gpg2 on Mac: How to enter passphrase on terminal instead of getting a GUI prompt?

Question

I am using Mountain Lion and when I encrypt a file using gpg an annoying GUI prompts for me to enter the passphrase. I would like to be prompted for the passphrase in the terminal, not in an external GUI. I may be doing that remotely for example.

Is there a way to make gpg for mac ask for the passphrase in the terminal and no in a GUI prompt?

---

UPDATE: This seems very hard with gpg2 so I have downgraded to gpg1. Tried everything with gpg2 (MacGPG2) and nothing worked. Sucks! With gpg1 works fine!

Answer 1

The following assumes you are using gnupg2 with macports, and not MacGPG2, but the fix will likely apply to your use case.

Install 'pinentry' package from macports:

port -v install pinentry

Edit your ~/.gnupg/gpg-agent.conf to suit:

pinentry-program /opt/local/bin/pinentry-curses

Remove or comment the existing 'pinentry-program' entry. Reload your terminal, or use this:

echo RELOADAGENT | gpg-connect-agent

Done. You should now have pinentry/passphrase in-terminal (curses dialog). If you wish to have the old gpg v1.x behaviour of inline-ttl pinentry, you may be able to use a custom './configure' command with the macports pinentry package.

If you have previously installed MacGPG2 / GPG tools for Mac, you may need to kill the 'shutdown-gpg-agent' process before the pinentry dialog will work (or just reboot).

user$ ps ax |grep shutdown-gpg-agent
 1854   ??  S      0:00.01 /bin/bash /usr/local/MacGPG2/libexec/shutdown-gpg-agent

user$ kill -KILL 1854

Answer 2

You can check whether you are coming over an ssh connection by checking the environment variable SSH_CONNECTION.

export GPG_TTY=$(tty)
if [[ -n "$SSH_CONNECTION" ]] ;then
    export PINENTRY_USER_DATA="USE_CURSES=1"
fi

I use checks to see whether I am running over ssh or over tmux by using the following check:

export GPG_TTY=$(tty)
if [[ -n "$SSH_CONNECTION" || -n "$TMUX" ]] ;then
    export PINENTRY_USER_DATA="USE_CURSES=1"
fi

Source

Answer 3

Three words: compile it yourself. Yes, you can do that! Be sure to get rid of the gpg-agent.conf file first though!

Answer 4

I just finished compiling the GnuPG (version 2.2.9) and all its dependencies for a Mac OS High Sierra. It was quite interesting. After solving a small problem with the tests of libgcrypt (with a little help of the respective recipe from Homebrew), everything worked basically out of the box.

While trying to import my private key, I couldn't, because the system was lacking a pinentry program. A quick search made me land on this page, but it wasn't very helpful, so I simply decided to compile the pinentry myself.

I already knew, from my experience using GnuPG on Linux machines, that I would like to type my password in a normal prompt on the command line, without those annoying, disrupting dialog boxes. And that's why I'm sharing the process here. It's simple, but might help someone with a similar problem.

Start by getting the source code of pinentry from GnuPG. Check their website. At the time of writing, the link to download the source was https://gnupg.org/ftp/gcrypt/pinentry/pinentry-1.1.0.tar.bz2. Download also the signature and check the authenticity using gpg itself.

DON'T SKIP THE VERIFICATION, this is important! This program will have access to all your gpg passwords and private keys. You better make sure it is what it claims to be! If you have problems, make sure you have imported the keys from the maintainers of GnuPG (see here):

$ gpg --verify pinentry-1.1.0.tar.bz2.sig pinentry-1.1.0.tar.bz2

Now that you are sure you are working with authentic source files, extract the source code and cd in that directory:

$ tar xvf pinentry-1.1.0.tar.bz2
$ cd pinentry-1.1.0

The compilation is very straight forward:

$ ./configure --enable-pinentry-tty
$ make
$ sudo make install

It might be that configure will complain about some missing dependency. It that case, simply read the error and download the dependency from GnuPG webpage (always checking for the integrity of the download!).

The important bit of the commands above is the flag --enable-pinentry-tty. Pinentry TTY is the simplest way to type your password in a very normal and boring prompt on the command line. Exactly what I wanted! If I'm not mistaken, the curses version will be built anyways. Although it's a CLI option, I find it as disruptive as all the others.

Once it's installed, you will see some new binaries in /usr/local/bin. Make sure you have one called pinentry-tty (if you don't, something went wrong...).

To make that new binary your default way of typing the gpg password, add the following line to ~/.gnupg/gpg-agent.conf (create the file and directory if they don't exist yet):

pinentry-program /usr/local/bin/pinentry-tty

It won't probably work if you try immediately, because you most likely still have an gpg-agent running with old configuration. Go ahead and kill all the gpg-agents and create a new one:

$ sudo killall gpg-agent
$ gpg-agent --daemon

That's it! Enjoy you old-style TTY pinentry :)