<html><head></head><body><div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br>> At <a href="https://dev.gnupg.org/T4154">https://dev.gnupg.org/T4154</a> , 'allow setting passphrase from an<br>environment variable', there is a comment of "I don't see why we<br>should add yet more clumsy passphrase workarounds to gpg. We already<br>have PINENTRY_USER_DATA which can fulfill the same task."<br><br>Of course, the reference here to PINENTRY_USER_DATA is specious. To incorporate the processing of such a customized PINENTRY_USER_DATA requires the coding of a corresponding pinentry executable to receive it. <br><br>And if one has the capacity to code one's own unique pinentry executable ... they could code around the stated problem outside of using PINENTRY_USER_DATA in the first place.<br><br>And the T4154 request would never have been made, in the first place.<br><br><br>So, given the above, a solution towards: <br><br>>+ (<a href="https://dev.gnupg.org/T4154">https://dev.gnupg.org/T4154</a>)<br>>+<br>>+ So this patch adds a new form of passphrase-passing, using an environment<br>>+ variable. In POSIX shell, this looks like (for example):<br>>+<br>>+ mypass="IUuKctdEhH8' gpg --batch --pinentry-mode=loopback \<br>>+ --passphrase-env=mypass --decrypt < message.txt<br>>+<br><br>can be effected without resorting to PINENTRY_USER_DATA - so no need to code, customize, maintain, update per gpg upgrades, or apply patches to in-house self-solutions.<br><br><br>> Can anyone give an example of doing so?<br><br>> I am looking to effect the equivalent of ...<br><br>> Has anyone got a link to a working example of '3<' or 'PINENTRY_USER_DATA which can fulfill the same task' of gpg picking up its passphrase from an environment variable?<br><br><br>Examine <a href="https://lists.gnupg.org/pipermail/gnupg-users/2024-March/067030.html">https://lists.gnupg.org/pipermail/gnupg-users/2024-March/067030.html</a> ('How can I 'echo' into fd 3 to be able to use it on a gpg cmd line?') for a more detailed example script solution, but in brief for this thread:<br><br><br>gs_myfifo="$(mktemp -ut fifo.XXX)"<br>mkfifo -m 0600 "${gs_myfifo}"<br><br>gs_mysecretpassphrase="KXhtctw4_zFfhRop"<br><br>echo -e "${gs_mysecretpassphrase}" > "${gs_myfifo}" &<br>unset gs_mysecretpassphrase<br><br>echo -e "Stuff to be encrypted." \<br>| gpg --pinentry-mode loopback --passphrase-fd 3 -c 3< "${gs_myfifo}"<br><br>rm "${gs_myfifo}"<br><br><br>Of course, 'gs_mysecretpassphrase="KXhtctw4_zFfhRop"' would be replaced with some other mechanism of acquiring the passphrase. Perhaps via something such as:<br><br>export GPG_TERM="${TERM}"<br>echo -e "GETPIN\nBYE\n" \<br>| pinentry --ttyname "${GPG_TTY}" \<br>| sed -e "s/^OK.*$//" -e "/^[[:space:]]*$/d" -e "s/^D //"<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Mar 21, 2024 at 7:45 PM B.S. <<a href="mailto:bs27975@gmail.com">bs27975@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">At <a href="https://dev.gnupg.org/T4154" rel="noreferrer" target="_blank">https://dev.gnupg.org/T4154</a> , 'allow setting passphrase from an<br>
environment variable', there is a comment of "I don't see why we<br>
should add yet more clumsy passphrase workarounds to gpg. We already<br>
have PINENTRY_USER_DATA which can fulfill the same task."<br>
<br>
Can anyone give an example of doing so?<br>
<br>
I am looking to effect the equivalent of:<br>
'@rem Get passhrase into (env.) var. programmatically (in your<br>
favourite manner)'<br>
'set /p myenvpassphrase="Enter symmetric keyphrase to use:"<br>
'echo "Secret data" | gpg.exe -c --envpassphrase myenvpassphrase ><br>
secretdata.gpg'<br>
- thereby avoiding storing any passphrase (even temporarily) on a<br>
storage medium, nor have it visible as the command line (via tasklist<br>
or ps).<br>
- in this case, the 'secret data' is actually confidential<br>
information, piped from elsewhere, on the fly.<br>
<br>
Of course, the '-envpassphrase' option doesn't exist in gpg currently,<br>
but the comment at the above link indicates that there is another way<br>
to effect the same intent.<br>
<br>
Can anyone give an example of so doing?<br>
<br>
A current means of effecting the same is, of course, '--passphase-fd<br>
3", for something like:<br>
'echo "Secret data" | gpg.exe -c --passphrase-fd 3 3< echo %PASSWORD%<br>
> secretdata.gpg'<br>
- except I have no idea [in (Win 10) DOS, not powershell, cmd] how to<br>
get anything into file descriptor 3.<br>
= let alone get an echo into fd 3 (without actually landing on a<br>
filesystem, even temporarily).<br>
<br>
Of course:<br>
'echo "Secret data" | gpg.exe -c --passphrase > secretdata.gpg'<br>
- doesn't work, as stdin can't be 'in two places at once', both<br>
passphrase input, and data input.<br>
= Remember, "Secret data" isn't on disk, either - it's being piped in, too.<br>
<br>
Has anyone got a link to a working example of '3<' or<br>
'PINENTRY_USER_DATA which can fulfill the same task' of gpg picking up<br>
its passphrase from an environment variable?<br>
</blockquote></div>
</body></html>