1

I've got a question about gpg and signing a key automatically via bash: I've got a script, that is doing the beginning of signing:

gpg --recv $schluessel1
gpg --edit $schluessel1

If I try something like this:

lsign

it is ignored and just show me the below output.

gpg>

From the above prompt, I can write manually lsign and later y in.

Is it possible to do these two steps automatically?

3
  • The phrase "sign and trust a gpg key automatically" just nearly gave me a coronary.
    – Shadur
    May 28, 2014 at 17:07
  • @Shadur Then I hope you don't use Enigmail... May 28, 2014 at 18:14
  • 1
    @Shadur There are circumstances where it's appropriate. For example when you just generated the key. May 28, 2014 at 23:10

2 Answers 2

1

I have written a script which does something similar (German but that seems not to be a problem here: http://www.openpgp-schulungen.de/scripte/keygeneration/key-generation.sh):

echo addkey$'\n'8$'\n'e$'\n'q$'\n'${length}$'\n'"$expire"$'\n'save$'\n' |
  LC_ALL= LANGUAGE=en gpg --batch --display-charset utf-8 --utf8-strings \
  --passphrase "$PASSPHRASE" --command-fd 0 --edit-key $x_short_id

This works with both GnuPG 1.4.x and 2.0.x.

With 1.4.x the lsign operation should be easily possible in a similar way. With 2.0.x you have to care about gpg-agent, too. That is possible but I have not implemented that yet. The basic idea is:

  1. Start gpg-agent with a configuration which replaces pinentry.
  2. Use a pinentry replacement which reads the necessary data from a FIFO (because the script is started by gpg-agent).
  3. Start a background process which writes the necessary data to the FIFO.

Code example:

echo "OK - what's up?"
while read cmd rest; do
        # echo "cmd=$cmd rest=$rest" >&2
        : ${PINENTRY_USER_DATA}
        case "$cmd" in
                \#*)
                        :
                ;;
                GETINFO)
                        if [ "pid" = "$rest" ]; then
                                echo "D $$"
                        fi
                        echo "OK"
                ;;
                GETPIN)
                        read PASSPHRASE <"$input_fifo_path"
                        echo "D ${PASSPHRASE}"
                        echo "OK"
                ;;
                BYE)
                        echo "OK"
                        exit 0
                ;;
                *)
                        echo "OK"
                ;;
        esac
done
0

I just found the correct answer:

gpg --recv $key                     # receive Key from Keyserver
xdotool key y; xdotool key Return   # press y and then return
gpg --edit $key lsign save          # Sign and save the key

First I had to install xdotool sudo apt-get install xdotool then it was possible to run it automatically. By now I didn't try the save but hope it is just fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.