Keygrip = 2EACA0C5A4B46168EB91970B6715AF1AA52968BEĬache the passphrase for the RPM signing key. On the RHEL 7.2 and Fedora 20 hosts I use for testing, the GPG2(1) program on those hosts didn't recognize the -with-keygrip option.) $ gpg2 -with-keygrip -K 0123ABCD
AUTOMATION GAME RPM CODE
Get the keygrip code for the RPM signing key. In this excample, the key ID is 0123ABCD. List your GPG keys to obtain the eight hexidecimal digit key ID for your RPM signing key. allow-preset-passphraseĪfter modifying ~/.gnupg/nf reload the gpg-agent.
If someone would like to comment on a solution for this, please do.)Įnsure ~/.gnupg/nf contains the line.
AUTOMATION GAME RPM HOW TO
I haven't yet figured out how to determine the RPM signing key's keygrip value on platforms running older versions of GnuPG because they don't support the -with-keygrip option. The solution described below was developed and tested on a Fedora 25 host with gnupg2-2.1.x installed. Thanks to Damato for pointing me toward the gpg-preset-passphrase utility. I don't want to permanently modify or disable the pinentry modules I just want to disable them temporarily to get back to GPG's CLI prompt "Enter pass phrase:" (or whatever that prompt string is now) without pinentry interfering.Īny suggestions for fully automating the entry of the RPM signing key's passphrase via the CLI without pinentry interference? +-+Īgain, pinentry-curses's console "dialog" interferes and prevents automated entry of the passphrase. | Please enter the passphrase to unlock the OpenPGP secret key: | Rpmsign -resign "/path/to/test-1.0."īut now I get an ncurses version of the dialog on the console: +-+ If I create a Bash script that momentarily unsets the DISPLAY environment variable, then I no longer get the GUI dialog, #!/bin/bash This pinentry behavior, of course, interferes and prevents automated entry of the passphrase. When I run RPMSIGN in a GUI console window on this F25 host, GPG uses pinentry to pop up a GUI dialog box that asks the user (me) to enter the passphrase for the RPM signing key. In F25 the pinentry feature breaks my existing EXPECT-based solution for automated entry of the passphrase for the RPM signing key. In the past I used an EXPECT(1) script that waited for GPG to ouptut the text "Enter pass phrase:" to the console, and then the EXPECT script would enter the pass phrase and on I'd go. In the production version the user will manually enter the RPM signing key's password.) This is simply an automated test environment and not a production host, so I'm not overly concerned about security. I want to take the human out of the loop and fully automate the task of supplying the passphrase for the RPM signing key.( And yes, I know about the security implications. Of course, GPG uses pinentry (PIN entry) to prompt the human to enter the passphrase for the RPM signing key (an RSA key pair). One of the automated tests involves invoking the RPMSIGN(8) program which in turn invokes GPG(1) to attach a digital signature to some RPM files I am creating. I'm writing some scripts to perform automated testing. I working on a Fedora 25 (F25) workstation, the KDE spin.
0 kommentar(er)
