Upgrading from Split GPG1 to Split GPG2?

[cubit]

Hello

I am using an older version of Enigmail as during the time Split GPG and enigmail did not seem to work well together.  Enigmail expecting gpg2 while split gpg on qubes was offering gpg1.

If I want to upgrade my enigmail to the latest is there anything I need to do to the split GPG set up or should it all just talk GPG2 now?

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Yes, Qubes Split GPG uses gpg2 by default in the backend now.

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJX8+3AAAoJENtN07w5UDAwheUP/j0rmuqkWqQ1R9cIabdBGAxN
EktX8umU+3M/oCRFCJ+lZLPzuxubAxGr+/6hulA1HgTK7Dczd+2gp32xDQ+ULBRp
2lvR204RhWClLYeRcxvH1QRnnT7sd0d3d/wqFDCdbtI2GOxM7NofC/Sv9Uy7D87S
vvtEHnrGW/13LxsygpTpzf9gjB2InWhibuo9VEexE2y/IGPPwcUvmAMBvNyzA9Ac
ShPaZNO+YOMH95/fpfLO2HcUYqKGsaxQT3kFCdRV3xPtv2NC3idkpr3mHPCI3NzG
GmWkPpq1QZxL0bNg6Q4h2FFIRGF9+GuFKt7f4NDcbOBLD4EsiCkc3b6KZJR9ISBo
3LX7Ek15gva7SQZtolBCl4M+lHUJt57IaBpZ7g/o2W83OdvzPgKM/mfTiPxnvH/Q
1Xwmicc3sDTkO4C+98Q52aUFKxPiIYnNH9AEZxGZb8EKLZY39RpqLKrOc5QJupjp
vtBxU2JRaRg9A5Bijf9vptWqfMgPlduNM9FvMKEAXTauwUEE5omDFry8FSjldDg7
9hohr6fBhHINJuRflIVzrsNAEQNMIbgJ8bpwYSBQ/NvLk17EiczPsSEgO7iCuD9t
WF8P5ruElH4If7M6fTBITmJ4cw2kaLgCiUEOpVfw1LddWiH8KOktpofgT5e1POga
7pBUfGNIH1YrE4aVGCJP
=dCE0
-----END PGP SIGNATURE-----

[cubit]

4. Oct 2016 17:58 by a...@qubes-os.org:

On 2016-10-04 07:09, cubit wrote:

I am using an older version of Enigmail as during the time Split GPG and enigmail did not seem to work well together. Enigmail expecting gpg2 while split gpg on qubes was offering gpg1.

If I want to upgrade my enigmail to the latest is there anything I need to do to the split GPG set up or should it all just talk GPG2 now?

Yes, Qubes Split GPG uses gpg2 by default in the backend now.

I upgraded enigmail to v 1.9.5 and it did not go as well as planned.   From what I read of the qubes documents there were nothing to change in qubes settings to take into account the GnuPG2 requrement now.

But when I run thunderbird 45.2.0 + enigmail 1.9.5 I get the following error.

   " GnuPG reported an error in the communication with gpg-agent (a component of GnuPG).

    This is a system setup or configuration error that prevents Enigmail from working properly and cannot be fixed automatically.

    We strongly recommend that you consult our support web site at https://enigmail.net/faq."

The messages decrypt but I lose the notification that the email was decrypted and I do not see any of the options to view details of the encrypted message such like who it was encrypted for.     I did restart both the appVM for thunderbird and the appVM for my keys, both debian 8

[cubit]

4. Oct 2016 19:40 by cu...@tutanota.com:

I upgraded enigmail to v 1.9.5 and it did not go as well as planned.   From what I read of the qubes documents there were nothing to change in qubes settings to take into account the GnuPG2 requrement now.

But when I run thunderbird 45.2.0 + enigmail 1.9.5 I get the following error.

   " GnuPG reported an error in the communication with gpg-agent (a component of GnuPG).

    This is a system setup or configuration error that prevents Enigmail from working properly and cannot be fixed automatically.

    We strongly recommend that you consult our support web site at https://enigmail.net/faq."

The messages decrypt but I lose the notification that the email was decrypted and I do not see any of the options to view details of the encrypted message such like who it was encrypted for.     I did restart both the appVM for thunderbird and the appVM for my keys, both debian 8

Hello qubers,

Has anyone experienced problems with using Splig GPG with Thunderbird and Enigmail 1.9.5 in Debian 8 appVM?       Have also tried to build the AppVM and TB install from scratch instead of simpli upgrading enigmail with existing AppVM.   When ever I try I get the above error. when checking encrypted email.

Cubit

[cubit]

9. Oct 2016 15:17 by cu...@tutanota.com:

Has anyone experienced problems with using Splig GPG with Thunderbird and Enigmail 1.9.5 in Debian 8 appVM?       Have also tried to build the AppVM and TB install from scratch instead of simpli upgrading enigmail with existing AppVM.   When ever I try I get the above error. when checking encrypted email.

Sorry for bumping but hoping someone knows a solution for this?

[george]

Yes. I get the same issue too. I can read the message, but I can't write, and I'm also in Debian-8 VM on Qubes 3.2, with Enigmail and Thunderbird. I can READ messages, but I can't send them, nor verify/encrypt/sign them. I'm not sure what to do with this...

[dmoe...@gmail.com]

On Wednesday, November 16, 2016 at 10:21:33 PM UTC-5, george wrote:
> Yes. I get the same issue too. I can read the message, but I can't write, and I'm also in Debian-8 VM on Qubes 3.2, with Enigmail and Thunderbird. I can READ messages, but I can't send them, nor verify/encrypt/sign them. I'm not sure what to do with this...

Hi,

What template are you using for the gpg VM?

As far as I can tell, gpg2 always requires access to gpg-agent, even if your keys have no passphrase. I realized this was the problem when running "echo test | gpg2 -v --clearsign" in a terminal in the gpg VM always failed. Switching from a modified fedora23-minimal to a full fedora23 template solved the problem for me. If you're also using a debian-8 template for the gpg VM, it might be missing the same thing that fedora23-minimal was missing. (Which I never figured out because I needed to get enigmail working.)

Best,
Daniel

[cubit]

17. Nov 2016 15:33 by dmoe...@gmail.com:

On Wednesday, November 16, 2016 at 10:21:33 PM UTC-5, george wrote:

Yes. I get the same issue too. I can read the message, but I can't write, and I'm also in Debian-8 VM on Qubes 3.2, with Enigmail and Thunderbird. I can READ messages, but I can't send them, nor verify/encrypt/sign them. I'm not sure what to do with this...

What template are you using for the gpg VM?

For me both my vault VM and thunderbird VM are sharing the same Debian 8 template.   This template does have gnupg-agent 2.0.26-6+deb8u1  installed

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Sorry, this is a known issue. Enigmail 1.9 is incompatible with Split GPG on Debian 8:

https://github.com/QubesOS/qubes-issues/issues/2170

Until this is resolved, I recommend using the Fedora template instead.

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJYMDr6AAoJENtN07w5UDAwCbgP/3z9RU8VOsmvVo+B7YA0E5PJ
+R9e8DuxKLavW5FRL+eoWclOnQ7/BgdINZa7r59XEs4e7fANQk9ZEdMErNbV3zS5
zw1hht0nbhUj7xZCGdw8AmPyTxp1KDBBB9MmFq3rP0ZlrEaacj4ef1U9jHxcnJMz
t1AciTj2R1he2y2hilEZ2f6hHAlzf9PYiu5o7YVnR9mLsbSRenYUewO3ExbVbrYP
me7P/dNasqZ/VAB6HB1EByrUycgt5vKxICmd4+E6N8qXn4K/15DGTQrgh1R9aGAD
2zBC/se8xMhDKPMZ0FZCrXZM6DnqgWh32iAdBR/JQQrOzpZMwel7i84BA5eDm/KQ
RhuEPhvdZUAqzfF68jk6yOKcMljGpatN+tgrpdX0SYObXCp9YpcmcfR8rDqT9b9F
wkJ1rIyDN43+gUJGNGzaJkgIT2RpjdfJ5VQppw73L4JwoKsPhebO1lwAtGU4FLbJ
O9Su3jkCJNfBFfOJOCvHmVHFZykgVIsy6SlTIJ6S15mPb82Iy/yT+bIcqsq2XMkK
m56NxHeUw7jwGEsvuuAlWHM6vy+ReYIVFgVOp+Hd/lFFs3cYN5KsGpT4L3UYj0Bg
Nw085JKxPjvnwdD+YcuN5hvxv3Qj0KM6LLf8rylHFsuICJK2bN0zx9Hh5Nv6ZuZr
atK2PCEgIUZ7ZlPidX35
=rsHN
-----END PGP SIGNATURE-----

[Daniel Moerner]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 11/19/2016 06:43 AM, Andrew David Wong wrote:
> Sorry, this is a known issue. Enigmail 1.9 is incompatible with
> Split GPG on Debian 8:
>
> https://github.com/QubesOS/qubes-issues/issues/2170
>
> Until this is resolved, I recommend using the Fedora template
> instead.

I added some comments to the issue tracker:
https://github.com/QubesOS/qubes-issues/issues/2170#issuecomment-2617233
58

I can confirm that this is fixed in Debian 9. I was unable to fix it
in Debian 8. It must be the case that gnome-keyring is hijacking
gpg-agent independently of the contents of
/etc/xdg/autostart/gnome-keyring-gpg.desktop.

Daniel
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIwBAEBCAAaBQJYMIZNExxkbW9lcm5lckBnbWFpbC5jb20ACgkQyz0BTtfxsyoU
yRAAi4wWlOuvW4YYQYgKe5PWhgm/66Lgc9sAnzdf57QHdKUMyLMNWEjZnWuuOsr2
LMYmd/xNtUv4+B8LZJLF0SCPNYNrFuX6utFJF/rIs7hf7mNb06P9XP4PCjpBcurh
7IH+083aVylapADJ5q8JegXullDH2tN2yKhXFKjPMGkBz/+V9T0Kg2kuVcvradf5
3VQ1jpOYnYnJfWeY74xvDTOrS/hT2zPbZma+i7vqmcL6+JHlHQny5HLqw0+a9duQ
dlrLoVwSe6zx6leqUo+3IewZmd9s+uSZfl5UrUh0UDysVewvQx9qlA/UvePtLD2p
ktDcmeNHyoGfW0FOXfkIwTgxiRPBYrGT3n6vpe1KDP1fp3C6ETzLseco3EidjHWh
itDCMrjFYmw2Z+xOyh17pmIJZuxrwmLiP8xd8Y65zgfcCWMKzkZ45AAl9TIGPvut
TJ4Fz3xZ2E5n1GxUMLal7ADgGsgDxvYaNzlKMpfVsk8ikd9+EQpUIAOrejFjyuE6
J1e0cv8Gu1QuW7/88gLt0YhdOymrgJE7L9ty8lDbgZqz7+SwRyZtCc6Vau1FmYrm
RKPf6m8MwImB34xyL6EX5Ocums/+IWZVmVBPPqYApCKx4UVuikNQMQC+CRqZrtz2
jz/AVeH+3YiVHssdddjQoXdB6FojbQZ6XaTNpMIsK8acJJ0=
=+FX1
-----END PGP SIGNATURE-----

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2016-11-19 03:43, Andrew David Wong wrote:
> On 2016-11-17 10:05, cubit wrote:
>> 17. Nov 2016 15:33 by dmoe...@gmail.com:
>
>>> On Wednesday, November 16, 2016 at 10:21:33 PM UTC-5, george wrote:
>>>> Yes. I get the same issue too. I can read the message, but I can't write, and I'm also in Debian-8 VM on Qubes 3.2, with Enigmail and Thunderbird. I can READ messages, but I can't send them, nor verify/encrypt/sign them. I'm not sure what to do with this...
>>>
>>> What template are you using for the gpg VM?
>>>
>> For me both my vault VM and thunderbird VM are sharing the same Debian 8 template. This template does have gnupg-agent 2.0.26-6+deb8u1 installed
>
>
> Sorry, this is a known issue. Enigmail 1.9 is incompatible with Split GPG on Debian 8:
>
> https://github.com/QubesOS/qubes-issues/issues/2170
>
> Until this is resolved, I recommend using the Fedora template instead.
>

Update: 3n7r0p1 has pointed out that this is not an issue, since Enigmail 1.9 is not contained in the Debian 8 repos to begin with.

Details: https://github.com/QubesOS/qubes-issues/issues/2170#issuecomment-261741646

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJYMTBoAAoJENtN07w5UDAw1K4QAIrfh6kri4K5DV3UwY/aGYDS
AQsMBR0HHb58pOyiqHvWHmEgvvX3v70k7q8HKn8hsq4cICakp5/Ww4BRM0gaD+qn
lkvM4AHDER+aXaHj0qYI/mzgkS6aCKdzoTdenj8CNp+fKDGsdfUaJwGPvjoHKUpO
3w2na590jHPqmPKCzDhIsYj4hO37PnCpQoapHlnTkbLM5pL/KIL3SSmYH+d1A2HZ
0fytTGu58nw+pcdYSQZfQFh7jsXQm3rqWiCQbmlxJMzo3XCjRf0FH8nNGfvoKZMZ
rTmrhdfSXW5kOPzXPR8tBgw/ssNa2c0c6pBfzRuSzs/dCcSbqXnwWeYIzQ9NmcMQ
UVh23EJ0I2tY+H+bvTw70ZgFLp9ETYuaR6dZ2ijasOSofNWj2UCIRyKPkYNirDMU
akyAaZjDSCEf2prk5n/Wtqt48rdkwfL5loJwDGcx577inUDV3asYRi5qSfiowmyZ
IFj79iOBQWpcnbOMt2aPG6yanGQWQT1YoQ3dRy0634RJpq0mxPwueA8ySLHlgapb
qNRkfaG9PFDe4OXqXGA1UL+rjjBiT0x082Gw2wsh5KlUhqMqXC/3o/jEWouKTHLK
5b2dgrF5usFU+6bgEI3cn9XgZDMP12NCifQFSoczytWNBV2AX2s9HdqrFQtjUCH6
+AyF+Nw9CwEJivOgJBuU
=FKgI
-----END PGP SIGNATURE-----

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Sat, Nov 19, 2016 at 09:11:21PM -0800, Andrew David Wong wrote:
> On 2016-11-19 03:43, Andrew David Wong wrote:
> > On 2016-11-17 10:05, cubit wrote:
> >> 17. Nov 2016 15:33 by dmoe...@gmail.com:
> >
> >>> On Wednesday, November 16, 2016 at 10:21:33 PM UTC-5, george wrote:
> >>>> Yes. I get the same issue too. I can read the message, but I can't write, and I'm also in Debian-8 VM on Qubes 3.2, with Enigmail and Thunderbird. I can READ messages, but I can't send them, nor verify/encrypt/sign them. I'm not sure what to do with this...
> >>>
> >>> What template are you using for the gpg VM?
> >>>
> >> For me both my vault VM and thunderbird VM are sharing the same Debian 8 template. This template does have gnupg-agent 2.0.26-6+deb8u1 installed
> >
> >
> > Sorry, this is a known issue. Enigmail 1.9 is incompatible with Split GPG on Debian 8:
> >
> > https://github.com/QubesOS/qubes-issues/issues/2170
> >
> > Until this is resolved, I recommend using the Fedora template instead.
> >
>
> Update: 3n7r0p1 has pointed out that this is not an issue, since Enigmail 1.9 is not contained in the Debian 8 repos to begin with.

Isn't it possible to install enigmail directly from thunderbird/icedove?
That would result in the most recent version.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJYMYwHAAoJENuP0xzK19csvmoH/1iyLXWzIVdUm73Biza1Krbc
TMjcjZX76p0KF8Oo8P7PGNuWaCHV0fKK6FRBsP28o4AH+cyVvAeYmX+qrg725lZ0
irqwxAIntrWgeqLRqArMjU+l374FmU1WD1MKoaK41H+1kA5197En3sekCNRaEqlY
Iu4ct6r4550W/0r6rj3nRxuxNoqYdKSxYn6qgZ0uMfo3dKp1248q9+qAuP8j+HA7
QM51irIwpoi1t9Rm24AqmNILmAakviM1c0EwilEphrW2SJFT0pvxm/tJ7RIk55mg
nl6bUU5XECUY/3x4YTAvo61AoNgIoVZg7BnguyLHW2qAdqKcVUEK5NUjb+M5UEA=
=QjVB
-----END PGP SIGNATURE-----

[entr0py]

Marek Marczykowski-Górecki:

> On Sat, Nov 19, 2016 at 09:11:21PM -0800, Andrew David Wong wrote:
>> On 2016-11-19 03:43, Andrew David Wong wrote:
>>> On 2016-11-17 10:05, cubit wrote:
>>>> 17. Nov 2016 15:33 by dmoe...@gmail.com:
>>>
>>>>> On Wednesday, November 16, 2016 at 10:21:33 PM UTC-5, george wrote:
>>>>>> Yes. I get the same issue too. I can read the message, but I can't write, and I'm also in Debian-8 VM on Qubes 3.2, with Enigmail and Thunderbird. I can READ messages, but I can't send them, nor verify/encrypt/sign them. I'm not sure what to do with this...
>>>>>
>>>>> What template are you using for the gpg VM?
>>>>>
>>>> For me both my vault VM and thunderbird VM are sharing the same Debian 8 template. This template does have gnupg-agent 2.0.26-6+deb8u1 installed
>>>
>>>
>>> Sorry, this is a known issue. Enigmail 1.9 is incompatible with Split GPG on Debian 8:
>>>
>>> https://github.com/QubesOS/qubes-issues/issues/2170
>>>
>>> Until this is resolved, I recommend using the Fedora template instead.
>>>
>
>> Update: 3n7r0p1 has pointed out that this is not an issue, since Enigmail 1.9 is not contained in the Debian 8 repos to begin with.
>
> Isn't it possible to install enigmail directly from thunderbird/icedove?
> That would result in the most recent version.
>

Marek is correct.

When installed from the repo, enigmail updates are disabled. However, newer versions can be installed through the addons manager and such versions can also be updated via that method.

Issue should be re-opened or docs should advise Debian users to install via apt-get (not a bad practice anyway).

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 11/20/16 03:41, Marek Marczykowski-Górecki wrote:
> On Sat, Nov 19, 2016 at 09:11:21PM -0800, Andrew David Wong wrote:
>> On 2016-11-19 03:43, Andrew David Wong wrote:
>>> On 2016-11-17 10:05, cubit wrote:
>>>> 17. Nov 2016 15:33 by dmoe...@gmail.com:
>>>
>>>>> On Wednesday, November 16, 2016 at 10:21:33 PM UTC-5, george wrote:
>>>>>> Yes. I get the same issue too. I can read the message, but I can't write, and I'm also in Debian-8 VM on Qubes 3.2, with Enigmail and Thunderbird. I can READ messages, but I can't send them, nor verify/encrypt/sign them. I'm not sure what to do with this...
>>>>>
>>>>> What template are you using for the gpg VM?
>>>>>
>>>> For me both my vault VM and thunderbird VM are sharing the same Debian 8 template. This template does have gnupg-agent 2.0.26-6+deb8u1 installed
>>>
>>>
>>> Sorry, this is a known issue. Enigmail 1.9 is incompatible with Split GPG on Debian 8:
>>>
>>> https://github.com/QubesOS/qubes-issues/issues/2170
>>>
>>> Until this is resolved, I recommend using the Fedora template instead.
>>>
>
>> Update: 3n7r0p1 has pointed out that this is not an issue, since Enigmail 1.9 is not contained in the Debian 8 repos to begin with.
>
> Isn't it possible to install enigmail directly from thunderbird/icedove?
> That would result in the most recent version.
>

Yes. It all depends on which versions (or version combinations) Qubes is willing to support. I take this to mean that we're willing to support the latest version available from addons.mozilla.org, so I've reopened the issue.

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJYM5GHAAoJENtN07w5UDAwsg0QALmQVFhF+wkI+gH3yZsbqKVH
odK76qKk/hk+nN7o0Vu1Q0D0+MNteNdV9cax0Kfsvp5jrWCiP4K1Td5BLjthTY75
r6Jv10Si8DfYVE85VJ17URK6AvZ8qri2Kujh8RYDytb1nKXfzl9vS8/7BK3b2g5I
1sLWpLy/6HQmaHMeYf6BFleOecbUBZKBuZBtZQWqEI4Ba51OMpvdgVSDeuBjaIAH
GZWecUF+Dm7OzrzhabREcPTRtJtIuOOVQBVKQWb4nVHVhNea99TPDOdWkKdruEim
encK3SfJWY2VdVcVz/8AMqrvOXLb16f9wYdVxD9ixvg3TaIqZuAY5RtWhKWMxGaH
hrqOTYrep1UzSWA8EgL19YU0eTmUSqcIwW6ThxrGlbQrOX7+jmV+bMEEJUlUozlH
ykPAn9CL706+i5rEwNfLMbjNfdw3Xaf+RKppTW7mD1cGqxhP6YSrlb66Cv/XuOD1
G/TUxXmTDiKp4aeD8dpzv6+GUFmCYgHyt5qCw1qDNXuxK0CINzmgSUiq0gkPPNzY
OkSufzigQ6Q2HGW4+pD/NTrOl/ebCMkG2tnchJ+JQgstyN+glZfpZEs5MPneRnPY
vNiBTSd23KbaSmfv20TxZ54qCuj9kHVQQbuLN6tjJHGN5oxmae1ybsREPtEgQ7pe
6cezq+XLNzT815VTG9jw
=tFsT
-----END PGP SIGNATURE-----