Emacs & gpg files: use minibuffer for a password prompt
Latest update:
In the past Emacs was communicating w/ gnupg directly & hence was
responsible for reading/sending/catching passwords. In contrast, Emacs
26.1, by default, fully delegates the password handling to gpg2.
The code for the interoperation w/ gpg1 is still present in the Emacs
core, but it's no longer advertised in favour of gpg2 + elpa
pinentry.
If you don't want an additional overhead or a special gpg-agent setup,
it's still possible to use gpg1 for (en|de)crypting ops.
Say we have a text file we want to encrypt & then transparently edit
in Emacs afterwards. The editor should remember the correct pw for the
file & not bother us w/ the pw during the file saving op.
$ rpm -qf `which gpg gpg2`
gnupg-1.4.22-6.fc28.x86_64
gnupg2-2.2.6-1.fc28.x86_64
$ echo rain raine goe away, little Johnny wants to play | gpg -c > nr.gpg
$ file nr.gpg
nr.gpg: GPG symmetrically encrypted data (AES cipher)
If you have both gpg1 & gpg2 installed, Emacs ignores gpg1
completely. E.g., run 'emacs -Q' & open nr.gpg file--gpg2 promptly
contacts gpg-agent, which, in turn, runs the pinentry app:
Although, it may look as if everything is alright, try to edit the
decrypted file & then save it. The pinentry window will reappear &
you'll be forced to enter the pw twice.
The Emacs mode that handles the gnupg dispatch is called EasyPG
Assistant. To check its current state, use epg-find-configuration
fn:
ELISP> (car (epg-find-configuration 'OpenPGP))
(program . "/usr/bin/gpg2")
We can force EasyPG to use gpg1, despite that it's not documented
anywhere.
The actual config data is located in epg-config--program-alist var:
ELISP> epg-config--program-alist
((OpenPGP epg-gpg-program
("gpg2" . "2.1.6")
("gpg" . "1.4.3"))
(CMS epg-gpgsm-program
("gpgsm" . "2.0.4")))
Here, if we shadow the gpg2 entry in the alist, EasyPG would
regenerate a new config for all the (en|de)crypting ops on the fly:
(require 'epg-config)
(add-to-list 'epg-config--program-alist `(OpenPGP epg-gpg-program ("gpg" . ,epg-gpg-minimum-version)))
(setq epa-file-cache-passphrase-for-symmetric-encryption t)
(setq epg--configurations nil)
Now, if you open nr.gpg afresh, Emacs neither should use the
gpg-agent any more:
Nor should it ask for the pw when you'll do edit+save later on.
To clear the internal pw cache, type
ELISP> (setq epa-file-passphrase-alist nil)
Tags: ойті
Authors: ag