From minterior at gmail.com  Thu Apr  2 16:18:53 2026
From: minterior at gmail.com (Jaume Casado Ruiz)
Date: Thu, 2 Apr 2026 18:18:53 +0200
Subject: [PATCH] gpg: respect user-defined GPG_OPTS precedence
In-Reply-To: <4dd718bf-fbba-4de1-b6a6-1f19973d6559@gmail.com>
References: <4dd718bf-fbba-4de1-b6a6-1f19973d6559@gmail.com>
Message-ID: <99ce31ea-e4ee-4516-9457-ba2fa10f3b3a@gmail.com>

Hello everyone,

I recently encountered an issue while using 'pass' in a remote session
(SSH + screen). When trying to access a password, GPG would fail with
the following error:

 ? ? gpg: can't get input

This happens because the environment requires an interactive TTY-based
pinentry, but 'pass' hardcodes the --batch flag. I found some
discussion on the Arch Linux forums [1] where users suggested
manually removing the --batch flag from the 'pass' source code to
fix this.

Instead of removing a default that might be useful for automation, I
looked into GPG's documentation and found the --no-batch flag.
However, providing --no-batch via $PASSWORD_STORE_GPG_OPTS does
not currently work because 'pass' appends its own --batch flag
*after* the user-defined options. Since GPG honors the last
occurrence of a flag, the hardcoded --batch always wins.

This patch reorders the arguments (or ensures GPG_OPTS precedence)
so that users can explicitly override the default behavior. With this
change, running:

 ? ? PASSWORD_STORE_GPG_OPTS="--no-batch" pass <name>

works perfectly in SSH/screen/tmux sessions by allowing the
interactive pinentry-tty to take over.

[1] https://bbs.archlinux.org/viewtopic.php?id=208059

-----------------------------------------------------------------------------------------------------

 From 35142707165bb67f4514592be411b47d34f02f5e Mon Sep 17 00:00:00 2001
From: Jaume Casado Ruiz <minterior at gmail.com>
Date: Thu, 2 Apr 2026 05:24:45 +0200
Subject: [PATCH] gpg: respect user-defined GPG_OPTS precedence

The current implementation appends internal GPG flags after the
$PASSWORD_STORE_GPG_OPTS variable. Since GPG typically honors the
last occurrence of a flag on the command line, this prevents users
from overriding default behaviors.

A specific case is the hardcoded --batch flag. In remote sessions
(e.g., SSH, screen, or tmux) that require an interactive TTY-based
pinentry, users cannot re-enable interactivity. Even if --no-batch
is provided via PASSWORD_STORE_GPG_OPTS, the trailing --batch forces
a non-interactive mode, resulting in "gpg: can't get input" errors.

By ensuring PASSWORD_STORE_GPG_OPTS takes precedence, users gain the
necessary flexibility to handle interactive prompts in restricted
environments without breaking existing automation.
---
src/password-store.sh | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/password-store.sh b/src/password-store.sh
index 22e818f..456cdc9 100755
--- a/src/password-store.sh
+++ b/src/password-store.sh
@@ -6,11 +6,12 @@
umask "${PASSWORD_STORE_UMASK:-077}"
set -o pipefail

-GPG_OPTS=( $PASSWORD_STORE_GPG_OPTS "--quiet" "--yes" 
"--compress-algo=none" "--no-encrypt-to" )
+GPG_OPTS=( "--quiet" "--yes" "--compress-algo=none" "--no-encrypt-to" )
GPG="gpg"
export GPG_TTY="${GPG_TTY:-$(tty 2>/dev/null)}"
command -v gpg2 &>/dev/null && GPG="gpg2"
[[ -n $GPG_AGENT_INFO || $GPG == "gpg2" ]] && GPG_OPTS+=( "--batch" 
"--use-agent" )
+GPG_OPTS+=( $PASSWORD_STORE_GPG_OPTS )

PREFIX="${PASSWORD_STORE_DIR:-$HOME/.password-store}"
EXTENSIONS="${PASSWORD_STORE_EXTENSIONS_DIR:-$PREFIX/.extensions}"
-- 
2.53.0


-- 
Jaume Casado Ruiz
GPG Key ID: 0xD9AB39238DF66919

Free software my friend ;-)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://lists.zx2c4.com/pipermail/password-store/attachments/20260402/d71721b7/attachment.sig>

From jay at gfax.ch  Wed Apr  8 04:23:01 2026
From: jay at gfax.ch (Jay Thomas)
Date: Wed, 08 Apr 2026 04:23:01 +0000
Subject: Fish completion patch
Message-ID: <B2gRdNETUu2Zv34cTu9DLhJgpIvN9oknYPV3F-29v2znpjEiUGYiWZrGaU3zGsKRZwn_9hspGgiWUx3mzh_FhB_esa0lvakJSvC3oYPKvlg=@gfax.ch>

Being an avid user of multi-line password files, I quickly discovered in the fish shell I couldn't do tab completion for `pass -c2 my_site_auth` as it only matched on `-c` or `--clip`. This attached patch allows passing a line number to clip between -c0 (line 0 and line 1 being the same thing) and -c99. I don't know the upper-limit on line number clipping but this seemed like a more-than-generous range for the sake of tab completion.

Thanks,
Jay



-------------- next part --------------
A non-text attachment was scrubbed...
Name: fish_patch.patch
Type: text/x-patch
Size: 1593 bytes
Desc: not available
URL: <http://lists.zx2c4.com/pipermail/password-store/attachments/20260408/433919dd/attachment.bin>

From jens.troeger at light-speed.de  Thu Apr 16 08:50:55 2026
From: jens.troeger at light-speed.de (=?utf-8?Q?Jens_Tr=C3=B6ger?=)
Date: Thu, 16 Apr 2026 18:50:55 +1000
Subject: Error: There is no assurance this key belongs to the named user
Message-ID: <5A77169F-90E5-4A75-A35B-337EA348D701@light-speed.de>

Hello,

I?ve been happily using `pass` for many years, and have been keeping up-to-date using MacPorts: https://ports.macports.org/port/pass/

A few weeks ago, however, when I wanted to edit an existing entry, I received the following error:

    jens at pooh ~ > pass edit Some/Entry
    gpg: WARNING: server 'gpg-agent' is older than us (2.5.17 < 2.5.18)
    gpg: 81............98: There is no assurance this key belongs to the named user
    gpg: /var/folders/2r/yyz1661s4j91vhdkzktg66z80000gn/T//pass.kF4Gb3qAp07WP/QHBHgP-Some-Entry: encryption failed: Unusable public key
    GPG encryption failed. Would you like to try again? [y/N] n

In the past I could just ignore the first line WARNING and update at a later point; that had no impact on using the agent. But now, with this error, I?m able to `pass show` but both `pass generate` and `pass edit` stopped working.

When I list the keys associated with that ?faulty? one:

    jens at pooh ~ > gpg -k 81............98
    pub   rsa4096 2017-04-18 [SC]
          1E1..................................EA7
    uid           [ unknown] Jens Tr?ger <jens.troeger at light-speed.de>
    sub   rsa4096 2017-04-18 [E]
          09D..................................798

and when I manually use the subkey to encrypt something I get the same error:

    jens at pooh ~ > gpg --recipient 09D..................................798 --encrypt --armor
    gpg: 81............98: There is no assurance this key belongs to the named user

    sub  rsa4096/81............98 2017-04-18 Jens Tr?ger <jens.troeger at light-speed.de>
          1E1..................................EA7
          09D..................................798

    It is NOT certain that the key belongs to the person named
    in the user ID.  If you *really* know what you are doing,
    you may answer the next question with yes.

    Use this key anyway? (y/N) y
    Hello
    ^D

So this works, although I get that exact same warning.

Now the question I have is: how can I fix this? And what happened here, why did that subkey suddenly (?) stop working?

Any insight would be appreciated, thank you!
Jens


From aclopte at gmail.com  Fri Apr 17 14:39:50 2026
From: aclopte at gmail.com (Johannes Altmanninger)
Date: Fri, 17 Apr 2026 22:39:50 +0800
Subject: [PATCH 1/3] fish-completion: deduplicate completion definition
In-Reply-To: <B2gRdNETUu2Zv34cTu9DLhJgpIvN9oknYPV3F-29v2znpjEiUGYiWZrGaU3zGsKRZwn_9hspGgiWUx3mzh_FhB_esa0lvakJSvC3oYPKvlg=@gfax.ch>
References: <B2gRdNETUu2Zv34cTu9DLhJgpIvN9oknYPV3F-29v2znpjEiUGYiWZrGaU3zGsKRZwn_9hspGgiWUx3mzh_FhB_esa0lvakJSvC3oYPKvlg=@gfax.ch>
Message-ID: <20260417144008.2324301-1-aclopte@gmail.com>

The completions for -c/--clip and for password names are defined
repeatedly, for different conditions:
1. for a command line like "pass show "
2. for a command line like "pass "
3. for a command line like "pass -c "

Fold the definitions into one, which paves the way for further
simplification.

No behavior change intended.
---
 src/completion/pass.fish-completion | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/src/completion/pass.fish-completion b/src/completion/pass.fish-completion
index 0f57dd2..e035f2c 100644
--- a/src/completion/pass.fish-completion
+++ b/src/completion/pass.fish-completion
@@ -96,13 +96,9 @@ complete -c $PROG -f -n '__fish_pass_needs_command' -a edit -d 'Command: edit pa
 complete -c $PROG -f -n '__fish_pass_uses_command edit' -a "(__fish_pass_print_entries)"
 
 complete -c $PROG -f -n '__fish_pass_needs_command' -a show -d 'Command: show existing password'
-complete -c $PROG -f -n '__fish_pass_uses_command show' -s c -l clip -d 'Put password in clipboard'
-complete -c $PROG -f -n '__fish_pass_uses_command show' -a "(__fish_pass_print_entries)"
 # When no command is given, `show` is defaulted.
-complete -c $PROG -f -n '__fish_pass_needs_command' -s c -l clip -d 'Put password in clipboard'
-complete -c $PROG -f -n '__fish_pass_needs_command' -a "(__fish_pass_print_entries)"
-complete -c $PROG -f -n '__fish_pass_uses_command -c' -a "(__fish_pass_print_entries)"
-complete -c $PROG -f -n '__fish_pass_uses_command --clip' -a "(__fish_pass_print_entries)"
+complete -c $PROG -f -n '__fish_pass_uses_command show || __fish_pass_needs_command' -s c -l clip -d 'Put password in clipboard'
+complete -c $PROG -f -n '__fish_pass_uses_command show || __fish_pass_needs_command || __fish_pass_uses_command -c || __fish_pass_uses_command --clip' -a "(__fish_pass_print_entries)"
 
 complete -c $PROG -f -n '__fish_pass_needs_command' -a git -d 'Command: execute a git command'
 complete -c $PROG -f -n '__fish_pass_uses_command git' -a '(__fish_pass_git_complete)'
-- 
2.54.0.rc2.1.gf65aba1e87


From aclopte at gmail.com  Fri Apr 17 14:39:52 2026
From: aclopte at gmail.com (Johannes Altmanninger)
Date: Fri, 17 Apr 2026 22:39:52 +0800
Subject: [PATCH 3/3] shell completion: complete -q/--qrcode option to
 show/generate
In-Reply-To: <20260417144008.2324301-1-aclopte@gmail.com>
References: <B2gRdNETUu2Zv34cTu9DLhJgpIvN9oknYPV3F-29v2znpjEiUGYiWZrGaU3zGsKRZwn_9hspGgiWUx3mzh_FhB_esa0lvakJSvC3oYPKvlg=@gfax.ch>
 <20260417144008.2324301-1-aclopte@gmail.com>
Message-ID: <20260417144008.2324301-3-aclopte@gmail.com>

Test case:

	fish -c 'complete -C"pass -"' | grep qrcode
---
 src/completion/pass.bash-completion | 4 ++--
 src/completion/pass.fish-completion | 2 ++
 src/completion/pass.zsh-completion  | 6 +++++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/completion/pass.bash-completion b/src/completion/pass.bash-completion
index 2d23cbf..e73fe90 100644
--- a/src/completion/pass.bash-completion
+++ b/src/completion/pass.bash-completion
@@ -101,7 +101,7 @@ _pass()
 				_pass_complete_entries
 				;;
 			show|-*)
-				COMPREPLY+=($(compgen -W "-c --clip" -- ${cur}))
+				COMPREPLY+=($(compgen -W "-c --clip -q --qrcode" -- ${cur}))
 				_pass_complete_entries 1
 				;;
 			insert)
@@ -109,7 +109,7 @@ _pass()
 				_pass_complete_entries
 				;;
 			generate)
-				COMPREPLY+=($(compgen -W "-n --no-symbols -c --clip -f --force -i --in-place" -- ${cur}))
+				COMPREPLY+=($(compgen -W "-n --no-symbols -c --clip -f --force -i --in-place -q --qrcode" -- ${cur}))
 				_pass_complete_entries
 				;;
 			cp|copy|mv|rename)
diff --git a/src/completion/pass.fish-completion b/src/completion/pass.fish-completion
index 4b43998..9dc3584 100644
--- a/src/completion/pass.fish-completion
+++ b/src/completion/pass.fish-completion
@@ -80,6 +80,7 @@ complete -c $PROG -f -n '__fish_pass_uses_command generate' -s n -l no-symbols -
 complete -c $PROG -f -n '__fish_pass_uses_command generate' -s c -l clip -d 'Put the password in clipboard'
 complete -c $PROG -f -n '__fish_pass_uses_command generate' -s f -l force -d 'Do not prompt before overwritting'
 complete -c $PROG -f -n '__fish_pass_uses_command generate' -s i -l in-place -d 'Replace only the first line with the generated password'
+complete -c $PROG -f -n '__fish_pass_uses_command generate' -s q -l qrcode -d 'Display the password as QR code'
 complete -c $PROG -f -n '__fish_pass_uses_command generate' -a "(__fish_pass_print_entry_dirs)"
 
 complete -c $PROG -f -n '__fish_pass_needs_command' -a mv -d 'Command: rename existing password'
@@ -102,6 +103,7 @@ complete -c $PROG -f -n '__fish_pass_needs_command' -a show -d 'Command: show ex
 # When no command is given, `show` is defaulted.
 set --local uses_show_command '__fish_pass_uses_command --regex -- "^(?:show|-.*)\$"'
 complete -c $PROG -f -n "$uses_show_command || __fish_pass_needs_command" -s c -l clip -d 'Put password in clipboard'
+complete -c $PROG -f -n "$uses_show_command || __fish_pass_needs_command" -s q -l qrcode -d 'Display password as QR code'
 complete -c $PROG -f -n "$uses_show_command || __fish_pass_needs_command" -a "(__fish_pass_print_entries)"
 
 complete -c $PROG -f -n '__fish_pass_needs_command' -a git -d 'Command: execute a git command'
diff --git a/src/completion/pass.zsh-completion b/src/completion/pass.zsh-completion
index d911e12..0eef548 100644
--- a/src/completion/pass.zsh-completion
+++ b/src/completion/pass.zsh-completion
@@ -52,6 +52,8 @@ _pass () {
 					"--no-symbols[don't include symbols in password]" \
 					"-c[copy password to the clipboard]" \
 					"--clip[copy password to the clipboard]" \
+					"-q[display password as QR code]" \
+					"--qrcode[display password as QR code]" \
 					"-f[force overwrite]" \
 					"--force[force overwrite]" \
 					"-i[replace first line]" \
@@ -117,7 +119,9 @@ _pass () {
 _pass_cmd_show () {
 	_arguments : \
 		"-c[put it on the clipboard]" \
-		"--clip[put it on the clipboard]"
+		"--clip[put it on the clipboard]" \
+		"-q[display as QR code]" \
+		"--qrcode[display as QR code]"
 	_pass_complete_entries
 }
 _pass_complete_entries_helper () {
-- 
2.54.0.rc2.1.gf65aba1e87


From aclopte at gmail.com  Fri Apr 17 14:39:51 2026
From: aclopte at gmail.com (Johannes Altmanninger)
Date: Fri, 17 Apr 2026 22:39:51 +0800
Subject: [PATCH 2/3] fish-completion: any first argument matching "-*" implies
 "show"
In-Reply-To: <20260417144008.2324301-1-aclopte@gmail.com>
References: <B2gRdNETUu2Zv34cTu9DLhJgpIvN9oknYPV3F-29v2znpjEiUGYiWZrGaU3zGsKRZwn_9hspGgiWUx3mzh_FhB_esa0lvakJSvC3oYPKvlg=@gfax.ch>
 <20260417144008.2324301-1-aclopte@gmail.com>
Message-ID: <20260417144008.2324301-2-aclopte@gmail.com>

Test cases:

	fish -c 'complete -C"pass -c1 "'
	fish -c 'complete -C"pass -c2 -"' | grep clip

Bash completions use this logic to determine whether to complete
password names:

	case "${COMP_WORDS[1]}" in
		[...]
		show|-*)

fish completions provide password names if the first argument is "-c",
"--clip" but not if it's something like "-c1" or "--clip=2".

Fix this by matching the logic in Bash completions: assume any command
that starts with a "-" implies "pass show".

Looking at how "cmd_extension_or_show" is invoked, we can see that this
implication does not hold for extensions with a name starting with
"-". But it's probably not a good idea to name extensions like that,
and Bash completions do the same.

Reported-by: Jay Thomas <jay at gfax.ch>

Note that zsh completions use "show|*)" instead of "show|-*)".
In future, we could resolve this inconsistency, either way should
be fine.
---
 src/completion/pass.fish-completion | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/completion/pass.fish-completion b/src/completion/pass.fish-completion
index e035f2c..4b43998 100644
--- a/src/completion/pass.fish-completion
+++ b/src/completion/pass.fish-completion
@@ -17,8 +17,11 @@ end
 
 function __fish_pass_uses_command
     set -l cmd (commandline -opc)
+    if not contains -- -- $argv
+        set --prepend argv --
+    end
     if [ (count $cmd) -gt 1 ]
-        if [ $argv[1] = $cmd[2] ]
+        if string match --quiet $argv $cmd[2]
             return 0
         end
     end
@@ -97,8 +100,9 @@ complete -c $PROG -f -n '__fish_pass_uses_command edit' -a "(__fish_pass_print_e
 
 complete -c $PROG -f -n '__fish_pass_needs_command' -a show -d 'Command: show existing password'
 # When no command is given, `show` is defaulted.
-complete -c $PROG -f -n '__fish_pass_uses_command show || __fish_pass_needs_command' -s c -l clip -d 'Put password in clipboard'
-complete -c $PROG -f -n '__fish_pass_uses_command show || __fish_pass_needs_command || __fish_pass_uses_command -c || __fish_pass_uses_command --clip' -a "(__fish_pass_print_entries)"
+set --local uses_show_command '__fish_pass_uses_command --regex -- "^(?:show|-.*)\$"'
+complete -c $PROG -f -n "$uses_show_command || __fish_pass_needs_command" -s c -l clip -d 'Put password in clipboard'
+complete -c $PROG -f -n "$uses_show_command || __fish_pass_needs_command" -a "(__fish_pass_print_entries)"
 
 complete -c $PROG -f -n '__fish_pass_needs_command' -a git -d 'Command: execute a git command'
 complete -c $PROG -f -n '__fish_pass_uses_command git' -a '(__fish_pass_git_complete)'
-- 
2.54.0.rc2.1.gf65aba1e87


From jens.troeger at light-speed.de  Mon Apr 20 20:15:13 2026
From: jens.troeger at light-speed.de (=?utf-8?Q?Jens_Tr=C3=B6ger?=)
Date: Tue, 21 Apr 2026 06:15:13 +1000
Subject: Error: There is no assurance this key belongs to the named user
In-Reply-To: <5A77169F-90E5-4A75-A35B-337EA348D701@light-speed.de>
References: <5A77169F-90E5-4A75-A35B-337EA348D701@light-speed.de>
Message-ID: <21C37763-8ED4-4C0A-AF86-1F595DAF248D@light-speed.de>

Still haven?t found an explanation or solution, but after more searching I came across this thread on the gnupg-users mailing list.

    https://marc.info/?m=157167920418502

In contrast to that post, I do not have a duplicated .gnupg/trustdb.gpg*  And when I export the ownertrust values:

    gpg --export-ownertrust

then the list contains *only* 1E1...EA7 of the public key but not 09D...798 of the subkey.

Any help would be great!
Jens


> On Apr 16, 2026, at 18:50, Jens Tr?ger <jens.troeger at light-speed.de> wrote:
> 
> Hello,
> 
> I?ve been happily using `pass` for many years, and have been keeping up-to-date using MacPorts: https://ports.macports.org/port/pass/
> 
> A few weeks ago, however, when I wanted to edit an existing entry, I received the following error:
> 
>    jens at pooh ~ > pass edit Some/Entry
>    gpg: WARNING: server 'gpg-agent' is older than us (2.5.17 < 2.5.18)
>    gpg: 81............98: There is no assurance this key belongs to the named user
>    gpg: /var/folders/2r/yyz1661s4j91vhdkzktg66z80000gn/T//pass.kF4Gb3qAp07WP/QHBHgP-Some-Entry: encryption failed: Unusable public key
>    GPG encryption failed. Would you like to try again? [y/N] n
> 
> In the past I could just ignore the first line WARNING and update at a later point; that had no impact on using the agent. But now, with this error, I?m able to `pass show` but both `pass generate` and `pass edit` stopped working.
> 
> When I list the keys associated with that ?faulty? one:
> 
>    jens at pooh ~ > gpg -k 81............98
>    pub   rsa4096 2017-04-18 [SC]
>          1E1..................................EA7
>    uid           [ unknown] Jens Tr?ger <jens.troeger at light-speed.de>
>    sub   rsa4096 2017-04-18 [E]
>          09D..................................798
> 
> and when I manually use the subkey to encrypt something I get the same error:
> 
>    jens at pooh ~ > gpg --recipient 09D..................................798 --encrypt --armor
>    gpg: 81............98: There is no assurance this key belongs to the named user
> 
>    sub  rsa4096/81............98 2017-04-18 Jens Tr?ger <jens.troeger at light-speed.de>
>          1E1..................................EA7
>          09D..................................798
> 
>    It is NOT certain that the key belongs to the person named
>    in the user ID.  If you *really* know what you are doing,
>    you may answer the next question with yes.
> 
>    Use this key anyway? (y/N) y
>    Hello
>    ^D
> 
> So this works, although I get that exact same warning.
> 
> Now the question I have is: how can I fix this? And what happened here, why did that subkey suddenly (?) stop working?
> 
> Any insight would be appreciated, thank you!
> Jens
> 

From hadronized at strongly-typed-thoughts.net  Sun Apr 26 11:35:14 2026
From: hadronized at strongly-typed-thoughts.net (Dimitri Sabadie)
Date: Sun, 26 Apr 2026 13:35:14 +0200
Subject: [PATCH] Add --flatten,-f for better interaction with filters.
Message-ID: <20260426113514.105142-1-hadronized@strongly-typed-thoughts.net>

The current mitigation has always been to use various scripts for every
integration, such as dmenu, bemenu, skim, fzf, etc. and it requires
everyone to keep writing the same code. This commit allows to get an
easy-to-consume interface for all filter programs.
---
 src/password-store.sh | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/password-store.sh b/src/password-store.sh
index 22e818f..0fd111c 100755
--- a/src/password-store.sh
+++ b/src/password-store.sh
@@ -366,17 +366,18 @@ cmd_init() {
 }
 
 cmd_show() {
-	local opts selected_line clip=0 qrcode=0
-	opts="$($GETOPT -o q::c:: -l qrcode::,clip:: -n "$PROGRAM" -- "$@")"
+	local opts selected_line clip=0 qrcode=0 flatten=0
+	opts="$($GETOPT -o q::c::f:: -l qrcode::,clip::,flatten:: -n "$PROGRAM" -- "$@")"
 	local err=$?
 	eval set -- "$opts"
 	while true; do case $1 in
 		-q|--qrcode) qrcode=1; selected_line="${2:-1}"; shift 2 ;;
 		-c|--clip) clip=1; selected_line="${2:-1}"; shift 2 ;;
+		-f|--flatten) flatten=1; shift 2 ;;
 		--) shift; break ;;
 	esac done
 
-	[[ $err -ne 0 || ( $qrcode -eq 1 && $clip -eq 1 ) ]] && die "Usage: $PROGRAM $COMMAND [--clip[=line-number],-c[line-number]] [--qrcode[=line-number],-q[line-number]] [pass-name]"
+	[[ $err -ne 0 || ( $qrcode -eq 1 && $clip -eq 1 ) ]] && die "Usage: $PROGRAM $COMMAND [--clip[=line-number],-c[line-number]] [--qrcode[=line-number],-q[line-number]] [--flatten,-f] [pass-name]"
 
 	local pass
 	local path="$1"
@@ -398,11 +399,20 @@ cmd_show() {
 		fi
 	elif [[ -d $PREFIX/$path ]]; then
 		if [[ -z $path ]]; then
-			echo "Password Store"
+			if [[ $flatten -eq 0 ]]; then
+				echo "Password Store"
+			fi
 		else
 			echo "${path%\/}"
 		fi
-		tree -N -C -l --noreport "$PREFIX/$path" 3>&- | tail -n +2 | sed -E 's/\.gpg(\x1B\[[0-9]+m)?( ->|$)/\1\2/g' # remove .gpg at end of line, but keep colors
+		if [[ "$flatten" -eq "0" ]]; then
+			tree -N -C -l --noreport "$PREFIX/$path" 3>&- | tail -n +2 | sed -E 's/\.gpg(\x1B\[[0-9]+m)?( ->|$)/\1\2/g' # remove .gpg at end of line, but keep colors
+		else
+			local passfiles=( "$PREFIX/$path"/**/*.gpg )
+			passfiles=( "${passfiles[@]#"$PREFIX/$path"/}" )
+			passfiles=( "${passfiles[@]%.gpg}" )
+			printf '%s\n' "${passfiles[@]}"
+		fi
 	elif [[ -z $path ]]; then
 		die "Error: password store is empty. Try \"pass init\"."
 	else
-- 
2.54.0


From hadronized at strongly-typed-thoughts.net  Sun Apr 26 12:07:15 2026
From: hadronized at strongly-typed-thoughts.net (Dimitri Sabadie)
Date: Sun, 26 Apr 2026 14:07:15 +0200
Subject: [PATCH v2 1/1] Add --flatten,-f for better interaction with filters.
In-Reply-To: <20260426120751.112143-1-hadronized@strongly-typed-thoughts.net>
References: <20260426120751.112143-1-hadronized@strongly-typed-thoughts.net>
Message-ID: <20260426120751.112143-2-hadronized@strongly-typed-thoughts.net>

The current mitigation has always been to use various scripts for every
integration, such as dmenu, bemenu, skim, fzf, etc. and it requires
everyone to keep writing the same code. This commit allows to get an
easy-to-consume interface for all filter programs.
---
 src/password-store.sh | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/password-store.sh b/src/password-store.sh
index 22e818f..b77c67c 100755
--- a/src/password-store.sh
+++ b/src/password-store.sh
@@ -366,17 +366,18 @@ cmd_init() {
 }
 
 cmd_show() {
-	local opts selected_line clip=0 qrcode=0
-	opts="$($GETOPT -o q::c:: -l qrcode::,clip:: -n "$PROGRAM" -- "$@")"
+	local opts selected_line clip=0 qrcode=0 flatten=0
+	opts="$($GETOPT -o q::c::f:: -l qrcode::,clip::,flatten:: -n "$PROGRAM" -- "$@")"
 	local err=$?
 	eval set -- "$opts"
 	while true; do case $1 in
 		-q|--qrcode) qrcode=1; selected_line="${2:-1}"; shift 2 ;;
 		-c|--clip) clip=1; selected_line="${2:-1}"; shift 2 ;;
+		-f|--flatten) flatten=1; shift 2 ;;
 		--) shift; break ;;
 	esac done
 
-	[[ $err -ne 0 || ( $qrcode -eq 1 && $clip -eq 1 ) ]] && die "Usage: $PROGRAM $COMMAND [--clip[=line-number],-c[line-number]] [--qrcode[=line-number],-q[line-number]] [pass-name]"
+	[[ $err -ne 0 || ( $qrcode -eq 1 && $clip -eq 1 ) ]] && die "Usage: $PROGRAM $COMMAND [--clip[=line-number],-c[line-number]] [--qrcode[=line-number],-q[line-number]] [--flatten,-f] [pass-name]"
 
 	local pass
 	local path="$1"
@@ -398,11 +399,20 @@ cmd_show() {
 		fi
 	elif [[ -d $PREFIX/$path ]]; then
 		if [[ -z $path ]]; then
-			echo "Password Store"
+			if [[ $flatten -eq 0 ]]; then
+				echo "Password Store"
+			fi
 		else
 			echo "${path%\/}"
 		fi
-		tree -N -C -l --noreport "$PREFIX/$path" 3>&- | tail -n +2 | sed -E 's/\.gpg(\x1B\[[0-9]+m)?( ->|$)/\1\2/g' # remove .gpg at end of line, but keep colors
+		if [[ "$flatten" -eq "0" ]]; then
+			tree -N -C -l --noreport "$PREFIX/$path" 3>&- | tail -n +2 | sed -E 's/\.gpg(\x1B\[[0-9]+m)?( ->|$)/\1\2/g' # remove .gpg at end of line, but keep colors
+		else
+			local passfiles=( "$PREFIX"/*.gpg "$PREFIX"/**/*.gpg )
+			passfiles=( "${passfiles[@]#"$PREFIX/$path"/}" )
+			passfiles=( "${passfiles[@]%.gpg}" )
+			printf '%s\n' "${passfiles[@]}"
+		fi
 	elif [[ -z $path ]]; then
 		die "Error: password store is empty. Try \"pass init\"."
 	else
-- 
2.54.0


From hadronized at strongly-typed-thoughts.net  Sun Apr 26 12:07:14 2026
From: hadronized at strongly-typed-thoughts.net (Dimitri Sabadie)
Date: Sun, 26 Apr 2026 14:07:14 +0200
Subject: [PATCH v2 0/1] Add top-root glob
Message-ID: <20260426120751.112143-1-hadronized@strongly-typed-thoughts.net>

I had missed the top-root glob (*.gpg), which covers the files **/*.gpg did not.

Dimitri Sabadie (1):
  Add --flatten,-f for better interaction with filters.

 src/password-store.sh | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

-- 
2.54.0


From kfogel at red-bean.com  Tue Apr 28 18:12:52 2026
From: kfogel at red-bean.com (Karl Fogel)
Date: Tue, 28 Apr 2026 13:12:52 -0500
Subject: Error: There is no assurance this key belongs to the named user
In-Reply-To: <21C37763-8ED4-4C0A-AF86-1F595DAF248D@light-speed.de>
References: <5A77169F-90E5-4A75-A35B-337EA348D701@light-speed.de>
 <21C37763-8ED4-4C0A-AF86-1F595DAF248D@light-speed.de>
Message-ID: <875x5bx8bf.fsf@red-bean.com>

On 21 Apr 2026, Jens Tr?ger wrote:
>Still haven?t found an explanation or solution, but after more
>searching I came across this thread on the gnupg-users mailing
>list.
>
>    https://marc.info/?m=157167920418502
>
>In contrast to that post, I do not have a duplicated
>.gnupg/trustdb.gpg* And when I export the ownertrust values:
>
>    gpg --export-ownertrust
>
>then the list contains *only* 1E1...EA7 of the public key but
>not 09D...798 of the subkey.
>
>Any help would be great!

I have encountered that error a lot.  Below is the documentation I 
wrote for myself on how to handle it; whether this will help you 
or not, I don't know, but I wish you luck.  (Note that we seem to 
have found exactly the same post from Matthias Apitz on 
'gnupg-users' :-) .)

---

  You may get an error like this:

    gpg: 8E8AF6393F237A2E: There is no assurance this key belongs 
    to the named user
    gpg: [stdin]: encryption failed: Unusable public key
  
  It's due to GPG trust/signature issues that are so intricate
  that I won't go into them here because I don't want to use up
  the remaining blank bits on my disk :-(.  The solution I used
  (in at least one case, anyway) was to add both a trust level
  and a signature to the relevant subkey (notice how in the error
  message above, the "8E8AF6393F237A2E" matches the subkey shown
  below, rather than matching the main public key).

  One solution is to do something like this:

    > $ gpg --edit-key 5972830CA206DCBA1EF97758D674C7632F4AC0E7
    > pub  rsa4096/2674C7632F4AC0E7
    >      created: 2022-11-21  expires: 2024-11-21  usage: SC  
    >      trust: full          validity: unknown
    > sub  rsa4096/8E8AF6393F237A2E
    >      created: 2022-11-21  expires: 2024-11-21  usage: E   
    > [ unknown] (1). J. Random <jrandom at example.com>
    > 
    > gpg> key 8E8AF6393F237A2E
    > 
    > [...]
    > 
    > gpg> trust  
    > Please decide how far you trust this user to correctly 
    > verify other users' keys
    > (by looking at passports, checking fingerprints from 
    > different sources, etc.)
    > 
    >   1 = I don't know or won't say
    >   2 = I do NOT trust
    >   3 = I trust marginally
    >   4 = I trust fully
    >   5 = I trust ultimately
    >   m = back to the main menu
    > 
    > Your decision? 4
    > 
    > [...]
    > 
    > gpg> sign
    > Your current signature on "J. Random <jrandom at example.com>"
    > is a local signature.
    > Do you want to promote it to a full exportable signature? 
    > (y/N) y
    > 
    > pub  rsa4096/2674C7632F4AC0E7
    >      created: 2022-11-21  expires: 2024-11-21  usage: SC  
    >      trust: full          validity: full
    >  Primary key fingerprint: 5972 830C A206 DCBA 1EF9  7758 
    >  D674 C763 2F4A C0E7
    > 
    >      J. Random <jrandom at example.com>
    > 
    > This key is due to expire on 2024-11-21.
    > Are you sure that you want to sign this key with your
    > key "Karl Fogel <kfogel at example.com>" (810A75CB5CDE3845)
    > 
    > Really sign? (y/N) y
  
  Note that I had first done 'lsign' instead of 'sign', and that
  worked fine insofar as it solved my problem, but it generated a
  local (non-exportable) signature.  Since I wanted to send the
  signed key to others, I did the dance again with 'sign' before
  exporting.
  
  See also this thread from Matthias Apitz on gnupg-users@:

  https://lists.gnupg.org/pipermail/gnupg-users/2019-October/thread.html#62955

Best regards,
-Karl

>> On Apr 16, 2026, at 18:50, Jens Tr?ger 
>> <jens.troeger at light-speed.de> wrote:
>> 
>> Hello,
>> 
>> I?ve been happily using `pass` for many years, and have been 
>> keeping up-to-date using MacPorts: 
>> https://ports.macports.org/port/pass/
>> 
>> A few weeks ago, however, when I wanted to edit an existing 
>> entry, I received the following error:
>> 
>>    jens at pooh ~ > pass edit Some/Entry
>>    gpg: WARNING: server 'gpg-agent' is older than us (2.5.17 < 
>>    2.5.18)
>>    gpg: 81............98: There is no assurance this key 
>>    belongs to the named user
>>    gpg: 
>>    /var/folders/2r/yyz1661s4j91vhdkzktg66z80000gn/T//pass.kF4Gb3qAp07WP/QHBHgP-Some-Entry: 
>>    encryption failed: Unusable public key
>>    GPG encryption failed. Would you like to try again? [y/N] n
>> 
>> In the past I could just ignore the first line WARNING and 
>> update at a later point; that had no impact on using the 
>> agent. But now, with this error, I?m able to `pass show` but 
>> both `pass generate` and `pass edit` stopped working.
>> 
>> When I list the keys associated with that ?faulty? one:
>> 
>>    jens at pooh ~ > gpg -k 81............98
>>    pub   rsa4096 2017-04-18 [SC]
>>          1E1..................................EA7
>>    uid           [ unknown] Jens Tr?ger 
>>    <jens.troeger at light-speed.de>
>>    sub   rsa4096 2017-04-18 [E]
>>          09D..................................798
>> 
>> and when I manually use the subkey to encrypt something I get 
>> the same error:
>> 
>>    jens at pooh ~ > gpg --recipient 
>>    09D..................................798 --encrypt --armor
>>    gpg: 81............98: There is no assurance this key 
>>    belongs to the named user
>> 
>>    sub  rsa4096/81............98 2017-04-18 Jens Tr?ger 
>>    <jens.troeger at light-speed.de>
>>          1E1..................................EA7
>>          09D..................................798
>> 
>>    It is NOT certain that the key belongs to the person named
>>    in the user ID.  If you *really* know what you are doing,
>>    you may answer the next question with yes.
>> 
>>    Use this key anyway? (y/N) y
>>    Hello
>>    ^D
>> 
>> So this works, although I get that exact same warning.
>> 
>> Now the question I have is: how can I fix this? And what 
>> happened here, why did that subkey suddenly (?) stop working?
>> 
>> Any insight would be appreciated, thank you!
>> Jens
>>