title: How to get the gpg-agent to ask for the password when used in maven-gpg-plugin
body: <p>I have several projects where I want to sign the resulting artifacts with a gpg key. In the past I used gpg 1.x (i.e. the old one) and in this setup I had the password encrypted (but usable) in the <code>~/.m2/settings-security.xml</code>. </p>
  
  <p>I do not like that (but at the time I wrote that it was the setup I managed to get running).</p>
  
  <p>I recently started to see if I could get it all running without storing the passwords. So now in the <code>~/.m2/settings.xml</code> I have something like this (this profile is active):</p>
  
  <pre><code>&lt;profile&gt;
    &lt;id&gt;signingkey&lt;/id&gt;
    &lt;properties&gt;
      &lt;gpg.executable&gt;gpg2&lt;/gpg.executable&gt;
      &lt;gpg.keyname&gt;ABCDEF01&lt;/gpg.keyname&gt;
    &lt;/properties&gt;
  &lt;/profile&gt;
  </code></pre>
  
  <p>In the pom.xml I have the maven-gpg-plugin with this basic config</p>
  
  <pre><code>&lt;build&gt;
    &lt;plugins&gt;
      &lt;plugin&gt;
        &lt;groupId&gt;org.apache.maven.plugins&lt;/groupId&gt;
        &lt;artifactId&gt;maven-gpg-plugin&lt;/artifactId&gt;
        &lt;version&gt;1.6&lt;/version&gt;
        &lt;executions&gt;
          &lt;execution&gt;
            &lt;id&gt;sign-artifacts&lt;/id&gt;
            &lt;phase&gt;verify&lt;/phase&gt;
            &lt;goals&gt;
              &lt;goal&gt;sign&lt;/goal&gt;
            &lt;/goals&gt;
          &lt;/execution&gt;
        &lt;/executions&gt;
      &lt;/plugin&gt;
    &lt;/plugins&gt;
  &lt;/build&gt;
  </code></pre>
  
  <p>Now when I do this on my Ubuntu 16.04 system the gpg-agent (part of gpg2) and the gnome-keyring-daemon remember the password after the first use.</p>
  
  <p>So on this system I am normally in the situation that I already have the gpg-agent running and as such when I do <code>mvn clean verify</code> in my project signs the artifacts without asking any questions because the password is available in the gpg-agent.</p>
  
  <p>So far so good.</p>
  
  <p>To ensure I have perfectly clean build of the software (and for some projects also to ensure all the tools are installed correctly) I frequently build/deploy the software from a separate docker environment.</p>
  
  <p>In such a 'very clean' docker environment there is no gpg-agent at startup and I have found that simply running <code>mvn clean verify</code> will yield a build that is not signed because I get</p>
  
  <pre><code>You need a passphrase to unlock the secret key for
  user: "Niels Basjes (Software Signing Key) &lt;signed@basjes.nl&gt;"
  ...
  gpg: cancelled by user
  </code></pre>
  
  <p>As far as I can tell because I should have entered the password but no prompt was provided.</p>
  
  <p>At this point I have only found one workaround and that is to do something like <code>gpg2 --sign pom.xml</code> before building the software because that starts the gpg-agent AND shows me a dialog to enter the password.  </p>
  
  <p>What I would like is to change my setup in such a way that I can simply do <code>mvn verify</code> and the first sign attempt will popup the password dialog for me and cache the password in the gpg-agent.</p>
  
  <p>Essentially my question is how to do this; or better: What is the proper way to set this up?</p>