Fix gpg signing in manifest builder
GPG versions 2.x+ require that --batch be passed if --passphrase-fd is
to be accepted.
From the man page:
--passphrase-fd n
Read the passphrase from file descriptor n. Only the first line
will be read from file descriptor n. If you use 0 for n, the
passphrase will be read from STDIN. This can only be used if
only one passphrase is supplied.
Note that this passphrase is only used if the option --batch has
also been given. This is different from GnuPG version 1.x.
dd8fc7dc06