In Magit commits are created using the committing popup (c). That popup would therefore be a good place to start looking for gpg support. If you do that, then you will find this:
=S Sign using gpg (--gpg-sign=)
So type = S and the select a key. To avoid having to do that every time you create a commit you can save the value of that argument (and all other ...
You also have to
Explicitely enable loopback mode for pinentry in your
Configure epa to use loopback for pinentry.
Start the pinentry server in emacs,
1. Enable Emacs pinentry and loopback mode for gpg-agent
Put this in your ~/.gnupg/gpg-agent.conf:
Then tell gpg-agent to load this configuration ...
You do not say which OS nor version of emacs you have.
I solved yesterday exactly the same problem in OSX and emacs 25.1 using information from this link: http://colinxy.github.io/software-installation/2016/09/24/emacs25-easypg-issue.html
I ran these commands:
brew unlink gnupg2 gpg-agent dirmngr
brew uninstall gnupg2 gpg-agent dirmngr
brew install ...
Encryption using password + key
This does not save the password directly in the file but does something similar without any security risk and helps you achieve what you want.
You need to use asymmetric encryption so that your password is associated with an email ID in a keyring.
Save the below at the top of your .gpg file
-*- epa-file-encrypt-to: ("...
Pinentry is only an interface, it doesn't keep any passphrase or permission, and neither does Emacs. It's GPG-agent that manages the ropes. For example, if the time expires or the process dies, you'll have to authenticate again. So just kill the agent:
gpgconf --kill gpg-agent
More info at the gnupg manual.
Took quite a bit of trial and error, but here was the eventual solution:
Create .authinfo.gpg file in a directory of your choice
Add the following to the .authinfo.gpg file (for IRC login)
machine irc.freenode.net login <your-irc-nick> port nickserv password <your-irc-pw>
Add the following to your emacs .init file
Set the dir where .authinfo....
Have you tried installing gpg version greater than 2.1, and then (setq epa-pinentry-mode 'loopback)? This should prompt for the password in the minibuffer.
epa-pinentry-mode has been marked obsolete from Emacs 27. Use epg-pinentry-mode instead.
# -*- mode:org; epa-file-encrypt-to: ("arthur@ul___dt.com" "firstname.lastname@example.org") -*-
When a mail address is associated to several keys switch to the key ids. E.g. a call to epa-file-select-keys reveals key ids. The header line with fake key ids looks like:
# -*- mode:org; epa-file-encrypt-to: ("12345678ABCDEF00" "...
I had this problem and got it to work. Needed to spelunk through the code in epg.el and epg-config.el to determine what to fiddle with. This is what worked for me:
In this documentation, the options you might be interested in
Set the time a cache entry is valid to n seconds. The default is 600 seconds. Each time a cache entry is accessed, the entry’s timer is reset. To set an entry’s maximum lifetime, use max-cache-...
I encountered this issue. I solved it using the following steps in order:
Make sure that the folder c:/Progra~2/GnuPG/bin is on your path before any other installed versions of the GnuPG executables (in my case, I had it installed via msys2).
Note that Progra~2 expands to "Program Files (x86)" on my system (I am using the 64 bit version ...
The prompt I see without any configuration is:
Password for 'https://email@example.com':
this corresponds to the used remote url:
I then added an entry like this:
machine firstname.lastname@example.org password 12345
and added the function to the hook:
I am moving my comment to an answer explaining how pinentry-emacs works because of formatting
pinentry-emacs stops the window from popping up that asks for your password and insteads asks for your password through the minibuffer.
It is super poorly documented and took me a bit of time to set up. From what I can tell I placed
I've just added --gpg-sign to the revert popup.
Since it sounds like you are signing all commits anyway, you might also just set the Git variable commit.gpgSign.
And you can always add your own actions and arguments to a popup. In this case this would have worked:
?S "Sign using gpg" "--gpg-sign=" 'magit-...
I cannot comment on Emacs 24, but here's how I solved this for Emacs 25:
By default epa in Emacs 25 uses gpg2 (GnuPG 2.x). According to the Epa manual, caching with gpg2 requires gpg-agent.
For some reason, I had to enable pinentry in the minibuffer, see: Enabling minibuffer pinentry with Emacs 25 and GnuPG 2.1 on Ubuntu Xenial
The documentation string ...
The following will prevent messages to email addresses in
blacklist-addresses from invoking mml-secure-message-sign.
(defvar blacklist-addresses nil
"List of email addresses (as strings) to blacklist for
(defun secure-sign-maybe ()
"Use `mml-secure-message-sign' unless the addressee is in the
How can you be sure that GNOME is not caching the passphrase? If you are starting emacs in non-terminal mode, and if it is not asking for passphrase, you must have checked the option for "Automatically unlock whenever I am logged in".
You can start seahorse from the GNOME search bar or from the terminal and go to your Gnome2 Key Storage and search for gpg2 ...
org-crypt-key is the GPG key identifier, normally an email address.
Your GPG secret key resides in the secret ring in your .gnupg directory, and is protected by your passphrase.
From the source code comments:
;; 2. Set the encryption key to use in the `org-crypt-key' variable,
;; or use `M-x org-set-property' to set the property CRYPTKEY to
;; any ...
Override org-agenda-file-regexp as shown to include .org.gpg files, then set org-agenda-files as usual.
(unless (string-match-p "\\.gpg" org-agenda-file-regexp)
(replace-regexp-in-string "\\\\\\.org" "\\\\.org\\\\(\\\\.gpg\\\\)?"
From the commentary at the beginning of org-crypt.el:
;; 4. To automatically encrypt all necessary entries when saving a
;; file, call `org-crypt-use-before-save-magic' after loading
So add to your init.el something like:
(add-hook 'before-save-hook #'org-crypt-use-before-save-...
This was intended as a comment, but it's too long, hopefully it will give you some hints.
Right now I don't have a mac to try OSX configs, but this is what I have now:
I had the same problem, on msys2, with the mingw64 version of emacs, which is 27.1, incidentally.
The problem I've found comes from emacs's package.el not agreeing (in msys2's context) with gpg on what to do with the --homedir argument.
As it is suggested here, package.el sets this argument to be (expand-file-name "gnupg" package-user-dir), but, ...
I had the same problem. It seems like gpg is not able to locate a key server.
To fix it, in the ~/.emacs.d/elpa/gnupg directory, create a file named gpg.conf with the following line:
Then run this on the command line:
gpg --homedir ~/.emacs.d/elpa/gnupg --receive-keys 066DAFCB81E42C40
And then in emacs:
For gpg version < 2, caching can be from emacs or the gpg-agent
To disable caching from emacs, set epa-file-cache-passphrase-for-symmetric-encryption to nil if it is not nil in emacs config file
(setq epa-file-cache-passphrase-for-symmetric-encryption nil)
To disable caching by gpg-agent, add
default-cache-ttl 0 to gpg config file located at ~/.gnupg/...
You can create your own command to set all variables before starting ERC:
(defun my/erc-freenode ()
(let ((erc-plist (car (auth-source-search :host "irc.freenode.net")))
(setq erc-server "irc.freenode.net")
(setq erc-nick (plist-get erc-plist :user))
(setq erc-password (funcall (plist-get ...
I assume you have already generated your public and private key pairs using gpg2. Before jumping into the gnus configuration there are some things you need to have done.
Setup Gmail to cooperate with Gnus
Make sure you have gnutls installed on your system
Let me elaborate:
Setup two step authentication and get an app password on ...
From GnuPG 2.1 two software should be used: gpg-agent and pinentry.
Update the files as follows:
$ echo 'allow-loopback-pinentry' >> ~/.gnupg/gpg-agent.conf
$ echo 'pinentry-mode loopback' >> ~/.gnupg/gpg.conf
$ gpgconf --kill gpg-agent
It worked for me on Emacs24 / FreeBsd11, but it should work on GNU / Linux as well.