I've written a script to help our developers store a copy of their private keys without a passphrase inside our Puppet tree (not committed to Git) so our Vagrant boxes can use Hiera with eyaml + gpg (https://github.com/sihil/hiera-eyaml-gpg) to access secret data during testing.
The script works great, but I'd like to also automate the process of verifying that the secret key has been stripped of a passphrase properly in the copy.
So far, the only way I found is manual - execute
gpg --homedir ... --edit-key keyid and then in the interactive prompt run
password and look for a
This key is not protected. message.
I'd like to do that automatically in the script - basically I want to know how does the gpg tool know that it should print this message. From the answer in https://security.stackexchange.com/a/54205/45966 and reading the GnuPG source code in g10/export.c I conclude that "no passphrase" is actually regarded as "passphrase is empty string" and the code actually tries to decrypt a random string with the passphrase and verify that the result contains repeated random pattern.
Is this correct?
If so - is there a way to avoid having to re-implement that entire process myself but instead use gpg command line tool or some Python/Ruby API's to do that for me? I looked at a few Python and Ruby front-ends to gpgme but didn't see something like this there.
I see in g10/build-packet.c that I should expect some different output if the packet is protected or not, but trying to compare dumps of protected vs. unprotected secret keys didn't yield anything except small differences in hashes. I might be mis-interpreting the code there.