1

I've written a little script for my Clonezilla USB stick which will allow me to quickly back everything up without entering any options by simply running the script.

Next, I'd like to store my public GPG key on the stick and add some encryption to my backups like so:

find . -maxdepth 1 -type f -not -iname "*.gpg" | while read file ; do
    gpg --encrypt-using-key-file "/path/to/my/keyfile" "$file"
    rm "$file"
done

What is the way to properly encrypt files using a public GPG keyfile, ensuring that it doesn't prompt for user input? How would I actually do this?

  • You can use gpg -r name "$file" where name is your own user id (aka key's email address). It will not prompt for a password. BTW, I usually add the --armor and --yes options. I'd also rewrite your first line as for file in $(find . -maxdepth 1 -type f -not -iname "*.gpg"); do. – Deathgrip Jun 7 '17 at 7:17
2

You must have the target key in the keyring. I am not sure whether it is necessary that the target key is valid; better make it so.

You should use a config directory on the stick. With this directory being empty you import the key:

gpg --homedir /dir/on/stick --import /target/key.asc

This needs to be done just once. From your script you do this:

gpg --homedir /dir/on/stick --trust-model always --recipient 0x12345678 \
  --output /path/to/encrypted_file.gpg --encrypt /source/file

You may consider creating a signature for the file, too. But that would make the operation a bit more complicated.

  • It's using a squashfs container as its root filesystem. If I chroot into that fs and import the key before I create the filesystem, will it... just work™? – Naftuli Kay Jun 24 '13 at 1:39
  • The file system should not matter. – Hauke Laging Jun 24 '13 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.