I am working on a computer program that stores and retrieves secrets and needs to run without user interaction on the server.
I have successfully set everything up in my system to use
gpg-agent to retrieve the cached passphrase without user interaction to encrypt and decrypt data with
gpg2 --symmetric when I specify a file name.
However, this requires me to temporarily store my data on the disk without encryption. I do not want to put unencrypted data on my disk. So now I have changed things to work with STDIN and STDOUT rather than disk files.
The command I am testing with is this:
cat test.txt | gpg2 --symmetric -o test.gpg.
The problem is that now it does not seem possible to get the passphrase cached and so I must enter it interactively each time. This will not work for my server program.
I have tried using gpg-preset-passphrase for this. I do not know if it is possible though because it wants a "KEYGRIP". One rough idea I have is this: maybe there is some default keygrip that gpg2 uses with --symmetric and STDIN. But I don't know if that idea will pan out.
I am not planning to specify a passphrase in my code with --passphrase because that means I need to store a secret in the code, which I am not going to do.. and it would allow anyone who could access the code to decrypt the files. It would also expose the passphrase on the command line.
I hope that it is clear enough what I am trying to achieve. Any ideas are appreciated.