Where is it?

Required

In my case the smartcard wasn’t immediately available to gpg, despite it clearly showing up in lsusb.

You can check this with

gpg --card-status

This command should output some information about the present smartcard. If the output looks like the desert scene out of an old western movie, it’s probably not being recognized correctly.

With WSL, gnupg apparently can’t simply access the device, which would normally be made possible by installing libusb-compat.

To use the smartcard, we need to install pcsclite, which manages the smartcard, as well as ccid, which is a generic CCID driver.

Then we enable and start the pcscd socket and service, which means it will be started, whenever needed

sudo systemctl enable pcscd
sudo systemctl start pcscd

As described in the Arch Wiki page about GnuPG however, forwarding the smartcard to WSL will most likely throw errors.

Following the wiki on how to fix this, we simply add a new polkit rule to allow all users of the wheel group (which our user is a part of), access to the smartcard. The polkit rules are written in JavaScript and I chose to put this rule in /etc/polkit-1/rules.d/99-pcscd.rules.

1
polkit.addRule(function (action, subject) {
2
  if (
3
    action.id == "org.debian.pcsc-lite.access_card" &&
4
    subject.isInGroup("wheel")
5
  ) {
6
    return polkit.Result.YES;
7
  }
8
});
9
polkit.addRule(function (action, subject) {
10
  if (
11
    action.id == "org.debian.pcsc-lite.access_pcsc" &&
12
    subject.isInGroup("wheel")
13
  ) {
14
    return polkit.Result.YES;
15
  }
16
});

Restart the polkit.service

sudo systemctl restart polkit.service

or even better, restart WSL (only restarting polkit didn’t work for me)

Terminal window
```
exit
```
Terminal window
```
wsl.exe --shutdown
arch.exe
```

In my case, it was still trying to connect to the smartcard using the integrated ccid, so I needed to disable it by modifying/creating ~/.gnupg/scdaemon.conf

disable-ccid

If you still struggle with WSL recognizing the smartcard, you could try the pcsc_scan utility from the pcsc-tools package.

If you still have outstanding permission issues, try running it with sudo to at least confirm the usbipd part worked, although after adding the polkit rule and a WSL restart, pcsc_scan should work as a normal user.

You can also check what gpg-agent is doing with

systemctl --user status gpg-agent