1Password CLI pinentry for gpg-agent

pinentry-1password.sh

#!/bin/sh

COMMAND="op read $OP_PIN_ITEM"

echo "OK"
while read cmd rest; do
  echo "cmd=$cmd rest=$rest" >&2
  echo "cmd=$cmd rest=$rest" >> $LOG
  case "$cmd" in
    \#*)
      echo "OK"
      ;;
    GETPIN)
      PASSPHRASE=${PASSPHRASE-`$COMMAND`}
      echo "D ${PASSPHRASE}"
      echo "OK"
      ;;
    BYE)
      echo "OK"
      exit 0
      ;;
    *)
      echo "OK"
      ;;
  esac
done

Usage

1. Install 1Password CLI
2. Save pinentry-1password.sh to /usr/bin/pinentry-1password.sh or a location of your choice
3. Make it executable: chmod +x /pinentry-1password.sh
4. Update ~/.gnupg/gpg-agent.conf (change the path to the location of the script):

pinentry-program /usr/bin/pinentry-1password.sh

5. In your shell's .profile, .bashrc,.zshrc etc. set OP_PIN_ITEM to the secret reference for your key's passphrase:

export OP_PIN_ITEM="op://vault/gpg_key_name/password"

WSL

You'll need to install and configure 1Password CLI for Windows. Then, in your WSL shell use op.exe instead. Adjust line 3 of the pinentry script accordingly:

COMMAND="op.exe read $OP_PIN_ITEM"

slightly adjusted fish version:

❯ cat pinentry-1password.fish
#!/usr/bin/env fish

echo "OK"
set key "GPG-898DFASD78345D"
set passphrase ""
set vault "Private"

while read cmd val
  #echo "cmd=$cmd val=$val" >> /tmp/logs
  switch $cmd
    case SETDESC
      set passphrase (op read op://$vault/$key/password)
    case GETPIN
      echo "D $passphrase"
    case SETERROR
       echo "ERR 31 Invalid passphrase"
    case BYE
      exit 0
  end
  echo "OK"
end