working right off the bat.
@jarkko hm so, gpg --card-status wouldn't work unless I add the scdaemon.conf stuff, as I'd expect given past attempts. Now the question is, will it work reliably, my previous experience is it starts working but then fails. Note I have uptodate openSUSE Tumbleweed.
BTW, you mention also gpg-agent.conf, anything special there?
On the yubikey side, yubioath 5.1 (the latest packaged) doesn't work regardless of pcscd running. That's weird, it used to. 7.0 downloaded manually seems to work (and stops once I stop pcscd so it does use it still), so it's hopefully just a matter of packaging. Wonder if there's a command line variant for the OTP's...
BTW, you mention also gpg-agent.conf, anything special there?
On the yubikey side, yubioath 5.1 (the latest packaged) doesn't work regardless of pcscd running. That's weird, it used to. 7.0 downloaded manually seems to work (and stops once I stop pcscd so it does use it still), so it's hopefully just a matter of packaging. Wonder if there's a command line variant for the OTP's...
@jarkko yeah and after a while of running, back to the usual
> gpg --card-status
gpg: selecting card failed: No such device
gpg: OpenPGP card not available: No such device
sigh
> gpg --card-status
gpg: selecting card failed: No such device
gpg: OpenPGP card not available: No such device
sigh
