# pgp-decrypt

Decrypts a PGP-encrypted attachment using the private key stored in this folder.
The private key is passphrase-protected, and the passphrase is kept in a
**separate file** (`passphrase.txt`) so it never lives inside the script.

## Files

| File                     | Purpose                                                        |
| ------------------------ | -------------------------------------------------------------- |
| `decrypt.sh`             | The decryption script.                                         |
| `pgp-secret-keys.asc`    | The passphrase-protected private key (CHECK24 Datenschutz).    |
| `passphrase.txt`         | The key passphrase — **you fill this in**. Git-ignored.        |
| `passphrase.txt.example` | Template for `passphrase.txt`.                                 |
| `*.pgp`                  | The encrypted attachment(s) to decrypt.                        |

## Setup

1. Install GnuPG if needed: `brew install gnupg`
2. Put the real passphrase into `passphrase.txt` (replace the placeholder):
   ```sh
   printf '%s' 'your-real-passphrase' > passphrase.txt
   ```

## Usage

```sh
# Auto-detect the single *.pgp in this folder, write the decrypted file next to it:
./decrypt.sh

# Or specify input and output explicitly:
./decrypt.sh "Anschreiben Check24_ 251102-0536-IP6054.pdf.pgp" out.pdf
```

## Notes / security

- The script imports the key into a **throwaway, isolated GnuPG home**
  (`mktemp -d`), so your real `~/.gnupg` keyring is never touched, and the temp
  keyring is deleted on exit.
- `.gitignore` excludes the passphrase, the private key, the `*.pgp` inputs and
  decrypted `*.pdf` output so secrets don't get committed. Adjust to taste.
- The passphrase is passed to `gpg` via a file descriptor (`--passphrase-fd`),
  not the command line, so it doesn't show up in the process list.