code: def _encrypt(self, archive):
          
          arc_name = archive.replace("sosreport-", "secured-sosreport-")
          arc_name += ".gpg"
          enc_cmd = "gpg --batch -o %s " % arc_name
          env = None
          if self.enc_opts["key"]:
              # need to assume a trusted key here to be able to encrypt the
              # archive non-interactively
              enc_cmd += "--trust-model always -e -r %s " % self.enc_opts["key"]
              enc_cmd += archive
          if self.enc_opts["password"]:
              # prevent change of gpg options using a long password, but also
              # prevent the addition of quote characters to the passphrase
              passwd = "%s" % self.enc_opts["password"].replace('\'"', '')
              env = {"sos_gpg": passwd}
              enc_cmd += "-c --passphrase-fd 0 "
              enc_cmd = "/bin/bash -c \"echo $sos_gpg | %s\"" % enc_cmd
              enc_cmd += archive
          r = sos_get_command_output(enc_cmd, timeout=0, env=env)
          if r["status"] == 0:
              return arc_name
          elif r["status"] == 2:
              if self.enc_opts["key"]:
                  msg = "Specified key not in keyring"
              else:
                  msg = "Could not read passphrase"
          else:
              # TODO: report the actual error from gpg. Currently, we cannot as
              # sos_get_command_output() does not capture stderr
              msg = "gpg exited with code %s" % r["status"]
          raise Exception(msg)
docs: Encrypts the compressed archive using GPG.
  
          If encryption fails for any reason, it should be logged by sos but not
          cause execution to stop. The assumption is that the unencrypted archive
          would still be of use to the user, and/or that the end user has another
          means of securing the archive.
  
          Returns the name of the encrypted archive, or raises an exception to
          signal that encryption failed and the unencrypted archive name should
          be used.