As of today, whenever I use
gpg2 (installed via Homebrew) on my Mac (10.12.1), I now see the following warning:
Warning: using insecure memory!
For what it's worth, I'm seeing this same behavior on two different machines: a Mac mini (late 2012) and a MacBook Pro (late 2012), both running 10.12.1.
As the GnuPG FAQ says:
GnuPG tries to lock memory so that no other process can see it and so that the memory will not be written to swap. If for some reason it’s not able to do this (for instance, certain platforms don’t support this kind of memory locking), GnuPG will warn you that it’s using insecure memory.
While it’s almost always better to use secure memory, it’s not necessarily a bad thing to use insecure memory. If you own the machine and you’re confident it’s not harboring malware, then this warning can probably be ignored.
The thing that baffles me is that
gpg2 has not changed since September 12, 2016. I've had version 2.0.30 installed more or less since then, but I've only started seeing this warning about insecure memory today. Even though the
gpg2 formula hasn't changed since September 12, 2016, the one thing I can say for sure that I did on both machines prior to the onset of seeing this warning is a
brew update && brew upgrade. But I'm not even sure how that could affect this; given what the GnuPG FAQ says, it seems like this has something more to do with the OS and memory locking.
... And what is even more odd is that I also have
gpg1 installed from Homebrew (version 1.4.21), which does not warn about insecure memory when I use it:
$ gpg1 --require-secmem gpg: Go ahead and type your message ... ^C gpg: Interrupt caught ... exiting $ gpg2 --require-secmem Warning: using insecure memory! gpg: will not run with insecure memory due to --require-secmem
Both binaries belong to the same owner and group and have the same permissions:
-r-xr-xr-x 1 adamliter admin 681932 Dec 10 18:06 /usr/local/Cellar/gnupg2/2.0.30_2/bin/gpg2 -r-xr-xr-x 1 adamliter admin 929352 Aug 17 09:21 /usr/local/Cellar/gnupg/1.4.21/bin/gpg1
I just tried reinstalling
gpg2 with Homebrew: both by using the precompiled binary and by building form source, but this doesn't change anything. I still get the warning about using insecure memory.
Moreover, even making the gpg2 binary have the setuid root bit flipped (as suggested, e.g., here) does not cause the message to disappear; it still warns about using insecure memory.
Does anyone know what could have changed such that I would suddenly start seeing this warning today? And why would I be seeing it when using the
gpg2 binary but not the
Other possibly relevant information:
$ which gpg1 /usr/local/bin/gpg1 $ ls -al /usr/local/bin/gpg1 lrwxr-xr-x 1 adamliter admin 31 Aug 17 17:42 /usr/local/bin/gpg1 -> ../Cellar/gnupg/1.4.21/bin/gpg1 $ which gpg2 /usr/local/bin/gpg2 $ ls -al /usr/local/bin/gpg2 lrwxr-xr-x 1 adamliter admin 34 Dec 10 18:06 /usr/local/bin/gpg2 -> ../Cellar/gnupg2/2.0.30_2/bin/gpg2
I think the reason this is happening is because of the new version of
libgcrypt. I still don't know why it's happening, but I'm pretty sure that this is at least the root cause of the issue. The formula for
libgcrypt was just updated today for the 1.7.4 bump; this would explain why I'm seeing this on two different computers after a
brew update && brew upgrade. It would also explain why it's not happening with
gpg1 did not rely on the external
libgcrypt cryptographic library, instead using its own integrated cryptographic library.
Moreover, I also have
gpg2 installed from MacGPG Suite, which is not exhibiting this problem and is linked against a different version of
$ /usr/local/MacGPG2/bin/gpg2 --version gpg (GnuPG/MacGPG2) 2.0.30 libgcrypt 1.6.6 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. $ gpg2 --version gpg (GnuPG) 2.0.30 libgcrypt 1.7.4 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
Thus I'm guessing that this is probably a bug report for the maintainers of
libgcrypt. I will post to their mailing list, but I will leave this here for the time being in case anyone else comes across the same issue and/or in case anyone else knows why exactly this is happening. If I get confirmation after sending word to their mailing list that this is a bug, I'll vote to close this question.