How to use gpg --gen-key in a script?
Rise to the top 3% as a developer or hire one of them at Toptal: https://topt.al/25cXVn
--------------------------------------------------
Music by Eric Matyas
https://www.soundimage.org
Track title: Puzzle Game 3
--
Chapters
00:00 How To Use Gpg --Gen-Key In A Script?
00:33 Accepted Answer Score 18
01:27 Answer 2 Score 3
02:34 Thank you
--
Full question
https://superuser.com/questions/1003403/...
--
Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...
--
Tags
#linux #script #gnupg #pgp #openpgp
#avk47
ACCEPTED ANSWER
Score 18
OpenSSL does not support OpenPGP, so you can't use it for key generation. Anyway, GnuPG is rather easy to script using --with-colons
together with --batch
. For most operations, using GPGME is the way to go, at least for high-level programming languages where libraries exist to interface GnuPG through it without having to parse the output on your own.
Also scripted key generation is possible: you're looking for unattended key generation, which is well possible. In the end it boils down to storing a description on how to generate the keys in a file, and running gpg --batch --genkey [filename]
.
The documentation linked above hosts following example on unattended key generation:
$ cat >foo <<EOF
%echo Generating a basic OpenPGP key
Key-Type: DSA
Key-Length: 1024
Subkey-Type: ELG-E
Subkey-Length: 1024
Name-Real: Joe Tester
Name-Comment: with stupid passphrase
Name-Email: joe@foo.bar
Expire-Date: 0
Passphrase: abc
%pubring foo.pub
%secring foo.sec
# Do a commit here, so that we can later print "done" :-)
%commit
%echo done
EOF
$ gpg2 --batch --gen-key foo
[...]
$ gpg2 --no-default-keyring --secret-keyring ./foo.sec \
--keyring ./foo.pub --list-secret-keys
/home/wk/work/gnupg-stable/scratch/foo.sec
------------------------------------------
sec 1024D/915A878D 2000-03-09 Joe Tester (with stupid passphrase) <joe@foo.bar>
ssb 1024g/8F70E2C0 2000-03-09
ANSWER 2
Score 3
$ gpg --quick-gen-key --batch --passphrase '...' a@gmail.com
From what I can see --quick-gen-key
is a better choice for scripts:
4.5.3 The quick key manipulation interface
Recent versions of GnuPG have an interface to manipulate keys without using the interactive command
--edit-key
. This interface was added mainly for the benefit of GPGME (please consider using GPGME, see the manual subsection “Programmatic use of GnuPG”).
https://www.gnupg.org/documentation/manuals/gnupg/The-quick-key-manipulation-interface.html
4.5 Unattended Usage
gpg
is often used as a backend engine by other software. To help with this a machine interface has been defined to have an unambiguous way to do this. The options--status-fd
and--batch
are almost always required for this.
- Programmatic use of GnuPG: Programmatic use of GnuPG
- Ephemeral home directories: Ephemeral home directories
- The quick key manipulation interface: The quick key manipulation interface
https://www.gnupg.org/documentation/manuals/gnupg/Unattended-Usage-of-GPG.html
--batch
makes it not ask questions (except for a passphrase):
--batch
--no-batch
Use batch mode. Never ask, do not allow interactive commands.
https://man.archlinux.org/man/core/gnupg/gpg.1.en
Or a bigger example.