Search code examples
gnupgkubernetes-helm

Pass gpg key password when signing a release

I use a gpg key that is secured with a password. Is there a way to pass the password to the underlying gpg command?

helm package --sign \
--key "my_key_name" \
--version "$VERSION" \
--app-version "$APP_VERSION" \
--keyring ~/.gnupg/secring.gpg my-chart

I tried echoing the password and piping it, also tried the yes command, but that does not seem to work.

When I do echo "password" | helm package ... I get Error: inappropriate ioctl for device

Solution

  • According to helm documentation:

    NOTE: If your PGP private key has a passphrase, you will be prompted to enter that passphrase for any commands that support the --sign option. You can set the HELM_KEY_PASSPHRASE environment variable to that passphrase in case you don't want to be prompted to enter the passphrase.

    The final command is:

    export HELM_KEY_PASSPHRASE=<password>
helm package --sign \
--key "my_key_name" \
--version "$VERSION" \
--app-version "$APP_VERSION" \
--keyring ~/.gnupg/secring.gpg my-chart