Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"File is not encrypted, all GPG functions disabled" on KDE #40

Closed
asdofindia opened this issue Jul 25, 2015 · 5 comments
Closed

"File is not encrypted, all GPG functions disabled" on KDE #40

asdofindia opened this issue Jul 25, 2015 · 5 comments

Comments

@asdofindia
Copy link

History
I am on archlinux. I had been running vim-gnupg smoothly in Gnome shell for at least 4 months. Last used 1 month back.
Yesterday I uninstalled gnome shell and installed KDE. During this process I also updated all the packages on the system.

Problem
.gpg files do not decrypt automatically. Gives the message "File is not encrypted, all GPG functions disabled"

gpg -d test.gpg
# asks for password
# shows the content of test.gpg

vim test.gpg
# shows gibberish with error message at the bottom.

I then updated the plugin to the latest version on git. Now, the error message isn't appearing. But the file is still not decrypted.

other info

  • older files which were correctly being decrypted in the past aren't being decrypted now.
  • files I create with vim-gnupg itself now aren't being decrypted either.

Is there anything I can do to debug this issue?

Update
I missed an important detail. During the switch to kde, I had to uninstall seahorse and replace it with ksshaskpass.

@jamessan
Copy link
Owner

Start vim with no arguments and run let g:GPGDebugLevel=3, let g:GPGDebugLog="debug.log". After that, open an encrypted file. Post the contents of the debug.log file and that should help determine what's happening.

@asdofindia
Copy link
Author

@jamessan Thanks for that. I did the same and here's the output of debug.log


GnuPG: >>>>>>>> Entering s:GPGInit(1)
GnuPG: gnupg.vim 2.5
GnuPG: shellredirsave: >%s 2>&1
GnuPG: shellsave: /usr/bin/zsh
GnuPG: shelltempsave: 1
GnuPG: shell: /bin/sh
GnuPG: shellcmdflag: -c
GnuPG: shellxquote: 
GnuPG: shellredir: >%s 2>&1
GnuPG: stderrredirnull: 2>/dev/null
GnuPG: shell implementation: /usr/bin/bash
GnuPG: command: LANG=C LC_ALL=C gpg --trust-model always --version 2>/dev/null
GnuPG: rc: 0
GnuPG: output: gpg (GnuPG) 2.1.6^@libgcrypt 1.6.3^@Copyright (C) 2015 Free Software Foundation, Inc.^@License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>^@This is free software: you are free to change and redistribute it.^@There is NO WARRANTY, to the extent permitted by law.^@^@Home: ~/.gnupg^@Supported algorithms:^@Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA^@Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,^@        CAMELLIA128, CAMELLIA192, CAMELLIA256^@Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224^@Compression: Uncompressed, ZIP, ZLIB, BZIP2^@
GnuPG: public key algorithms: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
GnuPG: cipher algorithms: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
GnuPG: hashing algorithms: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
GnuPG: compression algorithms: Uncompressed, ZIP, ZLIB, BZIP2
GnuPG: <<<<<<<< Leaving s:GPGInit()
GnuPG: >>>>>>>> Entering s:GPGDecrypt(1)
GnuPG: command: LANG=C LC_ALL=C gpg --trust-model always --use-agent --verbose --decrypt --list-only --dry-run --batch --no-use-agent --logger-fd 1 '/home/akshay/work/college/magazine/15/password.gpg' 2>/dev/null
GnuPG: rc: 0
GnuPG: output: 
GnuPG: this file is not encrypted
GnuPG: <<<<<<<< Leaving s:GPGDecrypt()

Additionally, I figured this out. gpgconf had changed my ~/.gnupg/gpg.conf

If I mv ~/.gnupg/gpg.conf ~/.gnupg/gpg.conf.bak everything starts to work again. And if I move it back, the problem comes back. This solves the problem, yet I think there's something better to be done either in gpgconf or in vim-gnupg. So I'm posting the content of ~/.gnupg/gpg.conf here too. Please see if you can spot what is causing the problem.

# Options for GnuPG
# Copyright 1998-2003, 2010 Free Software Foundation, Inc.
# Copyright 1998-2003, 2010 Werner Koch
#
# This file is free software; as a special exception the author gives
# unlimited permission to copy and/or distribute it, with or without
# modifications, as long as this notice is preserved.
#
# This file is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
#
# Unless you specify which option file to use (with the command line
# option "--options filename"), GnuPG uses the file ~/.gnupg/gpg.conf
# by default.
#
# An options file can contain any long options which are available in
# GnuPG. If the first non white space character of a line is a '#',
# this line is ignored.  Empty lines are also ignored.
#
# See the man page for a list of options.

# Uncomment the following option to get rid of the copyright notice

#no-greeting

# If you have more than 1 secret key in your keyring, you may want to
# uncomment the following option and set your preferred keyid.

#default-key 621CC013

# If you do not pass a recipient to gpg, it will ask for one.  Using
# this option you can encrypt to a default key.  Key validation will
# not be done in this case.  The second form uses the default key as
# default recipient.

#default-recipient some-user-id
#default-recipient-self

# By default GnuPG creates version 4 signatures for data files as
# specified by OpenPGP.  Some earlier (PGP 6, PGP 7) versions of PGP
# require the older version 3 signatures.  Setting this option forces
# GnuPG to create version 3 signatures.

#force-v3-sigs

# Because some mailers change lines starting with "From " to ">From "
# it is good to handle such lines in a special way when creating
# cleartext signatures; all other PGP versions do it this way too.
# To enable full OpenPGP compliance you may want to use this option.

#no-escape-from-lines

# When verifying a signature made from a subkey, ensure that the cross
# certification "back signature" on the subkey is present and valid.
# This protects against a subtle attack against subkeys that can sign.
# Defaults to --no-require-cross-certification.  However for new
# installations it should be enabled.

require-cross-certification


# If you do not use the Latin-1 (ISO-8859-1) charset, you should tell
# GnuPG which is the native character set.  Please check the man page
# for supported character sets.  This character set is only used for
# metadata and not for the actual message which does not undergo any
# translation.  Note that future version of GnuPG will change to UTF-8
# as default character set.

#charset utf-8

# Group names may be defined like this:
#   group mynames = paige 0x12345678 joe patti
#
# Any time "mynames" is a recipient (-r or --recipient), it will be
# expanded to the names "paige", "joe", and "patti", and the key ID
# "0x12345678".  Note there is only one level of expansion - you
# cannot make an group that points to another group.  Note also that
# if there are spaces in the recipient name, this will appear as two
# recipients.  In these cases it is better to use the key ID.

#group mynames = paige 0x12345678 joe patti

# Some old Windows platforms require 8.3 filenames.  If your system
# can handle long filenames, uncomment this.

#no-mangle-dos-filenames

# Lock the file only once for the lifetime of a process.  If you do
# not define this, the lock will be obtained and released every time
# it is needed - normally this is not needed.

#lock-once

# GnuPG can send and receive keys to and from a keyserver.  These
# servers can be HKP, email, or LDAP (if GnuPG is built with LDAP
# support).
#
# Example HKP keyservers:
#      hkp://keys.gnupg.net
#
# Example LDAP keyservers:
#      ldap://pgp.surfnet.nl:11370
#
# Regular URL syntax applies, and you can set an alternate port
# through the usual method:
#      hkp://keyserver.example.net:22742
#
# If you have problems connecting to a HKP server through a buggy http
# proxy, you can use keyserver option broken-http-proxy (see below),
# but first you should make sure that you have read the man page
# regarding proxies (keyserver option honor-http-proxy)
#
# Most users just set the name and type of their preferred keyserver.
# Note that most servers (with the notable exception of
# ldap://keyserver.pgp.com) synchronize changes with each other.  Note
# also that a single server name may actually point to multiple
# servers via DNS round-robin.  hkp://keys.gnupg.net is an example of
# such a "server", which spreads the load over a number of physical
# servers.  To see the IP address of the server actually used, you may use
# the "--keyserver-options debug".

keyserver hkp://keys.gnupg.net
#keyserver http://http-keys.gnupg.net
#keyserver mailto:pgp-public-keys@keys.nl.pgp.net

# Common options for keyserver functions:
#
# include-disabled = when searching, include keys marked as "disabled"
#                    on the keyserver (not all keyservers support this).
#
# no-include-revoked = when searching, do not include keys marked as
#                      "revoked" on the keyserver.
#
# verbose = show more information as the keys are fetched.
#           Can be used more than once to increase the amount
#           of information shown.
#
# use-temp-files = use temporary files instead of a pipe to talk to the
#                  keyserver.  Some platforms (Win32 for one) always
#                  have this on.
#
# keep-temp-files = do not delete temporary files after using them
#                   (really only useful for debugging)
#
# honor-http-proxy = if the keyserver uses HTTP, honor the http_proxy
#                    environment variable
#
# broken-http-proxy = try to work around a buggy HTTP proxy
#
# auto-key-retrieve = automatically fetch keys as needed from the keyserver
#                     when verifying signatures or when importing keys that
#                     have been revoked by a revocation key that is not
#                     present on the keyring.
#
# no-include-attributes = do not include attribute IDs (aka "photo IDs")
#                         when sending keys to the keyserver.

#keyserver-options auto-key-retrieve

# Uncomment this line to display photo user IDs in key listings and
# when a signature from a key with a photo is verified.

#show-photos

# Use this program to display photo user IDs
#
# %i is expanded to a temporary file that contains the photo.
# %I is the same as %i, but the file isn't deleted afterwards by GnuPG.
# %k is expanded to the key ID of the key.
# %K is expanded to the long OpenPGP key ID of the key.
# %t is expanded to the extension of the image (e.g. "jpg").
# %T is expanded to the MIME type of the image (e.g. "image/jpeg").
# %f is expanded to the fingerprint of the key.
# %% is %, of course.
#
# If %i or %I are not present, then the photo is supplied to the
# viewer on standard input.  If your platform supports it, standard
# input is the best way to do this as it avoids the time and effort in
# generating and then cleaning up a secure temp file.
#
# The default program is "xloadimage -fork -quiet -title 'KeyID 0x%k' stdin"
# On Mac OS X and Windows, the default is to use your regular JPEG image
# viewer.
#
# Some other viewers:
# photo-viewer "qiv %i"
# photo-viewer "ee %i"
# photo-viewer "display -title 'KeyID 0x%k'"
#
# This one saves a copy of the photo ID in your home directory:
# photo-viewer "cat > ~/photoid-for-key-%k.%t"
#
# Use your MIME handler to view photos:
# photo-viewer "metamail -q -d -b -c %T -s 'KeyID 0x%k' -f GnuPG"

###+++--- GPGConf ---+++###
utf8-strings
debug-level basic
log-file socket:///home/akshay/.gnupg/log-socket
###+++--- GPGConf ---+++### Thu 23 Jul 2015 17:35:29 IST
# GPGConf edited this configuration file.
# It will disable options before this marked block, but it will
# never change anything below these lines.

default-key  XXXXXXXXXXXXXXXXX

(Pardon me for pasting even the commented lines. :P I've also removed the default-key)

I tried changing debug-level to none and it makes no difference.

@jamessan
Copy link
Owner

GnuPG: command: LANG=C LC_ALL=C gpg --trust-model always --use-agent --verbose --decrypt --list-only --dry-run --batch --no-use-agent --logger-fd 1 '/home/akshay/work/college/magazine/15/password.gpg' 2>/dev/null
GnuPG: rc: 0
GnuPG: output:
GnuPG: this file is not encrypted

The rc 0 implies that is encrypted, but there's no output to tell us how which is why we say it isn't encrypted.

log-file socket:///home/akshay/.gnupg/log-socket

This is probably the problem. It prevents the normal logging output that the plugin parses. I would suggest removing that line.

@asdofindia
Copy link
Author

Yes, commenting that line out solves the problem. Thanks a lot.

The problem is/was created by the program KWatchGnuPG (which I ran from inside kmail). It runs gpgconf and changes the log-file to that socket. Resetting the log-file and not running kwatchgnupg again would be a solution. Thanks again for your patience.

@jamessan
Copy link
Owner

I'll see if I can override that from the command-line in case there are programs that require that to be set.

jamessan added a commit that referenced this issue Jul 26, 2015
If the “log-file” option is set in ~/.gnupg/gpg.conf, then using “--batch”
means that the CLI's “--logger-fd” is ignored.  Since this command
shouldn't need any of “--batch”'s functionality and “log-file” hides all
the output we're expecting, dropping “--batch” is the sane thing to do.

Closes #40

Signed-off-by: James McCoy <vega.james@gmail.com>

# Please enter the commit message for your changes. Lines starting
# with '#' will be ignored, and an empty message aborts the commit.
# On branch master
# Your branch is up-to-date with 'origin/master'.
#
# Changes to be committed:
#	modified:   plugin/gnupg.vim
#
# Untracked files:
#	foo.asc
#	foo.gpg
#	foo.sig
#
# ------------------------ >8 ------------------------
# Do not touch the line above.
# Everything below will be removed.
diff --git c/plugin/gnupg.vim i/plugin/gnupg.vim
index 80f2061..b0bcd5c 100644
--- c/plugin/gnupg.vim
+++ i/plugin/gnupg.vim
@@ -1,5 +1,5 @@
 " Name:    gnupg.vim
-" Last Change: 2015 Jul 16
+" Last Change: 2015 Jul 26
 " Maintainer:  James McCoy <vega.james@gmail.com>
 " Original Author:  Markus Braun <markus.braun@krawel.de>
 " Summary: Vim plugin for transparent editing of gpg encrypted files.
@@ -448,7 +448,7 @@ function s:GPGDecrypt(bufread)

   " find the recipients of the file
   let cmd = { 'level': 3 }
-  let cmd.args = '--verbose --decrypt --list-only --dry-run --batch --no-use-agent --logger-fd 1 ' . shellescape(filename)
+  let cmd.args = '--verbose --decrypt --list-only --dry-run --no-use-agent --logger-fd 1 ' . shellescape(filename)
   let output = s:GPGSystem(cmd)

   " Suppress the "N more lines" message when editing a file, not when reading
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants