gpg 解密-禁用交互式密码输入

背景描述

• gpg 解密默认弹出如下窗口，请用户输入密码，但在脚本自动化时遇到了问题

    lqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqk
    x Enter passphrase                                    x
    x                                                     x
    x                                                     x
    x Passphrase ________________________________________ x
    x                                                     x
    x       <OK>                             <Cancel>     x
    mqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqj

• gpg 版本2.0.22

    [root@localhost decode_tools]# gpg --version
    gpg (GnuPG) 2.0.22
    libgcrypt 1.5.3
    Copyright (C) 2013 Free Software Foundation, Inc.
    License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
    This is free software: you are free to change and redistribute it.
    There is NO WARRANTY, to the extent permitted by law.
    
    Home: ~/.gnupg
    Supported algorithms:
    Pubkey: RSA, ?, ?, ELG, DSA
    Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
            CAMELLIA128, CAMELLIA192, CAMELLIA256
    Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
    Compression: Uncompressed, ZIP, ZLIB, BZIP2

• gpg 的帮助信息没有给出明显的提示信息

    Syntax: gpg [options] [files]
    Sign, check, encrypt or decrypt
    Default operation depends on the input data
    
    Commands:
    
     -s, --sign                 make a signature
         --clearsign            make a clear text signature
     -b, --detach-sign          make a detached signature
     -e, --encrypt              encrypt data
     -c, --symmetric            encryption only with symmetric cipher
     -d, --decrypt              decrypt data (default)
         --verify               verify a signature
     -k, --list-keys            list keys
         --list-sigs            list keys and signatures
         --check-sigs           list and check key signatures
         --fingerprint          list keys and fingerprints
     -K, --list-secret-keys     list secret keys
         --gen-key              generate a new key pair
         --gen-revoke           generate a revocation certificate
         --delete-keys          remove keys from the public keyring
         --delete-secret-keys   remove keys from the secret keyring
         --sign-key             sign a key
         --lsign-key            sign a key locally
         --edit-key             sign or edit a key
         --passwd               change a passphrase
         --export               export keys
         --send-keys            export keys to a key server
         --recv-keys            import keys from a key server
         --search-keys          search for keys on a key server
         --refresh-keys         update all keys from a keyserver
         --import               import/merge keys
         --card-status          print the card status
         --card-edit            change data on a card
         --change-pin           change a card's PIN
         --update-trustdb       update the trust database
         --print-md             print message digests
         --server               run in server mode
    
    Options:
    
     -a, --armor                create ascii armored output
     -r, --recipient USER-ID    encrypt for USER-ID
     -u, --local-user USER-ID   use USER-ID to sign or decrypt
     -z N                       set compress level to N (0 disables)
         --textmode             use canonical text mode
     -o, --output FILE          write output to FILE
     -v, --verbose              verbose
     -n, --dry-run              do not make any changes
     -i, --interactive          prompt before overwriting
         --openpgp              use strict OpenPGP behavior
    
    (See the man page for a complete listing of all commands and options)
    
    Examples:
    
     -se -r Bob [file]          sign and encrypt for user Bob
     --clearsign [file]         make a clear text signature
     --detach-sign [file]       make a detached signature
     --list-keys [names]        show keys
     --fingerprint [names]      show fingerprints
    
    Please report bugs to <http://bugs.gnupg.org>.

验证后三种解决方法

• gpg 直接输入密码：

      gpg --batch --passphrase suanec groups.tgz.gpg

• 通过管道符 + gpg 文件描述符 间接输入密码

      # 这里--passphrase-fd  表示从哪个fd中读取信息，cat输出到标准输出，所以此处写0。
      cat conf/password | gpg --batch --passphrase-fd 0 groups.tgz.gpg

• 通过配置文件，gpg直接读取密码

      # 笔者使用的当前方式。
      gpg --batch --passphrase-file ./conf/password groups.tgz.gpg

注意

• gpg 1.x版本和gpg 2.x 版本有些许调整，需要--batch参数禁用交互式操作。

      Update 2017-12-04。（添加--batch以防止出现密码提示）

      您可能需要添加--batch选项：
      从的版本2开始GPG，--batch需要使用该选项以确保没有提示...