headers
Michael Roitzsch | 8 Mar 2012 12:58
Picon

GPGMail keychain question (or bug)

Hi GPGTools team,

I am using the GPGMail plugin (2.0a30) on OS X 10.7 Lion. I have a bit of an unusual keychain setup, because I
use two keychains to store my credentials. (One is for per-machine credentials and one is synced between machines.)

Unfortunately, pinentry-mac seems to find the gpg password in the keychain only when it is in the default
keychain. Whenever I move the keychain item to the second keychain, it is no longer found and pinentry-mac
asks for the password.

Is this intended behavior or is this a bug? I think pinentry-mac should search through the entire keychain
search list as configured by the user. This can be achieved by passing NULL as the first argument to
SecKeychainFindGenericPassword() when looking for the credential.

Michael


Hi GPGTools team,

I am using the GPGMail plugin (2.0a30) on OS X 10.7 Lion. I have a bit of an unusual keychain setup, because I
use two keychains to store my credentials. (One is for per-machine credentials and one is synced between machines.)

Unfortunately, pinentry-mac seems to find the gpg password in the keychain only when it is in the default
keychain. Whenever I move the keychain item to the second keychain, it is no longer found and pinentry-mac
asks for the password.

Is this intended behavior or is this a bug? I think pinentry-mac should search through the entire keychain
search list as configured by the user. This can be achieved by passing NULL as the first argument to
SecKeychainFindGenericPassword() when looking for the credential.
(Continue reading)

Permalink | Reply |
headers
Lukas Pitschl | Dressy Vagabonds | 8 Mar 2012 17:59
Gravatar

Re: GPGMail keychain question (or bug)

Hi Michael,
On 08.03.2012, at 12:58, Michael Roitzsch wrote:

> Hi GPGTools team,
> 
> I am using the GPGMail plugin (2.0a30) on OS X 10.7 Lion. I have a bit of an unusual keychain setup, because I
use two keychains to store my credentials. (One is for per-machine credentials and one is synced between machines.)
> 
> Unfortunately, pinentry-mac seems to find the gpg password in the keychain only when it is in the default
keychain. Whenever I move the keychain item to the second keychain, it is no longer found and pinentry-mac
asks for the password.
> 

That's true, at the moment it is only checking the default keychain which is returned by SecKeychainCopyDefault.
Or you can set a default keychain using the KeychainPath defaults value.

> Is this intended behavior or is this a bug? I think pinentry-mac should search through the entire keychain
search list as configured by the user. This can be achieved by passing NULL as the first argument to
SecKeychainFindGenericPassword() when looking for the credential.
> 

We'll have to test this, but sounds like a good idea, thanks! I'll add a feature request to gpgtools.lighthouseapp.com
http://gpgtools.lighthouseapp.com/projects/73378-libmacgpg/tickets/21-pinentry-mac-should-search-the-users-default-keychain-search-list-instead-of-only-the-default-one

> Michael
> 

Best,

Lukas
(Continue reading)

Permalink | Reply |

Gmane