duplicity - gnupg - no secret key - no passphrase given

Question

I have a problem with duplicity and gpgnu.

Environment (Software):

• Ubuntu 20.04
• gpg (GnuPG) 2.2.19 (from package)
• libgcrypt 1.8.5 (installed from package)
• duplicity 0.8.18 (installed manually, since ubuntu has 0.8.11)
• pinentry-gtk2 (as ubuntu package)
• gnupg-agent (as ubuntu package)

Environment (GnuPG, duplicity):

• sign key
• encryption key
• GnuPG conf file (~/.gnupg/.gpg.conf)
• GNuPG-agent conf file (~/.gnupg/gpg-agent.conf)
• bash-script for backup

Contents of gpg.conf

use-agent
pinentry-mode loopback

Contents of gpg-agent.conf

pinentry-program /usr/bin/pinentry-gtk-2
allow-loopback-pinentry

Environment folders:

• data (100 GB)
• backup_data
• test_data (5 kB)
• test_backup

Contents of bash-script for backup

export PASSPHRASE=""
export SIGN_PASSPHRASE=ZZZZZZZZZ #(of course real one is written)
ENCRYPT_KEY=XXXXXXXXX #(of course real one is written)
SIGN_KEY=YYYYYYYYY #(of course real one is written)
SOURCE="/mnt/test_data"
TARGET="file:///mnt/test_backup"
duplicity --full-if-older-than 1M --encrypt-key ${ENCRYPT_KEY} --sign-key ${SIGN_KEY} ${SOURCE} ${TARGET} --gpg-options '--cipher-algo AES256'

What works:

I can create enrypted full backup of the test folder. I also can create one encrypted full backup of the data folder without interruption.

What does NOT work:

I cannot do incremental backups of the folders. I cannot continue a full backup of data if I interrupt it.

The error message states:

GPGError: GPG Failed, see log below:
===== Begin GnuPG log =====
gpg: encrypted with 4096-bit RSA key, ID WWWWWWWWW, created 2021-04-03
"duplicity_enc (key for duplicity encryption)"
gpg: public key decryption failed: No passphrase given
gpg: decryption failed: No secret key
===== End GnuPG log =====

The WWWWWWWWW corresponds to the sub of the encryption key, while the XXXXXXXXX corresponds to the pub key of the encryption key.

I found the following links, which are close to my problem (I think):

• Duplicity restore failing: No secret key
• gpg: decryption failed: No secret key

I could not solve the problem. The seconds link states updating to GPU 2.2.23. I tried to compile GPU from scratch, installed the required libraries but I ended up in a symbol lookup error - that is another topic/issue.

Does anybody know, have any ideas or hints why and how to solve the "No passphrase given" problem?

Answer 1

You probably can try setting PASSPHRASE to the GPG key passphrase (the encrypt one; Duplicity needs to decrypt the manifest file to resume a backup)... Also make sure you have the private key of the one being used to encrypt.

You don't need the private key to make a full backup, you only need the public key for that. But to decrypt them you need the private key and its password.

This has helped me, and might help you as well: https://www.digitalocean.com/community/tutorials/how-to-use-duplicity-with-gpg-to-securely-automate-backups-on-ubuntu (search for "passphrase")