Is it posible to configure gpg in a way that I enter passphrase only once, and it will work for the whole session (I'm using Ubuntu/XFce)?

I'm not sure how gpg works, it seems that the default function is that gpg asks gpg-agent for the passphrase and the agent runs pin-entry to ask for passphrase.

I would like to use pinentry-curses only once per session, so I can paste my passphrase (I have hex string from a sentence - I use echo -n <SENTENCE> | str-hex) and sign email from Claws Mail without putting passphrase (you can't use pinentry-curses with Claws Mail).


You can use the technique described on this page:


Here's the gist:

  1. Install gpg-agent and pinentry program:

    sudo apt-get install gnupg-agent pinentry-curses
  2. Add the lines below to ~/.profile. Any POSIX-confirming shell should include this file.

    # Invoke GnuPG-Agent the first time we login.
    # Does `~/.gpg-agent-info' exist and points to gpg-agent process accepting signals?
    if test -f $HOME/.gpg-agent-info && \
        kill -0 `cut -d: -f 2 $HOME/.gpg-agent-info` 2>/dev/null; then
        GPG_AGENT_INFO=`cat $HOME/.gpg-agent-info | cut -c 16-`
        # No, gpg-agent not available; start gpg-agent
        eval `gpg-agent --daemon --no-grab --write-env-file $HOME/.gpg-agent-info`
    export GPG_TTY=`tty`
    export GPG_AGENT_INFO

    This little script will be activated when you login. If the agent is not running, it will be started. When the agent is started, it shows how to set environment variables in order to connect to it. The script saves these values in ~/.gpg-agent-info, so that when you start another login session the script can setup the variables correctly and thus use the agent.

You will only have to enter your passphrase once per boot. The agent will store your keys in memory, so you don't have to enter the passphrase again.

  • I'd been using this script happily, but it would fail randomly. Eventually, I modified the conditional to this GPG_PROCESS=`cut -d: -f 2 $HOME/.gpg-agent-info` if test -f $HOME/.gpg-agent-info && \ kill -0 ${GPG_PROCESS} 2>/dev/null && \ [[ ${GPG_PROCESS} == `pgrep -x -u "${USER}" gpg-agent` ]] ; then and it worked fine. The problem is that the script above checks if the process in .gpg-agent-info is alive and accepts signals with kill -0. If a process is there, but not gpg-agent, we get the wrong behavior. The attached code checks we have the right process. – wyer33 Aug 14 '16 at 6:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.