gpgsm: How do I import an unprotected key

[Jakob Bohm]

Dear list,

I am using gpgsm in a scripted system that decrypts huge CMS/PKCS#7
messages delivered between servers.

This means that there is no user interaction to unlock keys, not even
at boot.  Although interaction is allowed during certificate/key import

A typical gpgsm invocation goes like this (script simplified for mail):

#!/bin/bash
...
fprint=$(openssl x509 -in "${sigcertpem}" -noout -fingerprint | perl -pe 's/^SHA1 Fingerprint=//i; s/://sg;')
faketime "${ENCTSTAMP}" gpgsm --assume-binary --validation-model shell --disable-policy-checks --debug-level 7 --decrypt $encfile 2>/dev/null |
  tee $decfile |
  faketime "${SIGTSTAMP}" gpgsm --assume-binary --validation-model shell --disable-policy-checks --debug-level 7 --status-fd 3 --verify - 3>${tmppfx}.status 2>/dev/null ; then
    echo "Searching status file for ${fprint}..." >&2
    if ( grep "^\[GNUPG:\] GOODSIG ${fprint}" ${tmppfx}.status &&
         grep "^\[GNUPG:\] VALIDSIG ${fprint}" ${tmppfx}.status ) >/dev/null ; then
      rm ${tmppfx}.status
      echo "Success" >&2
      exit 0
    else
      rm ${tmppfx}.status
      echo "BadSig1" >&2
      exit 2
    fi
  else
    rm ${tmppfx}.status
    echo "BadSig2" >&2
    exit 2
  fi


Now the question that has hit further work is how to reliably import
the unprotected decruption key into gpgsm.

Running gpgsm --import ${newkeyandcert}.p12 creates a state that will
invoke gnupg-agent and prompt for a password, but refuse to accept
blank input.

Running gpgsm --import ${newcert}.pem doesn't import the private key
at all.

So what is the proper way to import a key and cert such that it is
treated as unprotected by private key operations?

Please state version differences in any answers.


Enjoy

Jakob
-- 
Jakob Bohm, CIO, Partner, WiseMo A/S.  https://www.wisemo.com
Transformervej 29, 2860 Søborg, Denmark.  Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded