No way to use gpg passphrase-file

[Artur Bodera]

duplicity 0.6.05, Python 2.5.2, linux 2.6.27.38

There is no way to use passphrase file with duplicity, normally available with gpg.

For example this works well:
    cat file | gpg --batch -c --passphrase-file /mysecretkey - | ncftp dst

It is broken in duplicity:
    duplicity --verbosity 9 --gpg-options "passphrase-file=/mysecretkey" /src /dst

Because the key is read from filem, duplicity should not ask for it.
Furthermore, using export PASSPHRASE="" doesn't help.
Duplicity then crashes with:

GPGError: GPG Failed, see log below:
===== Begin GnuPG log =====
usage: gpg [options] [filename]
===== End GnuPG log =====

Dirty workaround:
     export PASSPHRASE="`cat /mysecretkey`"

Possible solution 1 - new param for duplicity:
     --passphrase-file file Read passphrase from file

Possible solution 2 - detect passphrase-file param in gpg-options.

[edso (ed.so)]

use the --gpg-options parameter e.g. --gpg-options '--passphrase-file /mysecretkey'

.. ede

[Artur Bodera (abodera)]

As described above, doesn't work.

[Artur Bodera (abodera)]

I see it now. It's confusion around long,short gnu/non-gnu params and what duplicity expects inside --gpg-options
I've related to it in:
https://bugs.launchpad.net/duplicity/+bug/503309

[Artur Bodera (abodera)]

Tested the following and none works:
--gpg-options "passphrase-file=file"
--gpg-options "passphrase-file file"
--gpg-options "--passphrase-file=file"
--gpg-options "--passphrase-file file"

It will always result in: PASSPHRASE variable not set, asking user.

[Aaron Whitehouse (aaron-whitehouse)]

I have the same problem trying to set the passphrase directly in the shell script (I know, it isn't great, but none of these options are).

Neither
--gpg-options "--passphrase='[passphrase]'" nor
--gpg-options "--passphrase [passphrase]"
worked.

[Aaron Whitehouse (aaron-whitehouse)]

(Note that
export PASSPHRASE="[passphrase]"
did work.)

[Orair (gustavo-orair)]

In fact, '--passphrase-file [file]' works in any way. Try to specify this option with a non-existing file and duplicity will refuse to work. Then, in any way the file is being read.
But, seems that duplicity may not know about a passphrase being informed by file and demands an input from the user if this not find this in the environment.

[guttersnipe (fedcba098)]

Hi, what's the status of this being fixed? It's still an issue in July 2018 on CentOS7 running duplicity 0.7.17 from the yum repos.

[root@hetzner2 ~]# duplicity --version
duplicity 0.7.17
[root@hetzner2 ~]# cat /etc/redhat-release
CentOS Linux release 7.4.1708 (Core)
[root@hetzner2 ~]#

[Kenneth Loafman (kenneth-loafman)]

This will have to be exposed as a duplicity CLI option. It needs to know that the passphrase is coming from a non-interactive source.

[Kenneth Loafman (kenneth-loafman)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

 status medium
 importance fixreleased
 done
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExwf+p6/3mDvUSsaGH1G0ZBEHM/EFAmBl6RsACgkQH1G0ZBEH
M/EqQggAjnLLebeAum0IPZ81A2qZo8Yfqr2wK513CaA7S1u2SxqNoAmywaIGuszg
iFFhK81/QWyPv6JaEQ1JAOLktiT6aMw3JI7Ahxfu/jcWobNMyohM6SWj21lsNUw/
bngvTCgd2DnZHy4HHMTitUmv0W/wWpRacphT0vFm++p5/8H11T7KynELFZJdJcJN
/l/H2yqlDnCOxRWfhi/3Eu2Eq97LL8LsMtw/mT0byUDZ9yIRulYHl/mR6o5vgKED
6G6Hc3Xim80WkDUzRGgiVgUsilF3aS7cjJ7Ve6iqa+1knfrKo7QhXRxzAlAzxZUO
30Ya8IpTKo7w2W5m5cTD7TDdHK1HVA==
=2xP6
-----END PGP SIGNATURE-----

[Kenneth Loafman (kenneth-loafman)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

 status fixreleased
 importance medium
 done
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExwf+p6/3mDvUSsaGH1G0ZBEHM/EFAmBl6YEACgkQH1G0ZBEH
M/FE6gf+Mutsf3S/4UFe6HXNQAFkHxLOsUDxYZGViB/ZwbeurLyT6qZKwpO9jjx7
X+3dq0PCodbGhSCtzepDoIvcnDqPma2PAgVRuwH6bZLI7EflDjjCKSuGHfG0mdjy
sSe8ck5hyhrBMl4+E5/kRpFNW0AYTXxP7Mz+GJo+homqeUujLDu5Y2DrMot40SbZ
xCUD5ZxuiMIgfOaB9nm9K2XDkuBCfqLD2tUKmj3XhtVWIl4KtA/gYJ0P0M3CceMW
mV7XsE5O0s9a5nxOOnuQ63wV4LRNEit1SzDm0TOYlCnRYEq9tgwVF/ucPVFr4sI+
b7P0jW7LUbGahFRzlj9OtAdce3Ithg==
=VVPc
-----END PGP SIGNATURE-----

[Kenneth Loafman (kenneth-loafman)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

 status fixreleased
 importance medium
 done
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExwf+p6/3mDvUSsaGH1G0ZBEHM/EFAmBl6Y0ACgkQH1G0ZBEH
M/Ec4gf/UgUT5HVs47tcNIGYBBTFMiM64Rocp/+Whh/0cm7b+Ho6QAmIh0Jum8ZA
OSvANNc9zJJfwutCa30uD2XNlU8XwE5R2V7YyNU0GBjHZ8pnDF5TCXyUzs8fqoqU
wVKJ7gWBo1nb8fZBrLef53nsRRlwKw7lJiebuSJL/ezFJV1GefdwfIQgwxHPgR+c
pp+J+MB3R5kOHMcv297PH1j7K9GILS/LfKfXibB0mH7CDpcJ3XXlQg+Bl47vIvpR
7dsgXaDXl2UdUo7RzKb1QGfr7XHFnwFCoRp/AU2uUR+dO+8JEIG/TX4m0WmO7q+a
VFTILBevOnu2FRJ+6Pe06MrUQHtWmw==
=vknR
-----END PGP SIGNATURE-----

[Kenneth Loafman (kenneth-loafman)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

 status fixreleased
 importance medium
 done
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExwf+p6/3mDvUSsaGH1G0ZBEHM/EFAmBl6icACgkQH1G0ZBEH
M/EnHwf+KL7bJ7R1nPCmwKkon2nPe3+hVMqC1m9F8SHR2jL7r8kLgcdszSfPLHn3
vRyA/A1OhwyGfvB6dfSvW0z6KjXeRUZDsVqpgH9gXW5/aDVLQgzdTM623ia/NCEn
NW3ouQkvY7lmTRBkj9W4YoaFT94zmsaImrg2SeGyKIF/bLF9i8TunwEYMMs7njgd
ZFaavCe+vds7qnIH2ac6neAbmSw0Gr1rBswZXBRY2g9HgfU81VDHrW0tVjfsUVJB
wMkDNGtto0gQeVFPMpQEq/lvCKc0Iy39GTmNKVVkaeQwg3IF/cIdHUbmKwsvqvA2
k9Lqsrw8BDp3VjWbb9MvHBrtUhQG6Q==
=iL25
-----END PGP SIGNATURE-----