In Magit commits are created using the committing popup (c). That popup would therefore be a good place to start looking for gpg support. If you do that, then you will find this:
=S Sign using gpg (--gpg-sign=)
So type = S and the select a key. To avoid having to do that every time you create a commit you can save the value of that argument (and all other ...
You also have to
Explicitely enable loopback mode for pinentry in your
Configure epa to use loopback for pinentry.
Start the pinentry server in emacs,
1. Enable Emacs pinentry and loopback mode for gpg-agent
Put this in your ~/.gnupg/gpg-agent.conf:
Then tell gpg-agent to load this ...
You do not say which OS nor version of emacs you have.
I solved yesterday exactly the same problem in OSX and emacs 25.1 using information from this link: http://colinxy.github.io/software-installation/2016/09/24/emacs25-easypg-issue.html
I ran these commands:
brew unlink gnupg2 gpg-agent dirmngr
brew uninstall gnupg2 gpg-agent dirmngr
brew install ...
Encryption using password + key
This does not save the password directly in the file but does something similar without any security risk and helps you achieve what you want.
You need to use asymmetric encryption so that your password is associated with an email ID in a keyring.
Save the below at the top of your .gpg file
-*- epa-file-encrypt-to: ("...
Took quite a bit of trial and error, but here was the eventual solution:
Create .authinfo.gpg file in a directory of your choice
Add the following to the .authinfo.gpg file (for IRC login)
machine irc.freenode.net login <your-irc-nick> port nickserv password <your-irc-pw>
Add the following to your emacs .init file
Set the dir where .authinfo....
# -*- mode:org; epa-file-encrypt-to: ("arthur@ul___dt.com", "firstname.lastname@example.org") -*-
When a mail address is associated to several keys switch to the key ids. E.g. a call to epa-file-select-keys reveals key ids. The header line with fake key ids looks like:
# -*- mode:org; epa-file-encrypt-to: ("12345678ABCDEF00", "12345678ABCDEF01") -*-
I have not found a ...
Have you tried installing gpg version greater than 2.1, and then (setq epa-pinentry-mode 'loopback)? This should prompt for the password in the minibuffer.
epa-pinentry-mode has been marked obsolete from Emacs 27. Use epg-pinentry-mode instead.
I had this problem and got it to work. Needed to spelunk through the code in epg.el and epg-config.el to determine what to fiddle with. This is what worked for me:
In this documentation, the options you might be interested in
Set the time a cache entry is valid to n seconds. The default is 600 seconds. Each time a cache entry is accessed, the entry’s timer is reset. To set an entry’s maximum lifetime, use max-cache-...
The prompt I see without any configuration is:
Password for 'https://email@example.com':
this corresponds to the used remote url:
I then added an entry like this:
machine firstname.lastname@example.org password 12345
and added the function to the hook:
I cannot comment on Emacs 24, but here's how I solved this for Emacs 25:
By default epa in Emacs 25 uses gpg2 (GnuPG 2.x). According to the Epa manual, caching with gpg2 requires gpg-agent.
For some reason, I had to enable pinentry in the minibuffer, see: Enabling minibuffer pinentry with Emacs 25 and GnuPG 2.1 on Ubuntu Xenial
The documentation string ...
I am moving my comment to an answer explaining how pinentry-emacs works because of formatting
pinentry-emacs stops the window from popping up that asks for your password and insteads asks for your password through the minibuffer.
It is super poorly documented and took me a bit of time to set up. From what I can tell I placed
The following will prevent messages to email addresses in
blacklist-addresses from invoking mml-secure-message-sign.
(defvar blacklist-addresses nil
"List of email addresses (as strings) to blacklist for
(defun secure-sign-maybe ()
"Use `mml-secure-message-sign' unless the addressee is in the
I've just added --gpg-sign to the revert popup.
Since it sounds like you are signing all commits anyway, you might also just set the Git variable commit.gpgSign.
And you can always add your own actions and arguments to a popup. In this case this would have worked:
?S "Sign using gpg" "--gpg-sign=" 'magit-...
How can you be sure that GNOME is not caching the passphrase? If you are starting emacs in non-terminal mode, and if it is not asking for passphrase, you must have checked the option for "Automatically unlock whenever I am logged in".
You can start seahorse from the GNOME search bar or from the terminal and go to your Gnome2 Key Storage and search for gpg2 ...
From the commentary at the beginning of org-crypt.el:
;; 4. To automatically encrypt all necessary entries when saving a
;; file, call `org-crypt-use-before-save-magic' after loading
So add to your init.el something like:
(add-hook 'before-save-hook #'org-crypt-use-before-save-...
Pinentry is only an interface, it doesn't keep any passphrase or permission, and neither does Emacs. It's GPG-agent that manages the ropes. For example, if the time expires or the process dies, you'll have to authenticate again. So just kill the agent:
gpgconf --kill gpg-agent
More info at the gnupg manual.
GPG is just an implementation of the PGP encryption standard, you can read more about it here; gpg keys can be a real pain, particularly on Windows, maybe try downloading the key and then using M-x package-import-keyring from within emacs to load the key manually?
I encountered this issue. I solved it using the following steps in order:
Make sure that the folder c:/Progra~2/GnuPG/bin is on your path before any other installed versions of the GnuPG executables (in my case, I had it installed via msys2).
Note that Progra~2 expands to "Program Files (x86)" on my system (I am using the 64 bit version ...
For gpg version < 2, caching can be from emacs or the gpg-agent
To disable caching from emacs, set epa-file-cache-passphrase-for-symmetric-encryption to nil if it is not nil in emacs config file
(setq epa-file-cache-passphrase-for-symmetric-encryption nil)
To disable caching by gpg-agent, add
default-cache-ttl 0 to gpg config file located at ~/.gnupg/...
You can create your own command to set all variables before starting ERC:
(defun my/erc-freenode ()
(let ((erc-plist (car (auth-source-search :host "irc.freenode.net")))
(setq erc-server "irc.freenode.net")
(setq erc-nick (plist-get erc-plist :user))
(setq erc-password (funcall (plist-get ...
org-crypt-key is the GPG key identifier, normally an email address.
Your GPG secret key resides in the secret ring in your .gnupg directory, and is protected by your passphrase.
From the source code comments:
;; 2. Set the encryption key to use in the `org-crypt-key' variable,
;; or use `M-x org-set-property' to set the property CRYPTKEY to
;; any ...
From GnuPG 2.1 two software should be used: gpg-agent and pinentry.
Update the files as follows:
$ echo 'allow-loopback-pinentry' >> ~/.gnupg/gpg-agent.conf
$ echo 'pinentry-mode loopback' >> ~/.gnupg/gpg.conf
$ gpgconf --kill gpg-agent
It worked for me on Emacs24 / FreeBsd11, but it should work on GNU / Linux as well.
Though having not found how to defer the password request, I have learned a lot about desktops.
So to exclude gpg-files from desktop-save there is the variable desktop-files-not-to-save that is documented
Regexp identifying files whose buffers are to be excluded from saving.
The default value as shown in the customize buffer
When you open a encrypted file, Emacs automatically replaces the contents of it's buffer with a decrypted version of it. Though doc-view, and for that matter pdf-view as well, does not care for the actual buffer content, but rather uses the buffer's file-name with various programs, in your case ghostscript, in order to produce images of the PDF pages. ...
Not really an Emacs related problem but, one of the solution could be:
create a SUM of your .org file,
then create an encrypted signature of the SUM file, named SUM.sign,
and finally, share the 3 files whenever necessary
That way, your .org file will stay the same.