How to run gpg agent with custom config when the agent starts automatically after running a specific gpg command?

Question

From the documentation, I can run gpg-agent with custom config like this and I think this is the official way:

The following gpg-agent.conf contains this:

allow-preset-passphrase
default-cache-ttl 34560000
max-cache-ttl 34560000

and to run gpg-agent with custom config:

#!/bin/bash
GPG_CONFIG_FILE="/opt/gpg-agent.conf"
gpg-agent --options $GPG_CONFIG_FILE --daemon

From my observation, the gpg-agent reads the custom config perfectly with no issue.

But, then I notice that if a gpg-agent is not running, then when I run a gpg command it will automatically run gpg-agent. This are example of commands that will call gpg-agent and start it automatically:

1) echo RELOADAGENT | gpg-connect-agent # Reload and forget passphrase of gpg-agent
2) KEY_GRIP=$(gpg --with-keygrip --list-secret-keys $KEY_ID | grep -Pom1 '^ *Keygrip += +\K.*') # List key grip for that key_id

The problem is the above commands did not run gpg-agent with custom config. I'm writing a bash script where the config will be generated with predefined value automatically inside the script own path (if it does not exist). So the script will only use this custom config not in ~/.gnupg.

$ ls
myscript.sh
conf/gpg-agent.conf

Question:

1. How do I make the gpg-agent to use custom config when running the above example commands ?

2. If question 1) is not possible, how do I prevent gpg-agent from running when executing the commands example given above that will automatically run gpg-agent ?

Answer 1

This has been more than a year. So, I solved this issue. The problem is caused by bug using the --daemon option as described in here: https://dev.gnupg.org/T5076,

In brief, gpg-agent should not spawn another process if an existing process is already there when we try to execute gpg command but it was stubborn not to use the existing gpg-agent process and create its own random process without using the custom config.

So the solution for systemd user in my case, I need to use the --supervised option when starting gpg-agent. Never ever use the --daemon option.

More details:

It is not straightforward to use the --supervised option like you run it using --daemon option. This supervised mode requires the service file and socket file to communicate each other and it must be enabled through systemctl. Here are the systemd files (this link described everything how to enable it):

https://github.com/gpg/gnupg/tree/master/doc/examples/systemd-user

So I can modify the gpg-agent.service to use custom option, then start gpg-agent using systemctl --user start gpg-agent. After that, every gpg commands will use this process instead of creating the new one. Too see the current process ID of the running gpg-agent I can do this:

systemctl --user status gpg-agent

So, the above answered my previous first and second questions. The second question would not prevent gpg-agent from running, but it will not create an extra gpg-agent process as this is what I was trying to solve previously because I had multiple gpg-agent process running that caused error in passphrase validation when it was running using --daemon option; The error that I mentioned here also described in the gpg bug tracker above. So my objective from the 2nd question was trying to prevent every gpg command to start gpg-agent automatically so that I can start them manually. But I don't need this method anymore when using --supervised option.