I am using pass to manage my passwords, and I also use the [passmenu](https://git.zx2c4.com/password-store/tree/contrib/dmenu/passmenu) , a script that uses dmenu to select which password you want to copy to the clipboard. Now on my Linux machine running Gnome , upon selecting a password from the passmenu a full screen authentication overlay (Pinentry?) appears asking for the master password. Please correct me if this is not pinentry It looks like this: On my NetBSD machine however, using only a stand alone WM, I am unable to authenticate pass when launched from passmenu as no pinentry is triggered. When launched from within a terminal however with pass -c github.com for example, you get this: Essentially passmenu is useless if I cant authenticate it. Therefore my question is, would it be possible to use passmenu to spawn this pinentry program/event in an xterm ?

gnome-keyring and systemd black-magic 😉 EDIT: If you really want this... $ pkgin search gnome | grep keyring gnome-keyring-2.32.1nb30 GNOME password and secret manager gnome-keyring-manager-2.20.0nb49 GNOME password and secret manager libgnome-keyring-3.12.0nb1 GNOME password and secret manager if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Also, you'll need polkit running. $ doas pkgin install gnome-keyring gnome-keyring-manager Password: calculating dependencies...done. 30 packages to install: gnome-keyring-2.32.1nb30 gnome-keyring-manager-2.20.0nb49 gtk2+-2.24.32nb16 rarian-0.8.1nb5 libgnomeui-2.24.5nb51 libglade-2.6.4nb35 GConf-3.2.3nb6 python27-2.7.18nb3 py27-expat-2.7.18 dbus-glib-0.110nb1 ORBit2-2.14.19nb5 popt-1.18 libgnomecanvas-2.30.3nb29 libgnome-keyring-3.12.0nb1 libgnome-2.32.1nb40 libbonoboui-2.24.5nb2 gnome-vfs-2.24.4nb44 getopt-1.1.6 bash-5.0.18 hal-0.5.14nb24 libcanberra-0.30nb4 libbonobo-2.32.1nb2 libart-2.3.21 libIDL-0.8.14nb5 libltdl-2.4.6 usbids-20200622 policykit-0.9nb25 pciids-20200222 libvolume_id-0.81.1nb1 hal-info-20091130nb8 0 to refresh, 0 to upgrade, 30 to install 29M to download, 206M to install proceed ? [Y/n] n if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); }

pin black-magic Nay, Sir @pin , it be deep black magic this. Verily I could not have perform'd this feat (or maybe, it would have taken me many a day to accomplish)--but you have solved it in an instant!

pin Well, no, I dont want gnome-keyring installed... 😅 What I want, is to trigger the existing authentication program (whatever its called) used when running pass -c in a terminal. Although I am not clever enough to figure out how, I would imagine that with some scripting knowledge this should be possible?

pfr You can use a keybinding in your spectrwm.conf to spawn an xterm instance and execute the command 😉 What about something like xterm -e "command_to_execute"

pin Yes, but that would only be useful for individual passwords.. That's why I want it to work with passmenu . I have more passwords than I could remember the bindings for 😅

pfr But how do you launch passmenu ?

pin program[passmenu] = ~/.config/spectrwm/./passmenu.sh $dmenu_bottom -fn $bar_font -nb $bar_color -nf $bar_font_color -sb $bar_color_selected -sf $bar_font_color_selected bind[passmenu] = MOD+Shift+p if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Passmenu.sh (same as linked above) #!/usr/bin/env bash shopt -s nullglob globstar typeit=0 if [[ $1 == "--type" ]]; then typeit=1 shift fi prefix=${PASSWORD_STORE_DIR-~/.password-store} password_files=( "$prefix"/**/*.gpg ) password_files=( "${password_files[@]#"$prefix"/}" ) password_files=( "${password_files[@]%.gpg}" ) password=$(printf '%s\n' "${password_files[@]}" | dmenu "$@") [[ -n $password ]] || exit if [[ $typeit -eq 0 ]]; then pass show -c "$password" 2>/dev/null else pass show "$password" | { IFS= read -r pass; printf %s "$pass"; } | xdotool type --clearmodifiers --file - fi if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); }

@pfr Maybe I was wrong... https://wiki.archlinux.org/index.php/Pass https://pkgsrc.se/search.php?stype=folder&sbranch=CURRENT&so=pinentry https://superuser.com/questions/520980/how-to-force-gpg-to-use-console-mode-pinentry-to-prompt-for-passwords Now I see what you're looking for, ...I guess.

If pass needs a terminal to take input from, just modify passmenu.sh to run pass via xterm -e program , like @pin suggested.

Opening pinentry in xterm from passmenu(dmenu)

rvp

pfr briefly opens an xterm then exits immediately

Use this as a debug run-pass.sh:

#!/usr/bin/env bash

if [[ $# -ne 2 ]]
then	printf '%s: needs 2 arguments\n' $0 1>&2
read x
	exit 1
fi

typeit=$1
password=$2

if [[ $typeit -eq 0 ]]; then
echo "pass show"
	pass show -c "$password"
else
echo "pass type"
	pass show "$password" | { IFS= read -r pass; printf %s "$pass"; } |
		xdotool type --clearmodifiers --file -
fi
read x

It waits until enter is pressed.
What does this display?

Note: DMENU_SITE_LABEL should be the name of some .gpg file, minus the .gpg extension. (ie. Whatever dmenu shows.)

pfr

rvp
Ok, so getting a little closer.. The script above forces the xterm window (the one that opens with pinentry) to stay open and now show's the usual message 'Copied password to clipboard. will clear in 45 seconds'

While this window is open, my password is copied to xclip and I can paste it where needed. However, If I close this window, even before the 45 seconds is up, this somehow revokes it and clears the clipboard.

rvp

pfr However, If I close this window, even before the 45 seconds is up, this somehow revokes it and clears the clipboard.

That sounds like the correct behaviour. If you close the window, the program is terminated and it clears the clipboard before it dies.

If you want to be able to close the window, or, press ENTER and make the program disappear, and still retain the password for 45 secs, then that's a new feature, I think--one you'll have to request from the developer of pass. He'll have to add code to fork(2) a new background process to handle the clipboard clearing while the main instance exits on ENTER, or somesuch.

pfr The script above forces the xterm window (the one that opens with pinentry) to stay open and now show's the usual message 'Copied password to clipboard. will clear in 45 seconds'

Hmm. Are you saying that without the read x at the end, pass would've immediately exited? Doesn't it open an input box for the decryption PIN? I don't have pass installed, but, this behaviour doesn't make sense to me. I can understand it exiting (and the xterm window closing) after waiting for 45 seconds.

pfr

rvp If you want to be able to close the window, or, press ENTER and make the program disappear, and still retain the password for 45 secs, then that's a new feature, I think--one you'll have to request from the developer of pass. He'll have to add code to fork(2) a new background process to handle the clipboard clearing while the main instance exits on ENTER, or somesuch.

Ok, will see what I can do.

rvp Hmm. Are you saying that without the read x at the end, pass would've immediately exited? Doesn't it open an input box for the decryption PIN? I don't have pass installed, but, this behavior doesn't make sense to me. I can understand it exiting (and the xterm window closing) after waiting for 45 seconds.

Yes. Upon removing read x, on the first instance obviously, the pinentry window opens, but once you enter the passphrase the window closes, also clearing the clipboard. As opposed to having read x in the script, the window stays open until it is closed manually, and the password is kept on the clipboard for 45 seconds.

rvp

pfr Upon removing...the pinentry window opens, but once you enter the passphrase the window closes, also clearing the clipboard

Hm. This behaviour only makes sense if pass was doing something like what I outlined before; but, the clearing of the password doesn't make sense. I'll look into the source--when I get the time. For now, just keep the wndow around and press ENTER to close it.

BTW, since you're running under X, wouldn't it be easier to set ~/.gnupg/gpg-agent.conf to run pinentry-gtk and bypass all these minor irritations entirely?

rvp

pfr As opposed to having read x in the script, the window stays open until it is closed manually,

Just realized: since both the scripts run under bash, you can change the unconditional read, read x to a read with timeout: read -t 45 x. The window will then close when the clipboard clears.

rvp

pfr Upon removing read x, on the first instance obviously, the pinentry window opens, but once you enter the passphrase the window closes, also clearing the clipboard.

Update: patched patch!
Turns out pass is written in bash (I had assumed C) and it wasn't too hard to go through it and find the problem. There is a bug in pass with non-interactive shells.

Patch:

--- pass.orig	2020-07-17 13:45:22.000000000 +0000
+++ pass	2020-10-06 23:08:41.159955217 +0000
@@ -157,6 +157,12 @@
 	local sleep_argv0="password store sleep on display $DISPLAY"
 	pkill -f "^$sleep_argv0" 2>/dev/null && sleep 0.5
 	local before="$(xclip -o -selection "$X_SELECTION" 2>/dev/null | $BASE64)"
+	# Explicitly ignore SIGHUP because "disown" only works in interactive shells.
+	# Otherwise, in non-interactive cases like "xterm -e passmenu" or "xterm -e pass",
+	# which is needed to supply a terminal for pinentry when the script is called from
+	# a GUI, bash will kill xclip when the script finishes ie. before $CLIP_TIME has
+	# elapsed.
+	trap '' HUP
 	echo -n "$1" | xclip -selection "$X_SELECTION" || die "Error: Could not copy data to the clipboard"
 	(
 		( exec -a "$sleep_argv0" bash <<<"trap 'kill %1' TERM; sleep '$CLIP_TIME' & wait" )
@@ -173,7 +179,7 @@
 		qdbus org.kde.klipper /klipper org.kde.klipper.klipper.clearClipboardHistory &>/dev/null
 
 		echo "$before" | $BASE64 -d | xclip -selection "$X_SELECTION"
-	) >/dev/null 2>&1 & disown
+	) >/dev/null 2>&1 &
 	echo "Copied $2 to clipboard. Will clear in $CLIP_TIME seconds."
 }

You can either use the original passmenu.sh or the 2-piece version (both called via xterm -e ... as before to supply a terminal). They both do the same thing, just their aesthetics differ (with the first you get a blank screen before pinentry when selecting items; with the other you don't). You won't need the read x pauses now.

OK...back to sleep. (Woke up for a whizz and this started nagging, so I had to sit down and do something about it.)

rvp since you're running under X, wouldn't it be easier to set ~/.gnupg/gpg-agent.conf to run pinentry-gtk and bypass all these minor irritations entirely?

🙂

pfr

rvp pin
Yes, this does make more sense. But as I'm sure @pin can appreciate, I am striving for a gtk free system (eventually).
But for now it may have to do.

pfr

where do I put gtk2 themes? 😅

pfr /usr/pkg/share/themes
System wide configuration in /usr/pkg/share/gtk-2.0/gtkrc, user configuration ~/.gtkrc-2.0

pfr

rvp
Somehow, this does not give me a Pinentry, just this:

rvp

pfr Somehow, this does not give me a Pinentry, just this:

Sorry for that. The patch had a stupid typo. Corrected now. Apply to distribution's original /usr/pkg/bin/pass--after saving a copy of that somewhere. I'll upstream this patch RSN.

57 posts for this trifling issue! I could've fixed all this back around post #11 had I not dragged my feet over installing gpg & friends on my own system. Sorry for making you my guinea pig, mate.

pfr

rvp Not at all! You need not apologize, you are selflessly helping me without any obligation to do so. Not just with this, but with heirloom-mailx and with ncspot ... I am happy to be the guinea pig because for one; It helps me to learn what I am doing, and two; I want to be involved in the process of solving these issues as much as possible, so I can feel a sense of accomplishment (even though I lack the technical knowledge to fully understand what I'm doign most of the time) 😅

In fact, I'd go one step further and say, I apologize for constantly bugging you [et al.] with silly questions about things that ultimately aren't that important. So I sincerely thank you.

Now, I'm curious, what was the typo? + trap '' HUP wasn't there before, was it?

I will try this patch later tonight once I finish work. Cheers.

rvp

pfr Now, I'm curious, what was the typo? + trap '' HUP wasn't there before, was it?

It was there, but, in the wrong place. What I originally posted was some speculative change I had made to the "source"; not the diff for the final stuff in /usr/pkg/bin/pass.

pfr

rvp
Ok, I finally got around to trying the patch. I get the same result as the above screneshot.
I couldn't figure out how to patch the file using patch so I just backed up the original and edited the file manually.
I've pasted the complete file used here incase you want to check it.

rvp

pfr I couldn't figure out how to patch the file using patch so I just backed up the original and edited the file manually.

That file has extra \r (carriage-return) characters in it at the end of lines which messes up your script (did you edit the file on Windows?)

Copy my patch into a file called pass.patch and apply like this (as root):

# cd /usr/pkg/bin
# patch -p0 -l < /PATH/TO/pass.patch

The original pass file will be saved as pass.orig. There should be no pass.rej (reject) file created.

The screenshot shows me that the "debug" version of run-pass.sh is being used. Use either a) the original versions of passmenu.sh or b) the split passmenu.sh + run-pass.sh (non-debug version).

pfr

rvp Doh! 🙄 It's been a while since I've needed to patch a file. Thanks. I was trying to patch it (a copied version in my home folder) without root and using patch -p1
Will try this again.

bitofhope

Hi! Assuming this topic is still relevant, might I suggest you take a look at https://github.com/ritze/pinentry-dmenu

Seems like it would fit your needs well and visually integrate with passmenu as a bonus.

pfr

bitofhope OMG thank you!

I haven't tried it yet, but I will! I kind of gave up on this when it looked like I needed to start patching pass and just settled for the pinentry-gtk which works fine.

But THIS is exatly what I was looking for! I assume I can just enter my passphrase in the dmenu bar? .. anyway, I'll get this working and report back.

Cheers

EDIT:

Trying to install pinentry-dmenu and getting this error:

$ doas make install       
Password:
pinentry-dmenu build options:
CFLAGS   = -std=c99 -pedantic -Wall -Os -I/usr/X11R6/include -I/usr/include/freetype2 -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200809L -DVERSION="0.1" -DXINERAMA -DPACKAGE_VERSION="0.1" -DPACKAGE_BUGREPORT="https:\/\/github.com\/ritze\/pinentry-dmenu"
LDFLAGS  = -s -L/usr/X11R6/lib -lX11 -lXinerama -lfontconfig -lXft
CC       = cc
make -C pinentry
CC pinentry.c
pinentry.c:25:10: fatal error: assuan.h: No such file or directory
 #include <assuan.h>
          ^~~~~~~~~~
compilation terminated.
*** Error code 1

Stop.
make[1]: stopped in /home/dave/Downloads/pinentry-dmenu/pinentry
*** Error code 1

Stop.
make: stopped in /home/dave/Downloads/pinentry-dmenu
$

Dont know about assuan.h ?

rvp

pfr I kind of gave up on this when it looked like I needed to start patching pass

I've sent that small patch upstream, so password-store-1.7.4 should have that fix when it comes out.

pfr Dont know about assuan.h

That's part of the GPG suite. Install libassuan (if not already installed), then add a -I/usr/pkg/include to INCS and -L/usr/pkg/lib to LIBS (both in config.mk).

(Notice, I'm not sending a patch for this--just instructions instead--as you dislike patches.)😆

Edit: Also change X11R6 to X11R7 (what kind of golden oldie OS is this dev. running on?) and uncomment the FREETYPEINC definition for OpenBSD (NetBSD uses the same path).

« Previous Page Next Page »