<html><head></head><body><div>Hi Albert.</div><div><br></div><div> OK. I see that it works for a command-line program (I didn't know about qcatool, to be honest). Perhaps I didn't make it clear, but my project is a GUI program, using Qt5. Currently, QCA invokes the gpg executable (although I gather there are plans to switch to GPGME), and there are, as far as I know, only three ways to feed gpg with a passphrase when it needs one:</div><div><br></div><div>- Have gpg request it directly on the console, as you describe,</div><div><br></div><div>- Directly, on the command line (not a good idea), and</div><div><br></div><div>- Via gpg-agent.</div><div><br></div><div> gpg, when invoked manually, opens up a pinentry dialog, which collects the passphrase and feeds it to gpg-agent. QCA doesn't seem to contain the necessary assuan code to do that. Furthermore, it can't request for it on the console because it forces "--pinentry-mode loopback", which suppresses that. Besides, you don't want to use the console for anything when you're running a GUI program.</div><div><br></div><div> Since QCA invokes the gpg executable anyway, it makes more sense to just let gpg bring up a pinentry dialog.</div><div><br></div><div> I've attached the patch that fixes the library to do just that. I don't think it adds much more than 10-12 lines to the code.</div><div><br></div><div>Thanks,</div><div><br></div><div> .....Ron</div><div><br></div><div><br></div><div><span><pre>-- <br></pre><pre>Ron Murray <rjmx@rjmx.net>
PGP Fingerprint: 4D99 70E3 2317 334B 141E 7B63 12F7 E865 B5E2 E761
</pre></span></div><div><br></div><div>On Sat, 2022-09-10 at 11:31 +0200, Albert Astals Cid wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>El dissabte, 10 de setembre de 2022, a les 5:00:26 (CEST), Ron Murray va <br></div><div>escriure:<br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div> I'm working on a project using Qt5, GPG and QCA2, the latter because<br></div><div>it can encrypt and decrypt PGP messages. This, of course, involves<br></div><div>using the qca-gnupg plugin.<br></div><div><br></div><div> Encryption went fine (there's no need to sign anything (at the<br></div><div>moment, anyway)). Decryption, however, presented a problem: How to get<br></div><div>the password into gpg? I tried following the one example that I could<br></div><div>find (eventhandlerdemo.cpp), but I could never get the PasswordAsker<br></div><div>to, you know, actually ask for a password. <br></div></blockquote><div><br></div><div>Works fine here [1], i do<br></div><div><br></div><div>./bin/qcatool-qt5 message encrypt pgp P:df11<br></div><div><br></div><div>being df11 the short descriptor [2] of my key that has a passphrase, enter <br></div><div>some <br></div><div>text on the command line and press Ctrl+D and then run<br></div><div><br></div><div>./bin/qcatool-qt5 message decrypt pgp<br></div><div>paste the text on the command line that the encrypt process entered, press <br></div><div>Ctrl+D<br></div><div><br></div><div>and feed it that and it ends up in the PassphrasePrompt class code asking my <br></div><div>passphrase on the command line.<br></div><div><br></div><div>Cheers,<br></div><div> Albert<br></div><div><br></div><div>[1] Well, it needs a fix in the qcatool code, but that's "irrelevant", the <br></div><div>library code is fine.<br></div><div><a href="https://invent.kde.org/libraries/qca/-/merge_requests/89/diffs">https://invent.kde.org/libraries/qca/-/merge_requests/89/diffs</a><br></div><div><br></div><div>[2] you can use <br></div><div> qcatool-qt5 keystore list-stores<br></div><div>and<br></div><div> qcatool-qt5 keystore list ID_OF_THE_GPG_KEYRING<br></div><div>to try to find your short id if needed<br></div><div><br></div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div>I did discover, however,<br></div><div>that if I first used gpg to decrypt something (and supplying my<br></div><div>password to the agent in the process), that my program would<br></div><div>successfully decrypt things until the agent timed out (i.e. ten minutes<br></div><div>or so).<br></div><div><br></div><div> I began to think that the problem lay in the qca2 library. I went<br></div><div>through the source code and did a bit of tracing, and I found that QCA<br></div><div>always supplies "--pinentry-mode loopback" on the gpg command line.<br></div><div>This will never invoke the pinentry dialog, because that mode forces<br></div><div>gpg to ask for a password on the command line, which, apart from being<br></div><div>useless in a GUI application, won't work anyway because QCA also<br></div><div>supplies "--no-tty" on the command line, and that suppresses console<br></div><div>output.<br></div><div><br></div><div> I managed to modify the qca-gnupg plugin code to replace "--<br></div><div>pinentry-mode loopback" with "--pinentry-mode default" when it's<br></div><div>decrypting or signing a message, built the libraries, installed it, and<br></div><div>now I get a proper pinentry dialog when I want to decrypt a message.<br></div><div><br></div><div> So, the questions that I have are these:<br></div><div><br></div><div>1. I don't think that QCA, on its own, has any way to supply a password<br></div><div>to gpg or gpg-agent (apart, I suppose, by supplying it on the command<br></div><div>line, and nobody wants that), and anyway it's not implemented. But have<br></div><div>I missed something? Has anyone got QCA to decrypt files with GPG<br></div><div>lately?<br></div><div><br></div><div>2. Would this patch be useful for others? Note that it only affects the<br></div><div>qca-gnupg plugin: the rest of QCA is untouched.<br></div><div><br></div><div> I'm using the current QCA version on Debian testing (2.3.4-1+b1).<br></div></blockquote><div><br></div><div><br></div><div><br></div><div><br></div></blockquote></body></html>