From 6a251287916a8b5a18a54b24bdcff2174574d8f6 Mon Sep 17 00:00:00 2001 From: Stefan Berger Date: Wed, 31 Jul 2019 12:31:16 -0400 Subject: [PATCH] gpg: Pass the passphrase to the gpg2 tool using a file Rather than passing the passphrase via command line write it into a temp. file and pass the name of the file using passphrase-file option. Signed-off-by: Stefan Berger --- pkg/encryption/gpg.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/pkg/encryption/gpg.go b/pkg/encryption/gpg.go index b525d35bc..88be15e52 100644 --- a/pkg/encryption/gpg.go +++ b/pkg/encryption/gpg.go @@ -131,7 +131,16 @@ func (gc *gpgv2Client) GetGPGPrivateKey(keyid uint64, passphrase string) ([]byte args = append(args, []string{"--homedir", gc.gpgHomeDir}...) } - args = append(args, []string{"--pinentry-mode", "loopback", "--batch", "--passphrase", passphrase, "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...) + tempfile, err := ioutil.TempFile("", "gpg2*") + if err != nil { + return nil, errors.Wrapf(err, "could not create temporary file") + } + defer os.Remove(tempfile.Name()) + if err := ioutil.WriteFile(tempfile.Name(), []byte(passphrase), 0600); err != nil { + return nil, errors.Wrapf(err, "could not write to temporary file") + } + + args = append(args, []string{"--pinentry-mode", "loopback", "--batch", "--passphrase-file", tempfile.Name(), "--export-secret-key", fmt.Sprintf("0x%x", keyid)}...) cmd := exec.Command("gpg2", args...)