feat: Add GnuPG 2.4+ compatibility and fix keychain permission issues #43
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit implements critical fixes to make pinentry-touchid compatible with modern GnuPG versions (2.4+) and resolves keychain access permission issues. ## Key Changes ### 1. GETINFO Command Support - Implemented GETINFO handler for commands required by GnuPG 2.4+ - Added support for: flavor, version, pid, and ttyinfo queries - Resolves "You may want to update to a newer pinentry" errors ### 2. Keychain Permission Handling - Added ensureKeychainAccess() function to properly handle macOS permission dialogs - Fixed flow to check keychain permissions before Touch ID authentication - Ensures pinentry-touchid can access entries created by pinentry-mac ### 3. Name Parsing Fix - Fixed regex parsing to correctly extract user names from GPG descriptions - Strips GPG key comments (e.g., "GPG Key generated...") from names - Ensures keychain entry labels match between pinentry-mac and pinentry-touchid ### 4. Duplicate Entry Handling - Changed duplicate keychain entry errors from fatal to non-fatal - Allows the authentication flow to continue when entries already exist - Improves robustness when switching between pinentry programs ## Technical Details The main issue was that GnuPG 2.4+ requires pinentry programs to respond to GETINFO queries during initialization. Without these handlers, gpg-agent would abort the connection immediately after the handshake. Additionally, when keychain entries are created by pinentry-mac, macOS requires explicit permission for pinentry-touchid to access them. The new flow ensures these permissions are granted before attempting Touch ID authentication. ## Testing - Added comprehensive unit tests for GETINFO commands - Verified compatibility with GnuPG 2.4.8 on macOS - Tested keychain permission flow with existing entries - All existing tests continue to pass Fixes jorgelbg#9, jorgelbg#17, jorgelbg#42
- Changed module path from jorgelbg to lujstn - Updated .goreleaser.yml to point to lujstn/homebrew-tap - Added Homebrew installation instructions to README - Updated imports to use new module path
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit implements critical fixes to make pinentry-touchid compatible with modern GnuPG versions (2.4+) and resolves keychain access permission issues.
Key Changes
1. GETINFO Command Support
2. Keychain Permission Handling
3. Name Parsing Fix
4. Duplicate Entry Handling
Technical Details
The main issue was that GnuPG 2.4+ requires pinentry programs to respond to GETINFO queries during initialization. Without these handlers, gpg-agent would abort the connection immediately after the handshake.
Additionally, when keychain entries are created by pinentry-mac, macOS requires explicit permission for pinentry-touchid to access them. The new flow ensures these permissions are granted before attempting Touch ID authentication.
Testing
Fixes #9, #17, #42