Page MenuHome GnuPG

hijack warning
Closed, ResolvedPublic

Description

Recently gnupg started issuing the following message when it senses it is using
gnome-keyring as the key agent:
gpg: WARNING: The GNOME keyring manager hijacked the GnuPG agent.
gpg: WARNING: GnuPG will not work properly - please configure that tool to not
interfere with the GnuPG system!

These messages should be eliminated as they interfere with the normal
applications of gngpg. For example, after upgrading to gnupg-2.0.25 I could no
longer send any email using mutt without having to confirm that the messages
should be ignored. I had to do that on every message I sent.

While it may be that gnome-keyring does not provide a complete implementation of
the gpg agent protocol and that might cause problems for some users, it works
without problems for the vast majority of users.

The messages recommend that user configure their environments so that gnupg uses
gpg-agent rather than gnome-keyring, but doing so is beyond the skill level for
most users. Furthermore, some users actually prefer using gnome-keyring, and
these messages make that no longer practical.

Using words like 'hijacked' in these messages make it seem like gnome-keyring is
dangerous; like it is some kind of virus. This is misleading and counter
productive. It will likely frighten users, and when they cannot figure out how
to resolve the problem they are likely to abandon gnupg all together.

Many distributions configure gnupg to use gnome-keyring by default because it
works well in most cases and because most users are completely in-capable of
configuring gnupg to use an agent on their own. So in a very real sense, these
messages are complaining to the wrong people at the wrong time.

Please get rid of these warning messages. If you really feel the need to issue
warning messages, only do it when the agent actually fails.

Details

Version
2.0.25

Event Timeline

werner added a subscriber: werner.

GKD hijacks the gpg <-> gpg-agent IPC. It does this for a long time now but
most users don't care about this and the mainainer keeps this as the default.
Everone using gpgsm has always run into this problem.

Yes, this is hijacking.

The gpg--agent emulation of GKD is indeed dangerous. GnuPG consists of several
closely connected components. Arbitrary replacing an compenent breaks the whole
thing. On proprietary systems such a behaviour would be called malware.

werner claimed this task.