search

kacpowsky / gpgYubiKey

This is a guide to using YubiKey as a smart card for secure encryption, signature and authentication operations. (MacOS)
1 stars 0 forks source link

Stuck on pinentry showing "Remaining Attempts: 0" #2

Open nottoseethesun opened 2 weeks ago

nottoseethesun commented 2 weeks ago

Then when I enter the correct PIN anyway, it fails.

Intel Mac. Happens for all the scenarios where pinentry is used. Using the YubiKey Manager, I reset all pins of opt, fido, and piv. That didn't fix the issue.

Upgraded to the latest macOS, Sequoia 15.1, and upgraded all of brew (I have all gpg programs on brew).

Did your .zshrc instructions, and also, the demon kill/restarts, and unplug/replug YubiKey.

Still no change. My debug log shows nothing about the issue.

I saw on a Reddit post from a year ago, a note that the macOS system ssh-agent needed to be turned off via launchctl so that it doesn't conflict with the gpg one. Well, now that's not possible to change in macOS apparently (the o/s is rented to all users, not owned).

Idk if that's the issue but would need other things to check/try to get a YubiKey with a PIN to work on macOS.

kacpowsky commented 2 weeks ago

Install pinentry with brew install pinentry-mac then edit gpg-agent.conf to set the pinentry-program path to:

Apple Silicon Macs: /opt/homebrew/bin/pinentry-mac Intel Macs: /usr/local/bin/pinentry-mac MacGPG Suite: /usr/local/MacGPG2/libexec/pinentry-mac.app/Contents/MacOS/pinentry-mac Then run gpgconf --kill gpg-agent for the change to take effect.

nottoseethesun commented 2 weeks ago

I already had that setting in my ~/.gnupg/gpg-agent.conf:

pinentry-program /usr/local/bin/pinentry-mac
enable-ssh-support
default-cache-ttl 600
max-cache-ttl 7200
debug-level basic
log-file $HOME/.gnupg/gpg-agent.log # helpful for debugging

I just did gpgconf --kill gpg-agent and still got the same issue.