Enigmail uses GCR without user confirmation

Tried it on a freshly installed machine. Same results. Enigmail uses GCR without me ever telling it to....

Status changed to 'Confirmed' because the bug affects multiple users.

For me, I don't even get asked for the passphrase once per session. I can't remember last time I was asked for the passphrase.

Enigmail is using whatever gpg agent is listening to the socket defined by the GPG_AGENT_INFO environment variable, which by default on Ubuntu is gnome-keyring.

Enigmail is configured to not use gpg-agent and I see no running gpg-agent.
Still that socket exists:

$ echo $GPG_AGENT_INFO
/run/user/1000/keyring-HtA7vw/gpg:0:1

Running lsof on that socket shows:

gnome-key 3617 afx 8u unix 0xffff88020cacb480 0t0 20605 /run/user/1000/keyring-HtA7vw/gpg
gnome-key 3617 3618 afx 8u unix 0xffff88020cacb480 0t0 20605 /run/user/1000/keyring-HtA7vw/gpg
timer 3617 4055 afx 8u unix 0xffff88020cacb480 0t0 20605 /run/user/1000/keyring-HtA7vw/gpg
dconf 3617 4056 afx 8u unix 0xffff88020cacb480 0t0 20605 /run/user/1000/keyring-HtA7vw/gpg
gdbus 3617 4057 afx 8u unix 0xffff88020cacb480 0t0 20605 /run/user/1000/keyring-HtA7vw/gpg
dispatch 3617 4435 afx 8u unix 0xffff88020cacb480 0t0 20605 /run/user/1000/keyring-HtA7vw/gpg
dispatch 3617 14721 afx 8u unix 0xffff88020cacb480 0t0 20605 /run/user/1000/keyring-HtA7vw/gpg

yes, that's what I said...in Ubuntu, it's not gpg-agent, it's gnome-keyring-daemon that is the GPG agent, which is PID 3617 in your list.

But when I get prompted for the password I see gcr-prompter running, not some gnome prompter.

gnome-keyring-daemon calls out to gcr-prompter to draw the dialog, but it's gnome-keyring-daemon that does the caching, etc.

Ok, but why does Enigmail use it at all when configured to not use gpg-agent?

All Enigmail does is look up the GPG_AGENT_INFO environment variable, and connects to the socket that is listed where. It has no idea what is on the other end of the socket.

In your case, it's gnome-keyring-daemon.

As I mentioned several times already, Enigmail is not configured to use any form of agent. The appropriate tickmark is OFF.
So why the F... Hell does it use an agent?

And the other interesting question is of course, where does the agent (gnome-keyring-daemon) come from if I have never ever told the system to start any agent at all.

The "Use gpg-agent for passphrases" setting in Enigmail decides whether or not to launch _it's own_ gpg-agent if none is currently running.

If your GPG_AGENT_INFO environment variable exists, that setting is ignored, and Enigmail uses your session one.

As I've said before, by default in Ubuntu, we start gnome-keyring-daemon as a gpg agent.

Well, the popup help says "Use gpg-agent (part of gnupg 2) for all passphrase"s.
So your definition does not fit what Enigmail documents.
And, it also does not fit what Enigmail did on 12.4, where it worked just as documented.

The current behavior is neither expected nor documented.

Nowhere does Engimail tell the user that it will force the use of an existing agent if the env variable exists.

I looked at the source to figure out what it did.

The Enigmail website documents it as follows (note: seahorse is the gnome-keyring GUI):

https://www.enigmail.net/documentation/advanced.php

---
Use gpg-agent for passphrase handling: GnuPG version 2.0.x is distributed with the GnuPG passphrase agent, a tool for caching passphrases. This is especially useful if several passphrases are used. Enabling this option makes Enigmail use the gpg-agent also for GnuPG version 1.4.x (requires the tools gpg-agent and pinentry to be installed!). Note that in some distrubutions, Seahorse is installed instead of gpg-agent. This may cause trouble when using OpenPGP SmartCards. If you use a smartcard for your key, then either use gpg-agent and enable this option or unset it AND make sure the environment variable GPG_AGENT_INFO is unset prior to starting Enigmail since GnuPG expects gpg-agent be running once it detects GPG_AGENT_INFO.

Do not activate this option, if you want Enigmail to ask you for your passphrase.
---

If you want Enigmail to change the documentation to make the current behaviour clearer, please file a bug on their website, and attach it to this bug:

https://www.enigmail.net/support/bugs.php

Thanks!

It has a moderate impact on a core package.