Pinentry-gtk2 contains only pinentry-curses

jacg · January 3, 2024, 5:25pm

In nixpkgs 23.11, pinentry-gtk2 seems to contain only the executable for pinentry-curses

nix build nixpkgs#pinentry-gtk2

eza -T result/      
result
├── bin
│  └── pinentry -> /nix/store/ibvcjx98ljpnkrpw6w12q3gg4pl0ax4d-pinentry-1.2.1-curses/bin/pinentry-curses
└── share
   └── info
      └── pinentry.info

(which seems to be unusable in conjunction with Emacs).

Quickly looking at the source in nixpkgs, seems to suggest that gtk2 should contain a pinentry-gtk-2 executable.

Can you suggest a workaround?

jacg · January 3, 2024, 5:34pm

… and similarly for pinentry-gnome though the nixpkgs source looks as if it should produce a pinentry-gnome3 (extra 3) package, so I’m even more confused.

jtojnar · January 3, 2024, 9:26pm

You are looking at a wrong directory for pinentry-gnome, it would be result-gnome3/.

gtk2 flavour has been removed from the list of flavors enabled in the pinentry attribute. The top-level pinentry-gtk2 attribute was forgotten about and because the flavor attributes use lib.getOuput, it now points to ncurses flavour in out.

jacg · January 3, 2024, 11:18pm

Sorry, I was insufficiently clear. This

github.com

NixOS/nixpkgs/blob/054533f5c84884e3186a722c07cbb4a6c1a2af19/pkgs/tools/security/pinentry/default.nix#L29


      
              let
                flag = flavorInfo.${f}.flag or null;
              in
                lib.optionalString (flag != null)
                  (lib.enableFeature (lib.elem f enabledFlavors) ("pinentry-" + flag));
          
          
  flavorInfo = {
              curses = { bin = "curses"; flag = "curses"; buildInputs = [ ncurses ]; };
              tty = { bin = "tty"; flag = "tty"; };
              gtk2 = { bin = "gtk-2"; flag = "gtk2"; buildInputs = [ gtk2 ]; };
              gnome3 = { bin = "gnome3"; flag = "gnome3"; buildInputs = [ gcr ]; nativeBuildInputs = [ wrapGAppsHook ]; };
              qt = { bin = "qt"; flag = "qt"; buildInputs = [ qtbase ]; nativeBuildInputs = [ wrapQtAppsHook ]; };
              emacs = { bin = "emacs"; flag = "emacs"; buildInputs = []; };
            };
          
          
in
          
          
pinentryMkDerivation rec {
            pname = "pinentry";
            version = "1.2.1";

made me believe that there should be a pinentry-gnome3 package, whereas

nix build nixpkgs#pinentry-gnome3
error: flake 'flake:nixpkgs' does not provide attribute 'packages.x86_64-linux.pinentry-gnome3', 'legacyPackages.x86_64-linux.pinentry-gnome3' or 'pinentry-gnome3'
       Did you mean one of pinentry-gnome or pinentry_gnome?

Anyway, using this in my home-manager, thus


  services.gpg-agent = {
    enable = true;
    defaultCacheTtl = 24 * 60 * 60; # 24 hours
    maxCacheTtl     = 24 * 60 * 60;
    enableSshSupport = true;
    extraConfig = ''
      pinentry-program ${pkgs.pinentry-gnome}/bin/pinentry
    '';
  };

Generates the following .gnupg/gpg-agent.conf

enable-ssh-support
grab
default-cache-ttl 86400
max-cache-ttl 86400
pinentry-program /nix/store/1ky2hcsqsr0l82gf8wg20f03ca62irfw-pinentry-1.2.1-gtk2/bin/pinentry
pinentry-program /nix/store/khbgcfx6hqyrv817gfirnyg5pqngw04n-pinentry-1.2.1-gnome3/bin/pinentry

I have no idea where how the gtk2 (on the penultimate line) gets there, but this one does not appear to resolve to pinentry-curses:

eza -T /nix/store/1ky2hcsqsr0l82gf8wg20f03ca62irfw-pinentry-1.2.1-gtk2/
/nix/store/1ky2hcsqsr0l82gf8wg20f03ca62irfw-pinentry-1.2.1-gtk2
└── bin
   ├── pinentry -> pinentry-gtk-2
   └── pinentry-gtk-2

If I now restart gpg-agent with gpgconf --kll all I get the old gtk2 version of pinertry, when needed.

This gets me around my immediate problem, but I have no idea why/how this works, or whether it is a correct/stable solution, or how it relates to the removal of pinentry-gtk-2 to which you linked.

jtojnar · January 3, 2024, 11:20pm

Home Manager has an option for that at it rebuilds the pinentry package with a specific flavour:

github.com

nix-community/home-manager/blob/fcbc70a7ee064f2b65dc1fac1717ca2a9813bbe6/modules/services/gpg-agent.nix#L249


      
              ++ optional (!cfg.enableScDaemon) "disable-scdaemon"
              ++ optional (cfg.defaultCacheTtl != null)
              "default-cache-ttl ${toString cfg.defaultCacheTtl}"
              ++ optional (cfg.defaultCacheTtlSsh != null)
              "default-cache-ttl-ssh ${toString cfg.defaultCacheTtlSsh}"
              ++ optional (cfg.maxCacheTtl != null)
              "max-cache-ttl ${toString cfg.maxCacheTtl}"
              ++ optional (cfg.maxCacheTtlSsh != null)
              "max-cache-ttl-ssh ${toString cfg.maxCacheTtlSsh}"
              ++ optional (cfg.pinentryFlavor != null)
              "pinentry-program ${pkgs.pinentry.${cfg.pinentryFlavor}}/bin/pinentry"
              ++ [ cfg.extraConfig ]);
          
          
home.sessionVariablesExtra = optionalString cfg.enableSshSupport ''
            if [[ -z "$SSH_AUTH_SOCK" ]]; then
              export SSH_AUTH_SOCK="$(${gpgPkg}/bin/gpgconf --list-dirs agent-ssh-socket)"
            fi
          '';
          
          
programs.bash.initExtra = mkIf cfg.enableBashIntegration gpgInitStr;
          programs.zsh.initExtra = mkIf cfg.enableZshIntegration gpgInitStr;

jacg · January 3, 2024, 11:55pm

OK, so pinentryFlavor = "gnome3"; (in home-manager) or pinentryFlavor = "gtk2"; (equivalent to not setting pinentryFlavor at all, seem to be behaving sensibly.

But it seems that gtk2 has been deprecated 3 years ago, and gtk3 and gtk4 are both present in nixpkgs, but pinentry only comes in a gtk2 flavour (removed from nixpks, but still present in home-manager). Hmm. Should I stop using the gtk2 version?