Me and my new #yubikey5 part 2:
Now we get to the nitty-gritty parts. I'm using #mbsync to sync multiple #imap accounts to local #maildir and I am automating this via #systemd : a timer calls a service very 5 minutes, that will call mbsync on all mail accounts if connected to the internet.
Providing the passwords via #pass that is encrypted with #yubikey will need that yubikey to be unlocked (i.e. a pin needs to be provided). When providing this pin (e.g. by manually calling mbsync on one of my mail accounts), it will be stored for at least 12h, and up to 24h (on my home pc; mobile and remote devices will of course hav different settings).
However, if I never manually provide the PIN, the systemd automated scripts will fail. E.g. I just connected the key, but not used it.
First I thought, this was due to me using the `curses` version #pinentry . But that's not the whole truth. Even with `pinentry-gtk` the systemd script will not trigger a PIN entry. I didn't quite understand why, and therefore ran a different direction:
Could I just auto-unlock the yubikey if I connected it? I wrote a #udev rule that would recognize the yubikey. Learning that I need to put scripts for udev in certain dirs, and being unhappy with it, I then wrote a systemd service for the udev to call instead, and with that I maanged to finally get a PIN entry request using the gtk version.
And then it got me thinking. Why did that work, but my mailsync that basically has the same things involved (script instead of udev that triggers systemd that wants to decrypt something using yubikey triggering PIN entry). And then it hit me: My mailsync systemd service was missing the `DISPLAY=:0` environment variable, thus the script can't trigger the GUI. Half a days worth of work, all for nothing :picardfacepalm:
But hey, the weekend is young. Next up: If triggered via CLI i want gpg to trigger `pinentry-curses` instead of `pinentry-gtk`. Sounds easy: have a `pinentry-auto` script figuring out where it has been called from. Well... not really #wip
![Console with vim showing the content of the new `systemd` service I wrote, which lives in my home dir under: `.config/systemd/user/yubikey-unlock.service`
Content:
```
[Unit]
Description=Yubikey GPG Unlock
After=graphical-session.target
[Service]
Type=oneshot
ExecStart=/bin/bash -c 'TEMP_FILE=$(/usr/bin/mktemp); echo "unlock test" | /usr/bin/gpg --encrypt -r FEE1636BFD47D3E8 > "$TEMP_FILE"; /usr/bin/gpg --quiet --decrypt "$TEMP_FILE" >/dev/null 2>&1; /usr/bin/rm "$TEMP_FILE"'
Environment="DISPLAY=:0"
```
Last line was missing in my mailsync service, which is why the PIN entry did not trigger for fetching mails... you'll never stop learning :D](https://files.mastodon.social/cache/media_attachments/files/115/236/040/155/287/773/original/9e7290dfcf7f1e91.jpg)
