Encrypt and Restore a Directory with gpgtar

You will finish with a password-protected archive of a directory, a way to inspect its contents without extracting them, and a tested restore into a separate destination. The examples use gpgtar from GnuPG 2.4.4, installed here as package gnupg-utils version 2.4.4-2ubuntu17.6.

Allow about fifteen minutes. You need gpgtar, a shell, enough free space for both the archive and the extracted copy, and a passphrase you can enter securely. The commands below run as an ordinary user. You do not need sudo unless your input or destination is deliberately protected from that user.

1. Confirm the installed command

Check the binary and version before building a script around it:

$ command -v gpgtar
/usr/bin/gpgtar
$ gpgtar --version
gpgtar (GnuPG) 2.4.4

The installed program describes itself as a GnuPG version of tar using the PGP Zip format. Its main actions are explicit: --create and --extract handle unencrypted ustar archives, while --encrypt, --decrypt, --sign and --list-archive handle the archive workflow.

2. Prepare a relative input path

Put the directory you want to archive in a working location, then change into its parent directory. Using a relative name keeps the archive's member names useful when you restore it:

$ cd /path/to/working-directory
$ ls -la project-files
total 16
drwxr-xr-x 2 you you 4096 Sep 24 10:00 .
drwxr-xr-x 3 you you 4096 Sep 24 10:00 ..
-rw-r--r-- 1 you you   12 Sep 24 10:00 notes.txt

Do not pass an arbitrary absolute path and assume gpgtar will preserve it. The installed command rejects the absolute directory form in this workflow with a "skipping invalid name" diagnostic. A relative path such as project-files is also easier to review before you run a destructive restore.

3. Create a symmetric encrypted archive

Use --symmetric (or -c) when one passphrase should protect the archive. Give the output a new name, and do not place it inside the directory being archived:

$ gpgtar --symmetric --output project-files.gpg project-files
gpg: AES256.CFB encrypted data

Without batch options, GnuPG asks for the passphrase through its normal pinentry mechanism. The default symmetric cipher documented for gpgtar is AES-128, but GnuPG configuration and command options can select a different cipher. Do not infer the cipher from a filename. Treat the passphrase as the security boundary: anyone who has both the archive and its passphrase can read the files.

Check that the archive exists and is not empty:

$ stat -c '%n: %s bytes' project-files.gpg
project-files.gpg: 238 bytes

The size depends on the input. A successful exit status is useful, but it is not a substitute for listing and restoring a test copy.

4. Inspect the archive before extracting

List members with --list-archive (or -t). This reads the archive without writing the contained files:

$ gpgtar --list-archive project-files.gpg
project-files/
project-files/notes.txt

For an encrypted archive, gpgtar may ask for the passphrase. Check the names carefully. This is the point to stop if the archive contains an unexpected absolute-looking path, a sensitive file you did not intend to include, or an output archive nested in the input tree.

You can list an archive from standard input by using - as the filename:

$ cat project-files.gpg | gpgtar --list-archive -
project-files/
project-files/notes.txt

For a large archive, prefer redirection or a pipe that does not expose the passphrase in shell history. Never put a real passphrase directly in a command line.

5. Restore into a controlled directory

Create a new destination, then decrypt with --decrypt (or -d) and select it with --directory (or -C):

$ mkdir restored-project-files
$ gpgtar --decrypt --directory restored-project-files project-files.gpg
gpg: AES256.CFB encrypted data
gpg: encrypted with 1 passphrase
$ find restored-project-files -type f -printf '%P\n'
project-files/notes.txt

If you omit --directory, gpgtar normally takes the extraction directory name from the input filename. If it has no input filename, it uses GPGARCH. Choosing the destination explicitly avoids accidentally filling the current directory.

Compare important files before replacing anything in a live tree:

$ cmp -- project-files/notes.txt restored-project-files/project-files/notes.txt
$ printf 'restore status: %s\n' "$?"
restore status: 0

6. Avoid overwriting useful data

Extraction can encounter files that already exist. The --yes option assumes yes to most questions and is commonly paired with --batch to permit overwriting. That combination is security-sensitive and should not be part of a first restore:

$ mkdir restore-test
$ gpgtar --decrypt --batch --yes --directory restore-test project-files.gpg

Use it only when the destination is disposable or you have a verified backup. There is no general undo command for overwritten files. If a restore fails part-way through, stop, preserve the original archive, and inspect the destination rather than repeatedly rerunning with --yes. For a safe retry, choose a new empty directory:

$ mkdir restore-retry
$ gpgtar --decrypt --directory restore-retry project-files.gpg

7. Use a recipient key when a shared passphrase is not suitable

For a recipient-based archive, replace --symmetric with --encrypt (or -e) and name the recipient with --recipient (or -r):

$ gpgtar --encrypt --recipient 'RECIPIENT_USER_ID' --output project-files.gpg project-files

Replace RECIPIENT_USER_ID with an exact key identity from your own keyring. Verify the fingerprint through a trusted channel before encrypting anything important. The recipient needs the matching private key to decrypt the archive. You can combine --encrypt and --symmetric when both a key and a passphrase should be able to unlock it.

8. Diagnose the usual failures

A non-zero status means gpgtar did not complete successfully. A missing or wrong passphrase normally causes GnuPG to report a decryption failure; it does not mean the archive is empty. Check the archive path, retry through the normal pinentry prompt, and avoid storing passphrases in files unless your operating procedure protects those files.

If listing or extraction reports an invalid name, inspect the command's working directory and input arguments. Use --directory for the extraction destination and a relative source name for creation. If the archive is damaged or truncated, preserve it as evidence and recover from another copy rather than editing it.

--dry-run tells gpgtar not to output extracted files. It is useful for checking an extraction command, but it does not replace a real restore test. --skip-crypto deliberately creates or extracts a plain ustar archive, so do not use it when confidentiality or integrity is required.