0

I'm trying to sign yum repo metadata using GPG, as part of a Jenkins job. This is proving more difficult than I first imagined, but I'm sure lots of people must have done this already.

I've worked out that I can do it on the terminal using :-

gpg --detach-sign --armor --local-user "Our Team" repomd.xml

However this pops up a curses style window which asks for the key, and I'd like to automate this as part of the Jenkins job. I used expect for signing the actual RPMs, and that worked well but I don't think I can do that with this gpg / curses method. Is there a way to tell gpg to just accept input from the keyboard and not pop up a text entry box? (I've been reading the man page, but it's really massive and I'm getting stuck).

Will keep trying, but hopefully someone has already solved this?

  • 1
    If you want to do the signing in a Jenkins job, you probably don't want to have it prompt at all. Remove the passphrase from the key, or feed the passphrase in via an fd. – womble Aug 21 '18 at 10:58
  • We need a passphrase to protect the key just in case someone gets hold of it. I was planning to get people to enter the passphrase as part of running the Jenkins job (and hiding it). Ideally we'd use Vault or similar, but we don't have that. – Steve Button Aug 22 '18 at 7:43
0

The man page gives you several options for passing in the passphrase:

       --passphrase-fd n
              Read  the passphrase from file descriptor n. Only the first line
              will be read from file descriptor n. If you use  0  for  n,  the
              passphrase  will  be  read  from STDIN. This can only be used if
              only one passphrase is supplied.

       --passphrase-file file
              Read the passphrase from file file. Only the first line will  be
              read  from  file  file.  This  can  only  be  used  if  only one
              passphrase is supplied. Obviously, a passphrase stored in a file
              is  of  questionable security if other users can read this file.
              Don't use this option if you can avoid it.

       --passphrase string
              Use string as the passphrase. This can only be used if only  one
              passphrase  is supplied. Obviously, this is of very questionable
              security on a multi-user system. Don't use this  option  if  you
              can avoid it.

I'm not sure why you mention accepting the passphrase from the keyboard when you want to automate signing packages. Nobody will be around, and there won't be any keyboard. Your best bet is probably to use --passphrase-fd and pass the passphrase in via a file descriptor, as womble mentioned in his comment.

  • I mentioned keyboard, because I'm trying to test it on a terminal before I add it to the Jenkins job (could be any background job). I tried that, using :- echo "correct horse staple battery" | gpg --detach-sign --armor --local-user "My user" --passphrase-fd 0 repomd.xml` but it still pops up with the text box in the middle of the screen. – Steve Button Aug 22 '18 at 7:40
  • Reading my main page, it states ` Note that this passphrase is only used if the option --batch has also been given` so that's fixed It. Thanks! Sorry I don't have enough reputation to upvote the answer to my own question, otherwise I would. – Steve Button Aug 22 '18 at 7:50
  • That's strange, I just went through the man page again and I can't find anything about requiring --batch to read the passphrase from other than the terminal. – Michael Hampton Aug 22 '18 at 12:41
  • --passphrase-fd n Read the passphrase from file descriptor n. Only the first line will be read from file descriptor n. If you use 0 for n, the passphrase will be read from STDIN. This can only be used if only one passphrase is supplied. Note that this passphrase is only used if the option --batch has also been given. This is different from gpg. This is from the gpg manpage on Oracle Linux 6.7 (Red Hat) which when you type man gpg says gpg2 man page. – Steve Button Aug 23 '18 at 14:35
  • @SteveButton Ah, you are using an ancient gpg. That explains it. – Michael Hampton Aug 23 '18 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.