Skip to content

Commit 307abf0

Browse files
committed
fix(gpg): remove --pinentry-mode loopback from key import
loopback mode corrupts the at-rest storage of passphrase-less cv25519 secret keys under GnuPG 2.4.x: the keygrip is listed as present but unusable for pkdecrypt, so pillar decryption fails at render time with "Bad secret key" while the master still starts cleanly. loopback does not bypass gpg-agent and is pointless for passphrase-less keys; --batch --no-tty already covers the non-interactive CI case.
1 parent f921905 commit 307abf0

1 file changed

Lines changed: 1 addition & 3 deletions

File tree

assets/runtime/functions.sh

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -556,9 +556,7 @@ function _setup_gpgkeys() {
556556
chmod 700 "${SALT_GPGKEYS_DIR}"
557557

558558
local GPG_COMMON_OPTS=(
559-
--no-tty
560-
--batch # non-interactive mode
561-
--pinentry-mode loopback # do not use gpg-agent
559+
--no-tty --batch # non-interactive mode
562560
--homedir="${SALT_GPGKEYS_DIR}"
563561
)
564562

0 commit comments

Comments
 (0)