I have an application, run as a service by a system user, which uses GPG (using libgpgme in C). This user has no home directory and I would like to eliminate password caching.
Therefore I'd like
gpg-agent to be started with
--homedir=/opt/myapp/.gnupg --default-cache-ttl 0.
The agent is automatically started on demand by gpg, gpgsm, gpgconf, or gpg-connect-agent. Thus there is no reason to start it manually.
This leads me to a few of questions:
- How should one start
gpg-agentfor a specific home-dir with specific command-line options?
gpg-agentis already running, is it possible to change the
default-cache-ttlor should I kill the existing agent?
- Will killing the existing
gpg-agentaffect other (non-system) users?
gpg-connect-agent --homedir /opt/myapp/.gnupg /bye creates a new
gpg-agent with that homedir, but any other agents continue to run. Which
gpg-agent will be used when we sign?
For question 2: I tried the following. However,
homedir does not appear as an option in
--list-options gpg-agent and while I saw the new values refresh during
--list-options, I was still able to sign files without a password.
echo "default-cache-ttl::0" | gpgconf --change-options gpg-agent echo "max-cache-ttl::0" | gpgconf --change-options gpg-agent