'pinentry-mac' program installed itself; brew says 'pass' requires it; formulae.brew.sh does not list it as a dependency

[lutzke]

This morning, I go to copy a password from my password manager, so I can log into something.

I get a GUI popup, something called pinentry, asking for my master password. I did not install pinentry. I know nothing about pinentry, so this is concerning.

I go here, and 'pinentry' is not mentioned anywhere: https://formulae.brew.sh/formula/pass#default I go to the pass IRC channel, and nobody there has heard of pinentry, either.

What, exactly, is going on here?

[SMillerDev]

Gnupg depends on it, and pass depends on Gnupg. (Pinentry is actually part of the Gnupg project)

[lutzke]

Great. So how can I get my passwords back? After attempting to remove this pinentry thing, and even after reinstalling it (and pass,) pass just flat-out refuses to ask me for a password: gpg: decryption failed: No secret key

And when was this lovely pinentry thing added? (some time last night, it seems, because my password manager worked as expected yesterday morning.) And how are users supposed to know that some new GUI program asking for their master passwords isn't some kind of malware?!

[carlocab]

And when was this lovely pinentry thing added?

The pinentry dependency for gnupg dates back to at least Homebrew/homebrew-core@d0b5a7087a96, so more than five years ago.

[SMillerDev]

As for how to use it, you should ask the Gnupg and pass project about that.

[lutzke]

Five years ago... interesting. And the pass people say to check with the packagers, because they've made no changes to any dependencies lately.

All I wanted to do was sign into my home server this morning so I could move some video files, so that I can watch some shows and relax, but I guess that's asking a bit much.

[carlocab]

Here's the dependency tree for pass:

pass
├── gnu-getopt
├── gnupg
│   ├── gettext
│   ├── gnutls
│   │   ├── ca-certificates
│   │   ├── gmp
│   │   ├── guile
│   │   │   ├── bdw-gc
│   │   │   ├── gmp
│   │   │   ├── libffi
│   │   │   ├── libtool
│   │   │   │   └── m4
│   │   │   ├── libunistring
│   │   │   ├── pkg-config
│   │   │   └── readline
│   │   ├── libidn2
│   │   │   ├── gettext
│   │   │   └── libunistring
│   │   ├── libtasn1
│   │   ├── libunistring
│   │   ├── nettle
│   │   │   └── gmp
│   │   ├── p11-kit
│   │   │   ├── ca-certificates
│   │   │   ├── libffi
│   │   │   └── libtasn1
│   │   └── unbound
│   │       ├── libevent
│   │       │   └── [email protected]
│   │       │       └── ca-certificates
│   │       ├── libnghttp2
│   │       └── [email protected]
│   │           └── ca-certificates
│   ├── libassuan
│   │   └── libgpg-error
│   ├── libgcrypt
│   │   └── libgpg-error
│   ├── libgpg-error
│   ├── libksba
│   │   └── libgpg-error
│   ├── libusb
│   ├── npth
│   └── pinentry
│       ├── libassuan
│       │   └── libgpg-error
│       └── libgpg-error
├── qrencode
│   └── libpng
└── tree

You can generate this with brew deps --tree pass. Or, you can see a more compact list with brew deps pass.

[lutzke]

Thanks. I'll bookmark this for the future.