Sops: Support encrypted GPG private key in CLI environment

[max-wittig]

Maybe I missed something, but currently there seem to be no way for sops to decrypt secrets in an environment, where no X-Server is present, if the GPG private key is encrypted.

This certainly works like expected in a GUI enviroment, where /usr/bin/pinentry-gnome3 or similar programs can handle the GPG passphrase dialog. In a non-gui environment (CI), sops might need to call the gpg command with --pinentry-mode loopback for it to accept input via STDIN.

I think that this should work:

echo "{GPG_PASSPHRASE}" | sops -d values-prod-enc.yaml

[autrilla]

SOPS will use the Go openpgp package if it can, and will prompt for the key's passphrase on stdin. However, if for some reason it can't use the openpgp package (e.g. you use a GPG2 keyring, or have a smart card stub in your keyring), it will fall back to calling the GPG binary, and use whatever pinentry you configure GPG to use.

It seems that in your case it's falling back to the GPG binary. I recommend using gpg-agent and unlocking the key with it before calling sops. You can also probably configure your GPG binary to take pinentry input from the same tty GPG is running on.

[max-wittig]

@autrilla Thanks for your response.

For other people, who also encounter this issue. I've solved it like this

echo "${GPG_PASSPHRASE}" | gpg2 --batch --import key.asc
echo "${GPG_PASSPHRASE}" > key.txt
touch dummy.txt
gpg --batch --yes --passphrase-file key.txt --pinentry-mode=loopback -s dummy.txt # sign dummy file to unlock agent
# Decrypt secret
sops -d values-dev-enc.yaml > values-dev.yaml

[giannisbetas]

I had the same issue MACOS Mojave.

sops --version
sops 3.3.1 (latest)

gpg --version
gpg (GnuPG) 2.2.17
libgcrypt 1.8.4

Problem got solved after installing gpg-suite and running gpg-agent.
brew cask install gpg-suite