use Apple Keychain to store GPG Passphrases

README.md

gpg-agent setup

Need to setup gpg-agent first, on OSX I use keychain (it also does ssh-agent)

$ brew info keychain
keychain: stable 2.8.5
User-friendly front-end to ssh-agent(1)
https://www.funtoo.org/Keychain
/usr/local/Cellar/keychain/2.8.5 (7 files, 108.5KB) *
  Built from source on 2018-10-23 at 14:44:08
From: https://github.com/Homebrew/homebrew-core/blob/master/Formula/keychain.rb
==> Analytics
install: 267 (30 days), 841 (90 days), 3,910 (365 days)
install_on_request: 262 (30 days), 817 (90 days), 3,661 (365 days)
build_error: 0 (30 days)

gpg passphrase in keychain

brew install gpg gpg2 pinentry-mac

mkdir -m 0700 ~/.gnupg
echo "pinentry-program $(brew --prefix)/bin/pinentry-mac" | tee ~/.gnupg/gpg-agent.conf
pkill -TERM gpg-agent

Close and reopen shell.

test gpg passphrase stored in keychain

Assuming you've already created or imported a key, select an identity to test:

$ gpg --list-keys
/Users/kosh/.gnupg/pubring.kbx
------------------------------
pub   rsa4096 2019-06-18 [SC]
      C577EB80271726F2C2B75728BC90B58A3E7FC375
uid           [ultimate] Koshatul <koshatul@users.noreply.github.com>
sub   rsa4096 2019-06-18 [E]

Test (replace koshatul@users.noreply.github.com with the identity of your certificate):

$ echo test | gpg -e -r koshatul@users.noreply.github.com | gpg -d
gpg: encrypted with rsa4096 key, ID 3AF58C6962796950, created 2019-06-18
      "Koshatul <koshatul@users.noreply.github.com>"
test

works fine, thanks!

thanks!

Works like a charm, thanks.

awesome, thanks!

Has anyone had a problem with pinentry-mac not being able to input passphrase?
The entered text is still in the terminal and cannot be entered into pinentry-mac.
Ran on: macOS 13.2.1 (22D68), Apple M2 Pro

Has anyone had a problem with pinentry-mac not being able to input passphrase?

Solved, turns out I should restart pinentry-mac after setup gpg-agent too, leave notes here for those who also ran into this issue.
$ killall pinentry-mac gpg-agent

Yep. I found out why.

Looks like the problem is a missing key in defaults:

defaults write org.gpgtools.pinentry-mac DisableKeychain -bool no

You must set this to no, otherwise, it will be "true" and doesn't show, even if you have UseKeychain = yes.

For those who land here trying to disable the 'Save to Keychain' being on by default in pin entry-mac, I found that this worked for me (got this answer from here):

$ defaults write org.gpgtools.pinentry-mac UseKeychain -bool NO
$ killall pinentry-mac gpg-agent