Flatpak smartcard controller shows no openpgp card

[sjoerger]

I am using a Yubikey 5C that has my keys already installed. Using the current Flatpak version (2.1.9) the Smartcard controller shows no available openpgp key. Using the same version AppImage shows my openpgp card just fine.

[saturneric]

Flatpak runs applications inside a container environment, so on the Flatpak platform, the gpg-agent used by GpgFrontend is also running inside the container. This might prevent direct access to the smartcard on the host system. If your OpenPGP card cannot be detected, it is likely due to the isolation mechanism of Flatpak containers. I will investigate this issue and check whether additional permissions are needed or if a suitable Flatpak Portal exists to resolve this problem.

[sjoerger]

Flatpak runs applications inside a container environment, so on the Flatpak platform, the gpg-agent used by GpgFrontend is also running inside the container. This might prevent direct access to the smartcard on the host system. If your OpenPGP card cannot be detected, it is likely due to the isolation mechanism of Flatpak containers. I will investigate this issue and check whether additional permissions are needed or if a suitable Flatpak Portal exists to resolve this problem.

I'm not versed at all in how Flatpaks actually work as they are pretty new to me. I do see in the sandbox documentation that there is an option to have access to the system gpg-agent using --socket=gpg-agent. Also this link may be of help in debugging accessing the smartcard attached to the system https://ludovicrousseau.blogspot.com/2022/02/accessing-smart-cards-from-inside.html
/
Definitely seems related to flatpak/flatpak#4066

[saturneric]

Thank you very much for the suggestions and for the helpful link!

Using --socket=gpg-agent does indeed allow GpgFrontend inside the Flatpak container to communicate with the host’s gpg-agent. This was actually the approach used by earlier versions of GpgFrontend. However, it brings some significant issues:

• The version of GnuPG inside the container (usually 2.5.x) is often much newer than the gpg-agent version on the host (which is limited to whatever the distro provides, typically up to 2.2.x). This leads to a lot of compatibility problems.
• Additionally, due to some reasons, pinentry cannot be properly triggered in this mode, which causes even bigger troubles for end users.

The link you provided (https://ludovicrousseau.blogspot.com/2022/02/accessing-smart-cards-from-inside.html) is indeed an interesting alternative. This approach could work, but it depends on the exact communication mechanism used by scdaemon, so it will require further investigation.