I need to extend the expiration date of a GPG key, but all the answers or articles I can find do it interactively, for example. I need to embed the logic in a shell script, so wondering how can I do it non-interactively?
Suppose you have your key
email@example.com and your passphrase for that key is stored in file
passphrase.txt, following command will non-interactively change expiration date:
printf "expire\n10w\nsave\n" | gpg --batch --pinentry-mode loopback --passphrase-fd 3 --command-fd 0 --status-fd=2 --edit-key firstname.lastname@example.org 3<passphrase.txt
(If it doesn't work because of pinentry invocation see NOTE below.)
Brief explanation of command:
printf "expire\n10w\nsave\n"sends these commands to gpg.
expirechanges expiry date of key,
10wis 10 weeks,
--batchsays there will be no user input
--pinentry-mode loopbackallows piping passphrase file to gpg (see bellow)
--passphrase-fd 3says that file descriptor
3is where gpg should look for passphrase (note
3<passphrase.txtat the end of command.
--command-fd 0says that file descriptor
0(or STDIN) is where gpg should source
--batchcommands from (
printfportion in beginning of command).
--status-fd 2says that status goes to
2(or STDOUT), you might want to direct this to log.
--edit-key email@example.com key we want to edit
This answer should give you a good idea how to "automate" things with gpg. To make this complete you probably want to change expiration of encryption subkey, etc.
NOTE: Current versions of GnuPG don't allow to pipe passphrase easily (they default to gpg-agent and program called
pinentry). For sake of simplicity I enabled piping passphrase by adding
allow-loopback-pinentry to my
gpg-agent.conf. Please note this is not secure and you likely want to implement your own
pinentry (or use existing that suits your non-interactive workflow) and then set it in