gpg-agent and Loopback Pinentry
GnuPG 2.0 and newer only consider
--batch is also applied. From
Note that this passphrase is only used if the option
--batch has also been
given. This is different from GnuPG version 1.x.
So a working command for GnuPG 2.0 would be:
gpg --batch --passphrase-fd 0 --import <path>
Furthermore, since GnuPG 2.1,
gpg-agent handles all secret key operations and also asks for the passphrase. The idea behind this is to have a small core application handling the most critical bits of cryptography, and having the (comparably) large GnuPG with potentially more bugs and security issues application doing all the other stuff. By default,
gpg-agent will not query
gpg for the passphrase, but try to ask the user directly (which will obviously fail in an unattended build). There is a last escape, though: you can use
--pinentry-mode loopback to make
gpg for the passphrase, but as this impacts security as discussed before, you must also configure
gpg-agent to allow loopback pinentry.
Add following line to
Now, you should be able to use following command in GnuPG 2.1 and newer:
gpg --batch --pinentry-mode loopback --passphrase-fd 0 --import <path>
Passing in the
A better option than importing private keys to Docker containers is usually to store (and unlock) the private key on the host, and then passing a
gpg-agent socket into the Docker container. This way, the critical secrets never will enter the Docker container, and you can be very sure it will not be stored in the image layers and published by accident.