1

I've got a question about gpg and signing a key automatically via bash: I've got a script, that is doing the beginning of signing:

gpg --recv $schluessel1
gpg --edit $schluessel1

If I try something like this:

lsign

it is ignored and just show me the below output.

gpg>

From the above prompt, I can write manually lsign and later y in.

Is it possible to do these two steps automatically?

3
  • The phrase "sign and trust a gpg key automatically" just nearly gave me a coronary. Commented May 28, 2014 at 17:07
  • @Shadur Then I hope you don't use Enigmail... Commented May 28, 2014 at 18:14
  • 1
    @Shadur There are circumstances where it's appropriate. For example when you just generated the key. Commented May 28, 2014 at 23:10

2 Answers 2

1

I have written a script which does something similar (German but that seems not to be a problem here: http://www.openpgp-schulungen.de/scripte/keygeneration/key-generation.sh):

echo addkey$'\n'8$'\n'e$'\n'q$'\n'${length}$'\n'"$expire"$'\n'save$'\n' |
  LC_ALL= LANGUAGE=en gpg --batch --display-charset utf-8 --utf8-strings \
  --passphrase "$PASSPHRASE" --command-fd 0 --edit-key $x_short_id

This works with both GnuPG 1.4.x and 2.0.x.

With 1.4.x the lsign operation should be easily possible in a similar way. With 2.0.x you have to care about gpg-agent, too. That is possible but I have not implemented that yet. The basic idea is:

  1. Start gpg-agent with a configuration which replaces pinentry.
  2. Use a pinentry replacement which reads the necessary data from a FIFO (because the script is started by gpg-agent).
  3. Start a background process which writes the necessary data to the FIFO.

Code example:

echo "OK - what's up?"
while read cmd rest; do
        # echo "cmd=$cmd rest=$rest" >&2
        : ${PINENTRY_USER_DATA}
        case "$cmd" in
                \#*)
                        :
                ;;
                GETINFO)
                        if [ "pid" = "$rest" ]; then
                                echo "D $$"
                        fi
                        echo "OK"
                ;;
                GETPIN)
                        read PASSPHRASE <"$input_fifo_path"
                        echo "D ${PASSPHRASE}"
                        echo "OK"
                ;;
                BYE)
                        echo "OK"
                        exit 0
                ;;
                *)
                        echo "OK"
                ;;
        esac
done
0

I just found the correct answer:

gpg --recv $key                     # receive Key from Keyserver
xdotool key y; xdotool key Return   # press y and then return
gpg --edit $key lsign save          # Sign and save the key

First I had to install xdotool sudo apt-get install xdotool then it was possible to run it automatically. By now I didn't try the save but hope it is just fine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .