https://bugzilla.novell.com/show_bug.cgi?id=754700 https://bugzilla.novell.com/show_bug.cgi?id=754700#c1 Stanislav Brabec changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |sbrabec@suse.com --- Comment #1 from Stanislav Brabec 2012-03-29 18:15:25 CEST --- I see at least three bugs here: - pinentry alone does not work, probably due to not passing XAUTHORITY and/or XAUTHLOCALHOSTNAME to gpg. It is unsure which application drops them (thunderbird, gpg, pinentry). - XFCE does not work properly if pam-keyring starts gnome-keyring - Starting gnome-keyring modules from autostart desktop files makes no sense, because there is no way how to pass new system variables back to the system environment. Either all modules have to be started by PAM or session startup, or the environment has to implement magic to get new environment variables and pass it to any started application. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=754700 https://bugzilla.novell.com/show_bug.cgi?id=754700#c3 --- Comment #3 from Guido Berhörster 2012-03-29 17:05:16 UTC --- The recommended gpg- and ssh-agent for Xfce is gnome-keyring, in order to make use of it you have to enable "Launch GNOME services on startup" in the Session preferences. Enabling the gnome-keyring-{gpg,ssh,pkcs11,secrets} xdg autostart files does not have any effect because they rely on a GNOME-specific mechanism for passing environment variables to the session, by default they are only enabled for GNOME. Note that gnome-keyring-daemon requires initialization in two steps, first the daemon is always started via PAM during authentication and the keyring is unlocked, later, depending on whether "Launch GNOME services on startup" is enabled or not, xfce4-session initializes all gnome-keyring modules and exports the necessary environment variables to the session. So this is why you always see the daemon running. If you want to run gpg-agent I'd suggest you first disable "Launch GNOME services on startup" and then copy /etc/xdg/xfce4/xinitrc to $HOME/.config/xfce4/xinitrc and add "eval $(gpg-agent --daemon)" to that script. For the problems with pinentry-gtk-2 please file a separate bug against pinentry. So the only issue I see here is that GNOME compatibility mode ("Launch GNOME services on startup") is not active by default. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=754700 https://bugzilla.novell.com/show_bug.cgi?id=754700#c5 --- Comment #5 from Guido Berhörster 2012-03-29 17:11:19 UTC --- (In reply to comment #2)

And fourth possible bug: /etc/X11/xdm/sys.xsession incorrectly assumes, that gnome-keyring always handles ssh and gnupg. But these features are optional. If the environment does not implement the post-launch environment variable injection, then presence of GNOME_KEYRING_PID and absence of GPG_AGENT_PID means, that gnome-keyring-daemon runs without gnupg support.

Note that for Xfce this is currently an all-or-nothing operation either all keyring modules are initialized or none depending on whether GNOME compatibility mode is enabled since it does not support to selectively disable them as GNOME does. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=754700 https://bugzilla.novell.com/show_bug.cgi?id=754700#c7 --- Comment #7 from Guido Berhörster 2012-03-30 09:24:15 UTC --- (In reply to comment #6)

If it is recommended, it should definitely be enabled by default. Would that be

Recommended as in "Xfce doesn't have its own technology for that and this is the only implementation that can be relatively easily used".

possible, at least in 12.2? From the point of view of a simple user, it is hard to figure out that all his/her problems with passwords can be solved by enabling this option, and the issue is quite annoying.

Considering that GNOME/KDE offer this functionality out of the box I agree that's reasonable and I'll enable it for 12.2.

Yes. IMHO there should also be a warning message that your keyring management won't work, if you try to disable it.

This is actually documented, the settings dialog says "Start GNOME services, such as gnome-keyring" and it's noted in the documentation as well, see http://docs.xfce.org/xfce/xfce4-session/preferences#advanced. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=754700 https://bugzilla.novell.com/show_bug.cgi?id=754700#c9 --- Comment #9 from Guido Berhörster 2012-03-30 16:39:13 UTC --- (In reply to comment #8)

So if I understand correctly, GNOME has implemented its own way to pass environment variables to the session. So the autostart approach could work.

Yes, other session managers would need to implement the org.gnome.SessionManager through which gnome-keyring passes them to g-s-m and probably also support the X-GNOME-Autostart-Phase stuff. Not likely to happen any time soon in Xfce, although this is tracked in https://bugzilla.xfce.org/show_bug.cgi?id=8014

Other session types don't, so variables have to be set in the session initialization.

Regarding comment 5: Even if gnome-keyring-daemon serves "nothing", /etc/X11/xdm/sys.xsession still disables running of separate gnupg and ssh agents.

Right, from /etc/pam.d/common-session: session optional pam_gnome_keyring.so auto_start only_if=gdm,gdm-password,lxdm,lightdm So if you log in with gdm, lxdm or lightdm gnome-keyring will always be started and set GNOME_KEYRING_CONTROL/GNOME_KEYRING_PID for the session although it may not be usable if GNOME compatibility mode is turned off in xfce4-session. Apart from that it is of course also plain wrong when you e.g. use gdm to log into a KDE session. Since xfce4-session or even the GNOME-only gnome-keyring autostart files are processed _after_ sys.xsession which is called from Xsession there is no way for it to know whether gnome-keyring is actually being used. So there you have two problems, gnome-keyring is initialized from PAM regardless of whether it is actually used or not and the hairball of session wrapper scripts in /etc/X11/xdm cannot really know that either. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=754700 https://bugzilla.novell.com/show_bug.cgi?id=754700#c11 --- Comment #11 from Guido Berhörster 2012-03-30 17:51:40 UTC --- Duh, I should know that since I worked on that patch. But anyway, the problem is still that the ssh/gpg-agent functionality may be not be usable either due to Xfce's GNOME compat mode being disabled or gnome-keyring autostart files being disabled in GNOME. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=754700 https://bugzilla.novell.com/show_bug.cgi?id=754700#c13 Guido Berhörster changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #13 from Guido Berhörster 2013-09-30 07:45:08 UTC --- This has been fixed and GNOME compatibility mode is now enabled by default in all supported openSUSE releases. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.