PGP Encryption and Temporary Home Directories

GPG is used as back-end encryption for many applications and processes, as such, it’s necessary to have a reusable key implementation routine. This is where the home directory comes in; the home directory can be used to cache keys for repeated use even when the user executing the task does not own the keys.

To set a home directory, the — homedir switch can be used on the command line followed by the path to the home directory. Typically, this will be a copy of gnupg folder after the applicable keys have been created or imported and trusted. This type of setup is could be effective in a single-use context, but not in a scenario where file decryption needs to happen repeatedly. The reason for this is because of how the gpg agent interacts with the home directory. The gpg agent starts when it is called and ends when the interaction has ceased. But when using a home directory, the normal termination of the gpg agent is not allowed to occur and can leave the agent thread running in the background. This can have unintended consequences such as interrupting repeated processes that are attempting to use the same home directory.

The simplest solution to this is temporary home directories. Recursively copying, using, and then removing a home directory will reliably start, engage, and end the gpg agent thread, allowing for repeated use. The removal of the home directory indicates to the gpg agent that the process is complete, and it can end.