Neovim compatibility (for terminal pinentry prompts)

[ghallberg]

neovim spawns shell commands connected to pipes, which prevents vim-gnupg from receiving input when asking for passphrase.

To make vim-gnupg work with neovim it would be great to see an updated version using termopen.

[tarruda]

FWIW, I'm a long time vim-gnupg user and have been using it with neovim since day 1. I never had problems because I use gpg-agent which by defaults displays a x11 prompt to get the password(The GPG_TTY warning can be safely ignored).

With that said, it should be easy to make vim-gnupg compatible with neovim: You simply need to call jobstart passing the pty option, which will spawn the job in a headless pseudo terminal, and with jobwait you can wait for a job to finish. Here's a function that simulates system() but uses a new pty to run the program:

let s:Shell = {}

function s:Shell.on_stdout(jobid, data)
  let self.output .= a:data[0]
  for str in a:data[1:]
    let self.output .= "\n".str
  endfor
endfunction

let s:Shell.on_stderr = s:Shell.on_stdout

function! PTYSystem(cmd, ...)
  let s = extend({'output': '', 'pty': 1}, s:Shell)
  let job = jobstart(a:cmd, s)
  if a:0
    " send data plus newline plus ctrl+d to the terminal
    call jobsend(job, a:1."\n\x04")
  endif
  let [g:shell_error] = jobwait([job])
  return s.output
endfunction

This would require prompting the passwords with the inputsecret() function and feeding as the second argument of PTYSystem

[jamessan]

Thanks for the tips, @tarruda. I'll take another look at this after I finish packaging neovim for Debian.

[pmandera]

Hello! I was wondering if there is any progress with this issue? I am using neovim via tmux so the x11 prompt often does not work in this case and neovim hangs an entire window when asking for passpharse. Thanks for the great plugin anyway!

[jamessan]

Ok, I finally got Neovim packaged in Debian and will start taking a look at this.

Just as an FYI, neovim isn't actually hung. When encrypting a new file, you can type into the gpg prompt but you aren't going to see what's being typed. Other than that, it works fine. I've successfully created new encrypted files and opened existing files just fine.

Yes, it's not optimal but it is functional.

[kierun]

Any update on this?

Yes, of course, I can help test this on Fedora/CentOS/Ubuntu ☺

[sharethewisdom]

Yes, it's not optimal but it is functional.

I've been playing around with the job control and pseudo terminal for a while now but I still didn't get it to work. I just wanted to point out that using pinentry-curses in a non-login shell, I need to keep an eye on the wildcards and count them: apart from the fact that the letters aren't always input into dialogue, some characters are also put into the decrypted file 😧. (I don't call that functional.)

Maybe the keys are passed through and the input is result of normal mode "i" command? (not sure)

This is likely insecure, and may not work, but I wanted to share the idea all the same: using pexpect in a remote plugin one could wait for the the spawned process (started with gpg2 -d --no-tty, no -q) to print ^gpg: encrypted with.* as a sign of successful decryption, then delete the first few lines and passing the file contents to stdout, where neovim should pick it up and load it into a buffer.

[galaux]

As a complement/clarification to tarruda's comment, I would like to add that one can make vim-gnupg to work with NeoViM if one does not set gpg-agent to use pinentry-curses but any other X pinentry (make sure /usr/bin/pinentry points at pinentry-gtk-2 for instance and that setting pinentry-program is not set to …/pinentry-curses in ~/.gnupg/gpg-agent.conf).

Kind of a workaround of course but worth to be mentioned in my opinion.

[sharethewisdom]

any other X pinentry ...

Thanks but rather not, running a terminal using a compositor for Wayland, I would prefer to stick to a curses interface. If I can use it from other curses programs and for other uses, like signing commits and email, it feels like it should be possible to have a curses pinentry work from neovim.

The issue, I think, for me with neovim is that pinentry-curses seems to be running on /dev/ttyx, which obviously isn't the terminal connected to stdin.

[Integralist]

I'm using NeoVim on my mac 10.11.6 and it's NeoVim version v0.1.6-109-gdc6cc47 and when it asks me the passphrase I see nothing typed out and the program hangs. I can't quit it and need to shut my terminal tab down :-(

[jamessan]

Thanks to all the suggestions so far. I've already pushed some commits to fix issues related to the 'encoding' option, which will become more important once neovim/neovim#2905 is merged.

apart from the fact that the letters aren't always input into dialogue, some characters are also put into the decrypted file 😧. (I don't call that functional.)

Agreed. I don't know if I was just lucky before or didn't notice it, but it is essentially non-functional. The input randomly makes it to either nvim or the pinentry process.

This would require prompting the passwords with the inputsecret() function and feeding as the second argument of PTYSystem

I really don't like the idea of doing the password prompting in the plugin and passing it through. I removed a bunch of code that was just shuttling data between Vim and gpg when I took over maintenance of the plugin. I don't see a reason to reimplement what gpg already does just fine, and has the ability to do more securely.

That being said, I know that something needs to be done here and I'll be trying to focus my available FOSS time on this.

[kierun]

@jamessan I, for one, really appreciate all your hard work. Thank you very much.

[hugomg]

One issue I encountered on Fedora 25 (GNOME with X, not Wayland) is that by default gnupg would not try to use the graphical password prompt, which seems to be the recommended workaround for this bug at the moment. I think this is due to this part of the script.

if (str2float(gpgversion) >= 2.1 || (exists("$GPG_AGENT_INFO") && g:GPGUseAgent == 1))
  "... stuff ...
  let s:GPGCommand .= " --use-agent"
else
    let s:GPGCommand .= " --no-use-agent"
endif

On my system, vim-gnupg tries to use gpg version 1.4 by default and the GPG_AGENT_INFO variable was unset so it falls into the "--no-use-agent" branch of the code. A workaround that worked for me was to edit my .config/nvim/init.vim to tell vim-gnupg that it should use gpg 2.1 instead:

let g:GPGExecutable = "gpg2 --trust-model always"

I hope this information might be helpful.