I'm writing a web interface in PHP to generate keys. I'm familiar with gpg's command line options, particularly --batch. I'm also familiar with PHP's GnuPG API.
I can't find a way to safely pass the user's password from the web interface to the gpg command line because gpg uses a pinentry program? PHP's GnuPG functions don't include an API to generate keys.
What other way is there to generate keys, unattended, other than creating a batch file with the passphrase in that file like so:
Key-Type: default Subkey-Type: default Name-Real: Bob Name-Email: email@example.com Expire-Date: 2021-12-25 Passphrase: mysecretpassphrase %commit
Note: putting the passphrase on the command line with --passphrase is not wise.