2

I have two scripts that both need to decrypt passwords using gpg-agent. Both of them run fine when launched from the terminal. The problem is that when run via cron, they both fail with these messages:

gpg: problem with the agent: End of file
gpg: decryption failed: No secret key

I have this in /etc/profile.d/gpg-agent.sh:

if [ $EUID -ne 0 ] ; then
    envfile="$HOME/.gnupg/gpg-agent.env"
    if [[ -e "$envfile" ]] && kill -0 $(grep GPG_AGENT_INFO "$envfile" | cut -d: -f 2) 2>/dev/null; then
        eval "$(cat "$envfile")"
    else
        eval "$(gpg-agent --daemon --enable-ssh-support --write-env-file "$envfile")"
    fi
    export GPG_AGENT_INFO  # the env file does not contain the export statement
    export SSH_AUTH_SOCK   # enable gpg-agent for ssh
fi

And I can verify the agent is running:

% pgrep gpg-agent
510

The cron tasks are in my own crontab. I've tried executing the scripts like this:

*/30 * * * * source /home/user/.gnupg/gpg-agent.env && export GPG_AGENT_INFO && /script

But nothing I've tried works.

6
  • 1
    Is the agent running when your crontab runs? It's only started when you log in (and depending on your configuration, it might get killed when you log out). If you run env -i HOME="$HOME" PATH=/usr/bin:/bin SHELL=/bin/sh LOGNAME="$LOGNAME" USER="$USER" 'source /home/user/.gnupg/gpg-agent.env && export GPG_AGENT_INFO && /script', does it work? Commented May 24, 2014 at 6:19
  • The single quote syntax isn't working. I get env: source /home/user/.gnupg/gpg-agent.env && export GPG_AGENT_INFO && /script: No such file or directory. I also tried env - HOME="$HOME" PATH=/usr/bin:/bin SHELL=/bin/sh LOGNAME="$LOGNAME" USER="$USER" $(source /home/user/.gnupg/gpg-agent.env && export GPG_AGENT_INFO) but the GPG_AGENT_INFO isn't present. Commented May 24, 2014 at 10:55
  • 1
    Sorry, I left out a part, it should be env -i HOME="$HOME" PATH=/usr/bin:/bin SHELL=/bin/sh LOGNAME="$LOGNAME" USER="$USER" sh -c 'source /home/user/.gnupg/gpg-agent.env && export GPG_AGENT_INFO && /script' (with the real path for /script of course). Commented May 24, 2014 at 23:11
  • That works, but the script still doesn't work. If I change the script at the end to echo $GPG_AGENT_INFO then I do see the correct path and pid for gpg-agent. So something's still wrong with my gpg setup. I have use-agent in my ~/.gnupg/gpg.conf. I also have pinentry-program /usr/bin/pinentry-curses in my ~/.gnupg/gpg-agent.conf. Commented May 25, 2014 at 1:57
  • 1
    What do you mean by “doesn't work”, do you mean that this env -i … prints the “gpg: problem with the agent: End of file” message? If so, it means that gpg needs another variable that is usually in your environment. Commented May 25, 2014 at 9:20

0

You must log in to answer this question.

Browse other questions tagged .