11

I want to write a script that will run gpg a file called "file" with the passphrase "test".

Normally, when I use gpg, I usually just run gpg -c file and it asks me for the passphrase. But since I want this script to do everything on its own, I would like to provide the passphrase as part of the command.

Now when I try to use: gpg -c file --passphrase test, it outputs:

usage: gpg [options] --symmetric [filename]

Which seams like it wants me to use gpg --passphrase test --symmetric file. But if I do that, it pops up a dialog asking me for the passphrase to use; which is not what I want.

How do I do set up the arguments correctly?

Improve this question
7

In GnuPG, options must preced commands, thus the --passphrase option must come before --symmetric.

Regarding the pin entry window, that pops up anyway (although you use --passphrase), you're probably already using GnuPG 2, which requires --batch to be used together with --passphrase. From the man pages:

--passphrase string
    Use string as the passphrase. This can only be used if only one
    passphrase is supplied. Obviously, this is of very questionable
    security on a multi-user system. Don't  use this option if you
    can avoid it.  Note that this passphrase is only used if the
    option --batch has also been given.  This is different from
    GnuPG version 1.x.

Be aware that on multi user systems all other users will be able to read your command line, and thus also the passphrase while GnuPG is executed. Better use one of the other --passphrase-* options instead to read from a file or pipe.

Improve this answer
  • What you're saying is that my order of the --passphrase and --symmetric arguments were actually correct, but I was only missing the --batch argument? Because that didn't work for me. I've tried to add --batch both before and after, just in case. Also, I don't how to check if what I'm using is GPG 2, but the part that you've pasted that says Note that this passphrase is only used if the option --batch has also been given. does not exist in my man page. – user339781 Sep 13 '15 at 18:40
  • What operating system/distribution are you using? gpg --version should give information on the GnuPG version you're using. Do you have a gpg2 binary? – Jens Erat Sep 13 '15 at 19:42
  • I am using Xubuntu 14.04., the version of gpg is 1.4.16. Inspired by your comments, I found out that gpg2 is being developed separately, so I installed it and tried it out, but it complains that no valid OpenPGP data found. processing message failed: Unknown system error – user339781 Sep 13 '15 at 22:35
  • Jens you're super awesome and answer lots of questions w/great answers, but you're wrong on one point: "options must precede commands, thus the --passphrase option must come before --symmetric." Not true at all. – rsaw Sep 14 '15 at 3:30
  • @rsaw: You're partially right -- for --symmetric and --passphrase, the order does not seem to be relevant, but try to --export and define --armor afterwards. Generally, options must precede commands, which is also the order defined in the man pages. – Jens Erat Sep 14 '15 at 7:01
2

If gpg --version reports v2, you need to add the --batch option.

Based on the syntax output you're probably using v1, in which case you want:

gpg --passphrase PASS -c --no-use-agent FILE

Note that the order of options is not important; however, any file needs to be the last argument.

Improve this answer
1

Using --pinentry-mode loopback works with --passphrase & --passphrase-[file/fd], and will let you enter new info, in case of filename conflicts for example:

File 'xyz.gpg' exists. Overwrite? (y/N)n
Enter new filename: xyz2.gpg

unlike --batch that will quickly fail, saying ...failed: File exists

If you had originally added the verbose option (-v) first, you should have seen something like:

$ gpg -v -c file --pinentry-mode loopback --passphrase-file=passfile
gpg: Note: '--pinentry-mode' is not considered an option
gpg: Note: '--passphrase-file=passfile' is not considered an option
usage: gpg [options] --symmetric [filename]

indicating pretty clearly that it didn't like something about putting -c (--symmetric) first.

I consider gpg2's behaviour of ignoring --passphrase options unless accompanied by --batch as a bug.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy