1

Here's info on the pass: https://www.passwordstore.org

My key point is, that I would like to pass the passphrase key at the command line. However, the topic and solutions related to this question that I could find, are not working in my case.

When I have examined the code of Pass, I have found a parameter called PASSWORD_STORE_GPG_OPTS. As far as I can see, it should be possible to use it to pass --pinentry-mode=loopback --passphrase "<password_here>" to gpg executed by Pass. The code fragment that executes it is here:

#Line 9
GPG_OPTS=( $PASSWORD_STORE_GPG_OPTS "--quiet" "--yes" "--compress-algo=none" "--no-encrypt-to" )

#(...)

#Line 387

pass="$($GPG -d "${GPG_OPTS[@]}" "$passfile" | $BASE64)" || exit $?

However, for some reason, this is not working.

So the question is, would it be possible to use this parameter to pass passphrase to gpg and use pass without prompt? If not, then are there any other ways to do so?

EDIT: As @they suggested, here is info on what I'm doing:

Set variable:

 export PASSWORD_STORE_GPG_OPTS="--pinentry-mode=loopback --passphrase '<password_goes_here>'"

Remark: Password contains only small and big letters and digits - no whitespaces nor other characters.

Then, execute the pass with:

pass address/to/some/password

Outcome is:

gpg: decryption failed: No secret key
5
  • The variable is documented in the pass manual. It can only be used if the value can be split on whitespaces and undergo filename globbing and still be a valid set of arguments to gpg. This means that if your password contains filename globbing character and spaces/tabs, then you will have issues. It's not clear from the question what you actual issue is, so I'm not turning this into an answer. The answer to "does not work" is just "you did something wrong".
    – Kusalananda
    Commented Jan 27, 2022 at 11:44
  • Thanks for comment. Not sure about what I should state as an issue then - shall I write "my problem is that I keep getting 'gpg: decryption failed: No secret key' even with stated passphrase as mentioned above"?
    – PastorPL
    Commented Jan 27, 2022 at 11:58
  • At a minimum, show how you set the variable, how you call pass, and the actual output from doing so. Don't show your password, but say whether it contains spaces, tabs, or newlines, or filename globbing characters like *, [, ], and ?.
    – Kusalananda
    Commented Jan 27, 2022 at 12:21
  • 2
    Does removing the single quotes around the password help? The way you have written the string, they would be interpreted as part of the password since the shell will not do the usual quote-removal step on the contents of that string.
    – Kusalananda
    Commented Jan 27, 2022 at 14:01
  • It does.... my goodness, it was so obvious. Ehh, nevertheless, many thanks for patience and help! :) PS. Please post this as an answer.
    – PastorPL
    Commented Jan 28, 2022 at 8:04

2 Answers 2

0

In my case, as @they suggested, problem was using (for unknown reason....) quotes. Without them, everything is working like a charm.

2
  • What does the working export PASSWORD_STORE_GPG_OPTS= line look like, exactly?
    – baltakatei
    Commented Apr 11, 2022 at 10:34
  • 1
    I think export PASSWORD_STORE_GPG_OPTS=--pinentry-mode=loopback --passphrase <password_goes_here>
    – PastorPL
    Commented Apr 11, 2022 at 11:48
0

As an alternative to reading the password from a string, as suggested above, the passphrase can also be handled through some file:

export PASSWORD_STORE_GPG_OPTS="--pinentry=loopback --passphrase-file /path/to/.passphrase"

Using a hashed passphrase does not seem to be possible (for instance, with mkpasswd -m sha-512 passphrase > /path/to/.passphrase-hashed), so it needs to be given in plain text.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .