Comment by hsivonen | Hacker News Reader

Comment by hsivonen | Hacker News Reader

Parent Full thread

Using gpg is not so awesome. Obnam uses gpg. Since Obnam invokes gpg in batch mode, if you want to have a passphrase, you have to use gpg-agent, which at least for me took more effort than I found reasonable to set up on a GUIless server.

Furthermore, all the crypto config depends on gpg defaults or your gpg.conf. Whether this is good or bad depends on whether you are OK with gpg's defaults that are chosen for a non-Obnam use case and whether you like tweaking gpg config.

While figuring this out, I started wishing that Obnam used libsodium instead of gpg to avoid configuration and especially gpg-agent. (libsodium didn't exist when Obnam was created.)

you have to use gpg-agent, which at least for me took more effort than I found reasonable to set up on a GUIless server.

Did you try Keychain¹? I've used it in the past to auto-sign deb packages, and it was simple to set up.

¹ http://www.funtoo.org/Keychain

I didn't.

Having to be aware of tools like this is the problem when you face the requirement of having to set up gpg-agent and you don't already know how to do so in an environment where a desktop environment from your distro hasn't done it for you.

Duplicity allows using gpg in a rather painless way:

  PASSPHRASE="myBackupGpgKeyPassphrase" duplicity ...

I use one gpg key per machine for backups, so having the passphrase in cleartext on that machine is not much of a problem.

Reply on news.ycombinator.com