<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi there,</p>
<p><br>
</p>
<p>I've been using OpenPGP smartcard to decrypt a keyfile to my
drive partition with gpg.</p>
<p>This worked until it broke after system upgrade some time around
November 2017 (I do not have the pacman pkg cache from that time).</p>
<p><br>
</p>
<p>> uname -a<br>
</p>
<p> Linux username 4.14.15-1-ARCH #1 SMP PREEMPT Tue Jan 23
21:49:25 UTC 2018 x86_64 GNU/Linux</p>
<p><br>
</p>
<p>> gpg --version</p>
<p> gpg (GnuPG) 2.2.4<br>
libgcrypt 1.8.2</p>
<p><br>
</p>
<p><u>THE PROBLEM:</u></p>
<p>> gpg --homedir "/etc/initcpio/gpg" -o "/keyfile.bin"
--decrypt "${key_file}"</p>
<p><br>
</p>
<p>The command above which is run inside custom initcpio hook fails
with status code: 2</p>
<p>And prints:</p>
<blockquote>
<p>gpg: encrypted with <bit-length> RSA key, ID <key
id>. created <date> <owner name + email></p>
<p>gpg: public key decryption failed: Invalid IPC response</p>
<p>gpg: decryption failed: No secret key<br>
</p>
</blockquote>
<p><br>
</p>
<p>Interestingly enough, when I break into a shell with
`break=premount` kernel parameter and attempt to decrypt the
keyfile by manually invoking same set of commands, everything
works. However the break=premount gets triggered after the hook is
run which might be why it works by that point.<br>
</p>
<p>The custom initcpio hook is available here:<br>
<a class="moz-txt-link-freetext" href="https://github.com/fogine/initramfs-scencrypt">https://github.com/fogine/initramfs-scencrypt</a></p>
<p>Particularly this line:</p>
<p><a class="moz-txt-link-freetext" href="https://github.com/fogine/initramfs-scencrypt/blob/master/scencrypt-hook#L49">https://github.com/fogine/initramfs-scencrypt/blob/master/scencrypt-hook#L49</a></p>
<p><br>
</p>
<p>Note that before the decryption command, I run `gpg
--card-status` which successfully detects the smartcard and
populates subkey secret stub.</p>
<p><br>
</p>
<p>These are hooks run at boot time (/etc/mkinitcpio.conf):</p>
<p>HOOKS="base udev autodetect modconf block filesystems keyboard
fsck scencrypt"</p>
<p>"scencrypt" being my custom hook.<br>
</p>
<p>I do not load any MODULES="" (in /etc/mkinicpio.conf) before the
hooks are run.<br>
</p>
<p><br>
</p>
<p>I struggle with debuging this issue, does anybody have an idea
how I could proceed further?</p>
<p>Thank you.<br>
</p>
<br>
</body>
</html>