Check the key is capable of encryption / decryption before trying to add to the store

[hackaugusto]

Summary

This is not really a bug, more of an usability issue. When running gopass recipients add --store <store> <user_id> for a key that can not do encryption (say, it is a certificate only key), gopass will run and the encryption will just fail on every secret.

Steps To Reproduce

• create a new private / public key pair, which does not support encryption
• import on a test keystore
• try to add the key to a password store

Expected behavior

A friendly user message saying the key of user_id can not be used because it does not support encryption.

Environment

• OS: Fedora
• OS version: Linux .. 5.11.15-200.fc33.x86_64 Add template feature #1 SMP Fri Apr 16 13:41:20 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
• gopass Version: gopass 1.8.6 (d5b0d3b 2021-01-27 21:11:07) go1.15.6 linux amd64
• Installation method: compiled

Additional context

Cool project, thanks for it :)

[dominikschulz]

This is definitely something I'd like to add.

Not sure how, but I guess some GPG trickery should be able to give that information.

[hackaugusto]

@dominikschulz I didn't check how gopass is using gpg, but it is possible to list the keys with gpg --with-colons --list-public-keys <user_id>, and then the field 12 will have e in it if the key has encryption capabilities ref

[dominikschulz]

That's helpful, thank you. We already parse that output but we don't seem to evaluate the key capabilities, yet.