tool.medowar.de/pgp-decrypt

pgp-decrypt

Decrypts a PGP-encrypted attachment using the private key stored in this folder. The private key is passphrase-protected, and the passphrase is kept in a separate file (passphrase.txt) so it never lives inside the script.

Files

File	Purpose
decrypt.sh	The decryption script.
pgp-secret-keys.asc	The passphrase-protected private key (CHECK24 Datenschutz).
passphrase.txt	The key passphrase — you fill this in. Git-ignored.
passphrase.txt.example	Template for passphrase.txt.
*.pgp	The encrypted attachment(s) to decrypt.

Setup

1. Install GnuPG if needed: brew install gnupg

2. Put the real passphrase into passphrase.txt (replace the placeholder):

   printf '%s' 'your-real-passphrase' > passphrase.txt
   

Usage

# Auto-detect the single *.pgp in this folder, write the decrypted file next to it:
./decrypt.sh

# Or specify input and output explicitly:
./decrypt.sh "Anschreiben Check24_ 251102-0536-IP6054.pdf.pgp" out.pdf

Notes / security

• The script imports the key into a throwaway, isolated GnuPG home (mktemp -d), so your real ~/.gnupg keyring is never touched, and the temp keyring is deleted on exit.
• .gitignore excludes the passphrase, the private key, the *.pgp inputs and decrypted *.pdf output so secrets don't get committed. Adjust to taste.
• The passphrase is passed to gpg via a file descriptor (--passphrase-fd), not the command line, so it doesn't show up in the process list.