Fedora
duplicity package

No way to use gpg passphrase-file

Bug #503305 reported by Artur Bodera
30
This bug affects 6 people
Affects Status Importance Assigned to Milestone
Duplicity
Fix Released
Medium
Unassigned
duplicity (Fedora)
New
Undecided
Unassigned

Bug Description

duplicity 0.6.05, Python 2.5.2, linux 2.6.27.38

There is no way to use passphrase file with duplicity, normally available with gpg.

For example this works well:
    cat file | gpg --batch -c --passphrase-file /mysecretkey - | ncftp dst

It is broken in duplicity:
    duplicity --verbosity 9 --gpg-options "passphrase-file=/mysecretkey" /src /dst

Because the key is read from filem, duplicity should not ask for it.
Furthermore, using export PASSPHRASE="" doesn't help.
Duplicity then crashes with:

GPGError: GPG Failed, see log below:
===== Begin GnuPG log =====
usage: gpg [options] [filename]
===== End GnuPG log =====

Dirty workaround:
     export PASSPHRASE="`cat /mysecretkey`"

Possible solution 1 - new param for duplicity:
     --passphrase-file file Read passphrase from file

Possible solution 2 - detect passphrase-file param in gpg-options.

Revision history for this message
edso (ed.so) wrote :

use the --gpg-options parameter e.g. --gpg-options '--passphrase-file /mysecretkey'

.. ede

Revision history for this message
Artur Bodera (abodera) wrote :

As described above, doesn't work.

Revision history for this message
Artur Bodera (abodera) wrote :

I see it now. It's confusion around long,short gnu/non-gnu params and what duplicity expects inside --gpg-options
I've related to it in:
https://bugs.launchpad.net/duplicity/+bug/503309

Revision history for this message
Artur Bodera (abodera) wrote :

Tested the following and none works:
--gpg-options "passphrase-file=file"
--gpg-options "passphrase-file file"
--gpg-options "--passphrase-file=file"
--gpg-options "--passphrase-file file"

It will always result in: PASSPHRASE variable not set, asking user.

Revision history for this message
Aaron Whitehouse (aaron-whitehouse) wrote :

I have the same problem trying to set the passphrase directly in the shell script (I know, it isn't great, but none of these options are).

Neither
--gpg-options "--passphrase='[passphrase]'" nor
--gpg-options "--passphrase [passphrase]"
worked.

Revision history for this message
Aaron Whitehouse (aaron-whitehouse) wrote :

(Note that
export PASSPHRASE="[passphrase]"
did work.)

Revision history for this message
Orair (gustavo-orair) wrote :

In fact, '--passphrase-file [file]' works in any way. Try to specify this option with a non-existing file and duplicity will refuse to work. Then, in any way the file is being read.
But, seems that duplicity may not know about a passphrase being informed by file and demands an input from the user if this not find this in the environment.

Revision history for this message
guttersnipe (fedcba098) wrote :

Hi, what's the status of this being fixed? It's still an issue in July 2018 on CentOS7 running duplicity 0.7.17 from the yum repos.

[root@hetzner2 ~]# duplicity --version
duplicity 0.7.17
[root@hetzner2 ~]# cat /etc/redhat-release
CentOS Linux release 7.4.1708 (Core)
[root@hetzner2 ~]#

Revision history for this message
Kenneth Loafman (kenneth-loafman) wrote :

This will have to be exposed as a duplicity CLI option. It needs to know that the passphrase is coming from a non-interactive source.

Kenneth Loafman (kenneth-loafman)
Changed in duplicity:
status: New → Fix Committed
Revision history for this message
Kenneth Loafman (kenneth-loafman) wrote : Update bug #503305, status medium, importance fixreleased

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

 status medium
 importance fixreleased
 done
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExwf+p6/3mDvUSsaGH1G0ZBEHM/EFAmBl6RsACgkQH1G0ZBEH
M/EqQggAjnLLebeAum0IPZ81A2qZo8Yfqr2wK513CaA7S1u2SxqNoAmywaIGuszg
iFFhK81/QWyPv6JaEQ1JAOLktiT6aMw3JI7Ahxfu/jcWobNMyohM6SWj21lsNUw/
bngvTCgd2DnZHy4HHMTitUmv0W/wWpRacphT0vFm++p5/8H11T7KynELFZJdJcJN
/l/H2yqlDnCOxRWfhi/3Eu2Eq97LL8LsMtw/mT0byUDZ9yIRulYHl/mR6o5vgKED
6G6Hc3Xim80WkDUzRGgiVgUsilF3aS7cjJ7Ve6iqa+1knfrKo7QhXRxzAlAzxZUO
30Ya8IpTKo7w2W5m5cTD7TDdHK1HVA==
=2xP6
-----END PGP SIGNATURE-----

Revision history for this message
Kenneth Loafman (kenneth-loafman) wrote : Update bug #503305, status fixreleased, importance medium

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

 status fixreleased
 importance medium
 done
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExwf+p6/3mDvUSsaGH1G0ZBEHM/EFAmBl6YEACgkQH1G0ZBEH
M/FE6gf+Mutsf3S/4UFe6HXNQAFkHxLOsUDxYZGViB/ZwbeurLyT6qZKwpO9jjx7
X+3dq0PCodbGhSCtzepDoIvcnDqPma2PAgVRuwH6bZLI7EflDjjCKSuGHfG0mdjy
sSe8ck5hyhrBMl4+E5/kRpFNW0AYTXxP7Mz+GJo+homqeUujLDu5Y2DrMot40SbZ
xCUD5ZxuiMIgfOaB9nm9K2XDkuBCfqLD2tUKmj3XhtVWIl4KtA/gYJ0P0M3CceMW
mV7XsE5O0s9a5nxOOnuQ63wV4LRNEit1SzDm0TOYlCnRYEq9tgwVF/ucPVFr4sI+
b7P0jW7LUbGahFRzlj9OtAdce3Ithg==
=VVPc
-----END PGP SIGNATURE-----

Revision history for this message
Kenneth Loafman (kenneth-loafman) wrote :

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

 status fixreleased
 importance medium
 done
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExwf+p6/3mDvUSsaGH1G0ZBEHM/EFAmBl6Y0ACgkQH1G0ZBEH
M/Ec4gf/UgUT5HVs47tcNIGYBBTFMiM64Rocp/+Whh/0cm7b+Ho6QAmIh0Jum8ZA
OSvANNc9zJJfwutCa30uD2XNlU8XwE5R2V7YyNU0GBjHZ8pnDF5TCXyUzs8fqoqU
wVKJ7gWBo1nb8fZBrLef53nsRRlwKw7lJiebuSJL/ezFJV1GefdwfIQgwxHPgR+c
pp+J+MB3R5kOHMcv297PH1j7K9GILS/LfKfXibB0mH7CDpcJ3XXlQg+Bl47vIvpR
7dsgXaDXl2UdUo7RzKb1QGfr7XHFnwFCoRp/AU2uUR+dO+8JEIG/TX4m0WmO7q+a
VFTILBevOnu2FRJ+6Pe06MrUQHtWmw==
=vknR
-----END PGP SIGNATURE-----

Changed in duplicity:
importance: Undecided → Medium
status: Fix Committed → Fix Released
Revision history for this message
Kenneth Loafman (kenneth-loafman) wrote :

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

 status fixreleased
 importance medium
 done
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExwf+p6/3mDvUSsaGH1G0ZBEHM/EFAmBl6icACgkQH1G0ZBEH
M/EnHwf+KL7bJ7R1nPCmwKkon2nPe3+hVMqC1m9F8SHR2jL7r8kLgcdszSfPLHn3
vRyA/A1OhwyGfvB6dfSvW0z6KjXeRUZDsVqpgH9gXW5/aDVLQgzdTM623ia/NCEn
NW3ouQkvY7lmTRBkj9W4YoaFT94zmsaImrg2SeGyKIF/bLF9i8TunwEYMMs7njgd
ZFaavCe+vds7qnIH2ac6neAbmSw0Gr1rBswZXBRY2g9HgfU81VDHrW0tVjfsUVJB
wMkDNGtto0gQeVFPMpQEq/lvCKc0Iy39GTmNKVVkaeQwg3IF/cIdHUbmKwsvqvA2
k9Lqsrw8BDp3VjWbb9MvHBrtUhQG6Q==
=iL25
-----END PGP SIGNATURE-----

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.