5

I'm using dpkg-buildpackage and I would like to fully automate my scripts, but I cannot find how to GPG sign the packages and automate entering the pass phrases in my Continuous Integration System. I don't want to use the '-us -uc' parameters, because I do want to sign them.

Any ideas?

Improve this question
1
  • Maybe a solution using debsign, see this answer
    – Raffi
    Aug 24, 2015 at 20:04

5 Answers 5

Reset to default
1

If your keyring is already unlocked, all you have to do is:

setup gpg-agent

So you won't be prompted for your passphrase a whole bunch of times...

sudo aptitude install gnupg-agent pinentry-gtk2 pinentry-curses
replace 0xD34DB33F with your GPG Key ID
export GPGKEY=0xD34DB33F
killall -q gpg-agent
eval $(gpg-agent --daemon)

and

export DEBEMAIL="[email protected]"
export DEBFULLNAME="Your full name as it appears on the GPG key"

from here

I can attest to the second part. The first part is a copy-paste, but it seems legitimate. I would think you would still have to unlock the key once, but it would stay unlocked.

Improve this answer
1
  • How to make it persistent? The agent asks on every build.
    – Velkan
    Apr 29, 2015 at 7:02
1

Comment out:

use-agent

in ~/.gnupg/gpg.conf . And

dpkg-buildpackage -p'gpg --no-tty --passphrase <passphrase>'

or

dpkg-buildpackage -p'gpg --no-tty --passphrase-file <passphrase file>'

Edit:

WARNING: serious security Risk!
Everyone able to access such a script can distribute malicious software in your name

Improve this answer
2
  • This should be the accepted answer, since it precisely resolves the given problem.
    – Ichthyo
    Sep 17, 2022 at 13:45
  • However: placing your private key's password into any kind of file is risky and weakens the chain of trust for package distribution. When attackers get access to this script or even just your command history, they can inject malicious code and get it distributed to many users without further interaction, since users trust your signature
    – Ichthyo
    Sep 17, 2022 at 13:48
0

gpg-agent method does not avoid asking passphrase to be entered with keyboard. I've seen Freight uses

gpg --batch --passphrase-fd ...
Improve this answer
0

I'm not very experienced in this but I would suggest:

  1. Create new user account
  2. Create an unlocked key for it
  3. Use that user only for building packages or may be just signing using debsign to keep that account safe from build process and scripts.

That if you really trust safety of the machine. Anyway, you were already going to store an unsafe password in a command for unlocking.

Improve this answer
1
  • 1
    A variation of this scheme is basically what the Ubuntu-PPA-Builder does: you sign the source package regularly with your key, and setup the automated builder for binary packages such as to trust only your signing key and then sign the packages with another dedicated key, which is then published for your users. However, still very dangerous must keep your build machine very safe
    – Ichthyo
    Sep 17, 2022 at 16:55
0

Seed password once into gpg-agent

In addition to the other methods already mentioned here, it is possible to seed your gpg-agent with a passphrase; you may build that into a startup script, and require manual intervention once, when your build machine starts up. Such a setup is slightly more secure, since the passphrase only resides in memory. However, an attacker able to read memory contents could still steal your passphrase and then distribute malicious software in your name

  1. fist stop an existing agent

    gpgconf --kill gpg-agent

  2. then start a new instance and allow to inject the passphrase; moreover, we can increase the time-to-live here

    gpg-agent --default-cache-ttl 3600 --max-cache-ttl 86400 --allow-preset-passphrase --daemon

  3. inject the passphrase of your signing subkey — You will be prompted to enter the passphrase when this command runs.

    /usr/lib/gnupg/gpg-preset-passphrase --preset <keygrip>

For this to work, you need the "keygrip" of your signing subkey (not the master key!). Use gpg to find out that information

gpg --with-keygrip --list-secret-key <YourUserID>

The signing subkey is listed below the master key and the Email addresses, it is typically marked as ssb and [S] or [SA]

Hints

  • sometimes you need to export GPG_TTY=$(tty) for the pinentry to work

  • you may start a sub-shell from the gpg-agent

    gpg-agent [..further.options..] --daemon /bin/bash

    this way, the agent exits when the sub-shell exits and any password you set in the sub-shell is gone afterwards.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .