how to pass key password to password prompt with gpg2

22 Views Asked by At

We were initially using following code to sign gpg packages with gpg v1.41.x.

def RunSubprocessWithPexpect(cmd, passphrase, prompt_passphrase, prompt_succeeded, prompt_failed):
errmsg = None
answers = []
answer = None
if passphrase is None:
  errmsg = "The passphrase is null. Skipping the execution of the signing command."
  return errmsg

try:
    with pexpect.spawn(cmd[0], cmd[1:], timeout=600) as child:
        logging.debug(' '.join(cmd))

        child.expect(prompt_passphrase)
        child.sendline(passphrase)

        answers = [prompt_succeeded, prompt_failed, pexpect.EOF, pexpect.TIMEOUT]
        answer = child.expect(answers[:2])

        child.expect(pexpect.EOF)
        child.close()  # Close the child process
        if child.exitstatus == 0 and answer == 0:
            logging.debug("Command succeeded")
        else:
            logging.error("Command failed: %s" % ' '.join(cmd))
            logging.error("\tanswer='%s', status='%d', output='%s'" %
                  (answers[answer], child.status, child.before))
            errmsg = 'An unexpected error occurred: ' + str(answers[answer])

except (pexpect.EOF, pexpect.TIMEOUT) as e:
    logging.exception("Command failed: %s" % ' '.join(cmd))
    errmsg = 'An unexpected error occurred: ' + str(e)
return errmsg

This was working fine earlier as we were getting following Password prompt on CLI:

"Enter passphrase:" 

and the pexpect library use to pass the password and signing used to succeed.

But now we are upgrading gpg from version 1.41.x to 2.x and so a lot of things have changed...

With gpg2, we can password prompt in some king of GUI instead of cli... so I tried passing --batch --passphrase-fd 0 to the command:

/bin/gpg2 --batch --passphrase-fd 0 -sa --homedir /build/mts/apps/signing/signserver/key/test/test_gpg_AAAAAAA --default-key AAAAAAA --no-random-seed-file --lock-never --y --verbose --detach-sign --digest-algo SHA1 --output /tmp/hello_2.10-2ubuntu2_amd64.deb.sig /build/apps/signing/signserver/test/test_signserver/files/hello_2.10-2ubuntu2_amd64.deb

This prompts output without any text... (no password prompt but just will wait for password in new line and press enter).

This existing code now fails with following error:

Traceback (most recent call last):
  File "/build/toolchain/noarch/pexpect-4.0.1/lib/python3.3/site-packages/pexpect/spawnbase.py", line 144, in read_nonblocking
    s = os.read(self.child_fd, size)
OSError: [Errno 5] Input/output error

During handling of the above exception, another exception occurred:

Can anyone please help how to handle this case?

0

There are 0 best solutions below