I'm using gpg-agent to remember and supply my GnuPG password when building Debian/Ubuntu packages. But I'm still confused how gpg-agent works. I invoke gpg-agent as:

eval $(gpg-agent --daemon)

It works sometimes. But what bothers me is that sometimes it doesn't work. I.e., sometimes the building process asks for my GnuPG passwords once, sometimes none, and sometimes many times. This all happens during one single bash session, after I've invoked gpg-agent as before. Not being asked for password this time doesn't guarantee that I won't get asked for password next time. I still haven't figure out why gpg decides to prompt me for password and why it doesn't.

Does it happen to you as well?


  • 1
    You'll need to spend some time to try to pin down under what circumstances it fails and what circumstances it succeeds. If you can describe what's reliably correlated with the failure then someone else is more likely to think of a solution. – bignose Jul 26 '13 at 0:07
  • In Emacs, for GNUS and .authinfo.gpg, I got a hint to use gpg2, which gpg-agent is associated with. So (setq epg-gpg-program "/usr/bin/gpg2") worked for me. Perhaps you will have to discover which of your applications are having the issue, they may be preferring gpg (1). – Brady Trainor Sep 14 '14 at 0:15

Found how to properly use gpg-agent from http://tr.opensuse.org/SDB:Using_gpg-agent

Following that, my gpg-agent daemon is caching my GnuPG passwords properly now. There was nothing wrong with my setup, just that I didn't know how to test whether my GnuPG passwords is caching properly or not.

Now, I do:

echo "test" | gpg -ase -r 0xMYKEYID | gpg

From the site: "Replace 0xMYKEYID with your GnuPG key ID. While running this command, the agent should open a graphical password dialog twice: first for signing or encrypting (gpg -ase)(gpg -ase) then for decryption or signature check (| gpg). From now on, every time GnuPG is used (either from the command line or embedded in a graphical program such as KMail), gpg-agent's password will be passed automatically (until the time-out expires or the graphical interface is closed)."

And to avoid the caching expiration, I now have set extremely long timeout period:

$ cat ~/.gnupg/gpg-agent.conf
max-cache-ttl 60480000
default-cache-ttl 60480000
| improve this answer | |
  • According to linux.die.net/man/1/gpg-agent, you can also add --write-env-file "${HOME}/.gpg-agent-info" when starting gpg-agent and then add if [ -f "${HOME}/.gpg-agent-info" ]; then . "${HOME}/.gpg-agent-info"; export GPG_AGENT_INFO fi to your .bashrc to detect whether the agent is already running. Seems like a bit cleaner solution. – Sean the Bean Jul 28 '16 at 17:08
  • @SeantheBean, excellent. I'll test it out and get back to you... – xpt Jul 28 '16 at 18:52
  • WARNING: "--write-env-file" is an obsolete option - it has no effect since at least Apr 4 '16. Ref: serverfault.com/a/481174 – xpt Dec 27 '19 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.