1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
|
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xml:lang="en-GB">
<topic id="exporting-seckeys">
<title>Exporting Secret Keys</title>
<body>
<p>Exporting secret keys is, functionally, very similar to exporting public keys; save for the
invocation of <cmdname>pinentry</cmdname> via <cmdname>gpg-agent</cmdname> in order to
securely enter the key's passphrase and authorise the export.</p>
<p>The following example exports the secret key to a file which is then set with the same
permissions as the output files created by the command line secret key export options.</p>
<p>
<codeblock id="export-seckey-01" outputclass="language-python">import gpg
import os
import os.path
import sys
print("""
This script exports one or more secret keys.
The gpg-agent and pinentry are invoked to authorise the export.
""")
c = gpg.Context(armor=True)
if len(sys.argv) >= 4:
keyfile = sys.argv[1]
logrus = sys.argv[2]
homedir = sys.argv[3]
elif len(sys.argv) == 3:
keyfile = sys.argv[1]
logrus = sys.argv[2]
homedir = input("Enter the GPG configuration directory path (optional): ")
elif len(sys.argv) == 2:
keyfile = sys.argv[1]
logrus = input("Enter the UID matching the secret key(s) to export: ")
homedir = input("Enter the GPG configuration directory path (optional): ")
else:
keyfile = input("Enter the path and filename to save the secret key to: ")
logrus = input("Enter the UID matching the secret key(s) to export: ")
homedir = input("Enter the GPG configuration directory path (optional): ")
if homedir.startswith("~"):
if os.path.exists(os.path.expanduser(homedir)) is True:
c.home_dir = os.path.expanduser(homedir)
else:
pass
elif os.path.exists(homedir) is True:
c.home_dir = homedir
else:
pass
try:
result = c.key_export_secret(pattern=logrus)
except:
result = c.key_export_secret(pattern=None)
if result is not None:
with open(keyfile, "wb") as f:
f.write(result)
os.chmod(keyfile, 0o600)
else:
pass
</codeblock>
</p>
<p>Alternatively the approach of the following script can be used. This longer example saves
the exported secret key(s) in files in the GnuPG home directory, in addition to setting the
file permissions as only readable and writable by the user. It also exports the secret
key(s) twice in order to output both GPG binary (<codeph>.gpg</codeph>) and ASCII armoured
(<codeph>.asc</codeph>) files.</p>
<p>
<codeblock id="export-seckey-02" outputclass="language-python">import gpg
import os
import os.path
import subprocess
import sys
print("""
This script exports one or more secret keys as both ASCII armored and binary
file formats, saved in files within the user's GPG home directory.
The gpg-agent and pinentry are invoked to authorise the export.
""")
if sys.platform == "win32":
gpgconfcmd = "gpgconf.exe --list-dirs homedir"
else:
gpgconfcmd = "gpgconf --list-dirs homedir"
a = gpg.Context(armor=True)
b = gpg.Context()
c = gpg.Context()
if len(sys.argv) >= 4:
keyfile = sys.argv[1]
logrus = sys.argv[2]
homedir = sys.argv[3]
elif len(sys.argv) == 3:
keyfile = sys.argv[1]
logrus = sys.argv[2]
homedir = input("Enter the GPG configuration directory path (optional): ")
elif len(sys.argv) == 2:
keyfile = sys.argv[1]
logrus = input("Enter the UID matching the secret key(s) to export: ")
homedir = input("Enter the GPG configuration directory path (optional): ")
else:
keyfile = input("Enter the filename to save the secret key to: ")
logrus = input("Enter the UID matching the secret key(s) to export: ")
homedir = input("Enter the GPG configuration directory path (optional): ")
if homedir.startswith("~"):
if os.path.exists(os.path.expanduser(homedir)) is True:
c.home_dir = os.path.expanduser(homedir)
else:
pass
elif os.path.exists(homedir) is True:
c.home_dir = homedir
else:
pass
if c.home_dir is not None:
if c.home_dir.endswith("/"):
gpgfile = "{0}{1}.gpg".format(c.home_dir, keyfile)
ascfile = "{0}{1}.asc".format(c.home_dir, keyfile)
else:
gpgfile = "{0}/{1}.gpg".format(c.home_dir, keyfile)
ascfile = "{0}/{1}.asc".format(c.home_dir, keyfile)
else:
if os.path.exists(os.environ["GNUPGHOME"]) is True:
hd = os.environ["GNUPGHOME"]
else:
hd = subprocess.getoutput(gpgconfcmd)
gpgfile = "{0}/{1}.gpg".format(hd, keyfile)
ascfile = "{0}/{1}.asc".format(hd, keyfile)
try:
a_result = a.key_export_secret(pattern=logrus)
b_result = b.key_export_secret(pattern=logrus)
except:
a_result = a.key_export_secret(pattern=None)
b_result = b.key_export_secret(pattern=None)
if a_result is not None:
with open(ascfile, "wb") as f:
f.write(a_result)
os.chmod(ascfile, 0o600)
else:
pass
if b_result is not None:
with open(gpgfile, "wb") as f:
f.write(b_result)
os.chmod(gpgfile, 0o600)
else:
pass
</codeblock>
</p>
<p/>
</body>
</topic>
</dita>
|
