gpg加密文件没有键盘交互

Question

我在crontab中运行下一个命令来加密文件,我不想进行键盘交互

echo "PASSPHRASE" | gpg --passphrase-fd 0 -r USER --encrypt FILENAME.TXT

但我有这个答案:

gpg: C042XXXX: There is no assurance this key belongs to the named user

pub  40XXX/C042XXXX 2012-01-11 Name LastName. (comment) <user@email.com>
 Primary key fingerprint: XXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX
      Subkey fingerprint: XXXX XXXX XXXX XXXX XXXX  XXXX XXXX XXXX XXXX XXXX

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) 

Answer 1

正如大卫暗示的那样,问题在于gpg不信任你用来加密的公钥.你解释说,你可以签署密钥.

另一种选择 - 特别是如果键可能偶尔会发生变化 - 将是--trust-model always你的gpg命令.

这是手册页中的相关位:

--trust-model pgp|classic|direct|always|auto

     Set what trust model GnuPG should follow. The models are:

     pgp    This is the Web of Trust combined with trust signatures as used in
            PGP 5.x and later. This is the default trust model when creating a
            new trust database.

     classic
            This is the standard Web of Trust as used in PGP 2.x and earlier.

     direct Key validity is set directly by the user and  not  calculated  via
            the Web of Trust.

     always Skip  key  validation  and  assume that used keys are always fully
            trusted. You generally won't use this unless you  are  using  some
            external  validation  scheme.  This  option  also  suppresses  the
            "[uncertain]" tag printed with signature checks when there  is  no
            evidence that the user ID is bound to the key.

     auto   Select  the  trust  model depending on whatever the internal trust
            database says. This is  the  default  model  if  such  a  database
            already exists.

Answer 2

这是我的解决方案,基于gpg2(但我打赌你可以将相似的技术应用于gpg)

$ gpg2 --edit-key {recipient email address}  
> trust
> 5 (select 5 if you ultimately trust the key) 
> save

这将告诉gpg2完全信任密钥,以便您可以在没有提示的情况下进行加密

Answer 3

黑客方法:

echo -n PASSPHRASE > phrase
chmod 400 phrase #Make sure ONLY the user running the cron job can read the phrase
yes | gpg --passphrase-fd 3 --recipient USER --encrypt FILENAME.txt 3<phrase

根本问题是您对USER的密钥没有签名.如果你相信它,你可以签名

gpg --edit-key USER sign

它可能会询问几个问题,具体取决于您的配置.这样做一次,然后你应该好好进入你的crontab.我仍然建议使用我提出的解决方案,将密码短语放在一个单独的文件中,并使其只能由命令运行的一个用户读取.如果你这样做,你可以杀死yes |,只需要加密线.

Answer 4

使用这个命令，它会对你有帮助

echo "PASSPHRASE" | gpg --passphrase-fd 0 --always-trust -r USER --encrypt FILENAME.TX