5045 lines
159 KiB
HTML
5045 lines
159 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of GPG</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>GPG</H1>
|
|
Section: GNU Privacy Guard 2.2 (1)<BR>Updated: 2019-11-23<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
<B>gpg</B>
|
|
|
|
- OpenPGP encryption and signing tool
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>gpg</B>
|
|
|
|
[<B>--homedir</B>
|
|
|
|
<I>dir</I>]
|
|
|
|
[<B>--options</B>
|
|
|
|
<I>file</I>]
|
|
|
|
[<I>options</I>]
|
|
|
|
<I>command</I>
|
|
|
|
[<I>args</I>]
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>gpg</B> is the OpenPGP part of the GNU Privacy Guard (GnuPG). It
|
|
is a tool to provide digital encryption and signing services using the
|
|
OpenPGP standard. <B>gpg</B> features complete key management and
|
|
all the bells and whistles you would expect from a full OpenPGP
|
|
implementation.
|
|
<P>
|
|
There are two main versions of GnuPG: GnuPG 1.x and GnuPG 2.x. GnuPG
|
|
2.x supports modern encryption algorithms and thus should be preferred
|
|
over GnuPG 1.x. You only need to use GnuPG 1.x if your platform
|
|
doesn't support GnuPG 2.x, or you need support for some features that
|
|
GnuPG 2.x has deprecated, e.g., decrypting data created with PGP-2
|
|
keys.
|
|
<P>
|
|
If you are looking for version 1 of GnuPG, you may find that version
|
|
installed under the name <B>gpg1</B>.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAE"> </A>
|
|
<H2>RETURN VALUE</H2>
|
|
|
|
<P>
|
|
The program returns 0 if everything was fine, 1 if at least
|
|
a signature was bad, and other error codes for fatal errors.
|
|
<P>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>WARNINGS</H2>
|
|
|
|
<P>
|
|
Use a *good* password for your user account and a *good* passphrase
|
|
to protect your secret key. This passphrase is the weakest part of the
|
|
whole system. Programs to do dictionary attacks on your secret keyring
|
|
are very easy to write and so you should protect your "~/.gnupg/"
|
|
directory very well.
|
|
<P>
|
|
Keep in mind that, if this program is used over a network (telnet), it
|
|
is *very* easy to spy out your passphrase!
|
|
<P>
|
|
If you are going to verify detached signatures, make sure that the
|
|
program knows about it; either give both filenames on the command line
|
|
or use '-' to specify STDIN.
|
|
<P>
|
|
For scripted or other unattended use of <B>gpg</B> make sure to use
|
|
the machine-parseable interface and not the default interface which is
|
|
intended for direct use by humans. The machine-parseable interface
|
|
provides a stable and well documented API independent of the locale or
|
|
future changes of <B>gpg</B>. To enable this interface use the
|
|
options <B>--with-colons</B> and <B>--status-fd</B>. For certain
|
|
operations the option <B>--command-fd</B> may come handy too. See
|
|
this man page and the file '<I>DETAILS</I>' for the specification of the
|
|
interface. Note that the GnuPG ``info'' pages as well as the PDF
|
|
version of the GnuPG manual features a chapter on unattended use of
|
|
GnuPG. As an alternative the library <B>GPGME</B> can be used as a
|
|
high-level abstraction on top of that interface.
|
|
<P>
|
|
<A NAME="lbAG"> </A>
|
|
<H2>INTEROPERABILITY</H2>
|
|
|
|
<P>
|
|
GnuPG tries to be a very flexible implementation of the OpenPGP
|
|
standard. In particular, GnuPG implements many of the optional parts
|
|
of the standard, such as the SHA-512 hash, and the ZLIB and BZIP2
|
|
compression algorithms. It is important to be aware that not all
|
|
OpenPGP programs implement these optional algorithms and that by
|
|
forcing their use via the <B>--cipher-algo</B>,
|
|
<B>--digest-algo</B>, <B>--cert-digest-algo</B>, or
|
|
<B>--compress-algo</B> options in GnuPG, it is possible to create a
|
|
perfectly valid OpenPGP message, but one that cannot be read by the
|
|
intended recipient.
|
|
<P>
|
|
There are dozens of variations of OpenPGP programs available, and each
|
|
supports a slightly different subset of these optional algorithms.
|
|
For example, until recently, no (unhacked) version of PGP supported
|
|
the BLOWFISH cipher algorithm. A message using BLOWFISH simply could
|
|
not be read by a PGP user. By default, GnuPG uses the standard
|
|
OpenPGP preferences system that will always do the right thing and
|
|
create messages that are usable by all recipients, regardless of which
|
|
OpenPGP program they use. Only override this safe default if you
|
|
really know what you are doing.
|
|
<P>
|
|
If you absolutely must override the safe default, or if the preferences
|
|
on a given key are invalid for some reason, you are far better off using
|
|
the <B>--pgp6</B>, <B>--pgp7</B>, or <B>--pgp8</B> options. These
|
|
options are safe as they do not force any particular algorithms in
|
|
violation of OpenPGP, but rather reduce the available algorithms to a
|
|
"PGP-safe" list.
|
|
<P>
|
|
<A NAME="lbAH"> </A>
|
|
<H2>COMMANDS</H2>
|
|
|
|
<P>
|
|
Commands are not distinguished from options except for the fact that
|
|
only one command is allowed. Generally speaking, irrelevant options
|
|
are silently ignored, and may not be checked for correctness.
|
|
<P>
|
|
<B>gpg</B> may be run with no commands. In this case it will
|
|
print a warning perform a reasonable action depending on the type of
|
|
file it is given as input (an encrypted message is decrypted, a
|
|
signature is verified, a file containing keys is listed, etc.).
|
|
<P>
|
|
If you run into any problems, please add the option <B>--verbose</B>
|
|
to the invocation to see more diagnostics.
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAI"> </A>
|
|
<H3>Commands not specific to the function</H3>
|
|
|
|
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="1"><B>--version</B>
|
|
|
|
<DD>
|
|
Print the program version and licensing information. Note that you
|
|
cannot abbreviate this command.
|
|
<P>
|
|
<DT id="2"><B>--help</B>
|
|
|
|
<DD>
|
|
|
|
<B>-h</B>
|
|
|
|
Print a usage message summarizing the most useful command-line options.
|
|
Note that you cannot arbitrarily abbreviate this command
|
|
(though you can use its short form <B>-h</B>).
|
|
<P>
|
|
<DT id="3"><B>--warranty</B>
|
|
|
|
<DD>
|
|
Print warranty information.
|
|
<P>
|
|
<DT id="4"><B>--dump-options</B>
|
|
|
|
<DD>
|
|
Print a list of all available options and commands. Note that you cannot
|
|
abbreviate this command.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAJ"> </A>
|
|
<H3>Commands to select the type of operation</H3>
|
|
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="5"><B>--sign</B>
|
|
|
|
<DD>
|
|
|
|
<B>-s</B>
|
|
|
|
Sign a message. This command may be combined with <B>--encrypt</B>
|
|
(to sign and encrypt a message), <B>--symmetric</B> (to sign and
|
|
symmetrically encrypt a message), or both <B>--encrypt</B> and
|
|
<B>--symmetric</B> (to sign and encrypt a message that can be
|
|
decrypted using a secret key or a passphrase). The signing key is
|
|
chosen by default or can be set explicitly using the
|
|
<B>--local-user</B> and <B>--default-key</B> options.
|
|
<P>
|
|
<DT id="6"><B>--clear-sign</B>
|
|
|
|
<DD>
|
|
|
|
<B>--clearsign</B>
|
|
|
|
Make a cleartext signature. The content in a cleartext signature is
|
|
readable without any special software. OpenPGP software is only needed
|
|
to verify the signature. cleartext signatures may modify end-of-line
|
|
whitespace for platform independence and are not intended to be
|
|
reversible. The signing key is chosen by default or can be set
|
|
explicitly using the <B>--local-user</B> and <B>--default-key</B>
|
|
options.
|
|
<P>
|
|
<P>
|
|
<DT id="7"><B>--detach-sign</B>
|
|
|
|
<DD>
|
|
|
|
<B>-b</B>
|
|
|
|
Make a detached signature.
|
|
<P>
|
|
<DT id="8"><B>--encrypt</B>
|
|
|
|
<DD>
|
|
|
|
<B>-e</B>
|
|
|
|
Encrypt data to one or more public keys. This command may be combined
|
|
with <B>--sign</B> (to sign and encrypt a message),
|
|
<B>--symmetric</B> (to encrypt a message that can be decrypted using a
|
|
secret key or a passphrase), or <B>--sign</B> and
|
|
<B>--symmetric</B> together (for a signed message that can be
|
|
decrypted using a secret key or a passphrase). <B>--recipient</B>
|
|
and related options specify which public keys to use for encryption.
|
|
<P>
|
|
<DT id="9"><B>--symmetric</B>
|
|
|
|
<DD>
|
|
|
|
<B>-c</B>
|
|
|
|
Encrypt with a symmetric cipher using a passphrase. The default
|
|
symmetric cipher used is AES-128, but may be chosen with the
|
|
<B>--cipher-algo</B> option. This command may be combined with
|
|
<B>--sign</B> (for a signed and symmetrically encrypted message),
|
|
<B>--encrypt</B> (for a message that may be decrypted via a secret key
|
|
or a passphrase), or <B>--sign</B> and <B>--encrypt</B> together
|
|
(for a signed message that may be decrypted via a secret key or a
|
|
passphrase). <B>gpg</B> caches the passphrase used for
|
|
symmetric encryption so that a decrypt operation may not require that
|
|
the user needs to enter the passphrase. The option
|
|
<B>--no-symkey-cache</B> can be used to disable this feature.
|
|
<P>
|
|
<DT id="10"><B>--store</B>
|
|
|
|
<DD>
|
|
Store only (make a simple literal data packet).
|
|
<P>
|
|
<DT id="11"><B>--decrypt</B>
|
|
|
|
<DD>
|
|
|
|
<B>-d</B>
|
|
|
|
Decrypt the file given on the command line (or STDIN if no file
|
|
is specified) and write it to STDOUT (or the file specified with
|
|
<B>--output</B>). If the decrypted file is signed, the signature is also
|
|
verified. This command differs from the default operation, as it never
|
|
writes to the filename which is included in the file and it rejects
|
|
files that don't begin with an encrypted message.
|
|
<P>
|
|
<DT id="12"><B>--verify</B>
|
|
|
|
<DD>
|
|
Assume that the first argument is a signed file and verify it without
|
|
generating any output. With no arguments, the signature packet is
|
|
read from STDIN. If only one argument is given, the specified file is
|
|
expected to include a complete signature.
|
|
<P>
|
|
With more than one argument, the first argument should specify a file
|
|
with a detached signature and the remaining files should contain the
|
|
signed data. To read the signed data from STDIN, use '-' as the
|
|
second filename. For security reasons, a detached signature will not
|
|
read the signed material from STDIN if not explicitly specified.
|
|
<P>
|
|
Note: If the option <B>--batch</B> is not used, <B>gpg</B>
|
|
may assume that a single argument is a file with a detached signature,
|
|
and it will try to find a matching data file by stripping certain
|
|
suffixes. Using this historical feature to verify a detached
|
|
signature is strongly discouraged; you should always specify the data file
|
|
explicitly.
|
|
<P>
|
|
Note: When verifying a cleartext signature, <B>gpg</B> verifies
|
|
only what makes up the cleartext signed data and not any extra data
|
|
outside of the cleartext signature or the header lines directly following
|
|
the dash marker line. The option <B>--output</B> may be used to write
|
|
out the actual signed data, but there are other pitfalls with this
|
|
format as well. It is suggested to avoid cleartext signatures in
|
|
favor of detached signatures.
|
|
<P>
|
|
Note: Sometimes the use of the <B>gpgv</B> tool is easier than
|
|
using the full-fledged <B>gpg</B> with this option. <B>gpgv</B>
|
|
is designed to compare signed data against a list of trusted keys and
|
|
returns with success only for a good signature. It has its own manual
|
|
page.
|
|
<P>
|
|
<P>
|
|
<DT id="13"><B>--multifile</B>
|
|
|
|
<DD>
|
|
This modifies certain other commands to accept multiple files for
|
|
processing on the command line or read from STDIN with each filename on
|
|
a separate line. This allows for many files to be processed at
|
|
once. <B>--multifile</B> may currently be used along with
|
|
<B>--verify</B>, <B>--encrypt</B>, and <B>--decrypt</B>. Note that
|
|
<B>--multifile --verify</B> may not be used with detached signatures.
|
|
<P>
|
|
<DT id="14"><B>--verify-files</B>
|
|
|
|
<DD>
|
|
Identical to <B>--multifile --verify</B>.
|
|
<P>
|
|
<DT id="15"><B>--encrypt-files</B>
|
|
|
|
<DD>
|
|
Identical to <B>--multifile --encrypt</B>.
|
|
<P>
|
|
<DT id="16"><B>--decrypt-files</B>
|
|
|
|
<DD>
|
|
Identical to <B>--multifile --decrypt</B>.
|
|
<P>
|
|
<DT id="17"><B>--list-keys</B>
|
|
|
|
<DD>
|
|
|
|
<B>-k</B>
|
|
|
|
|
|
<B>--list-public-keys</B>
|
|
|
|
List the specified keys. If no keys are specified, then all keys from
|
|
the configured public keyrings are listed.
|
|
<P>
|
|
Never use the output of this command in scripts or other programs.
|
|
The output is intended only for humans and its format is likely to
|
|
change. The <B>--with-colons</B> option emits the output in a
|
|
stable, machine-parseable format, which is intended for use by scripts
|
|
and other programs.
|
|
<P>
|
|
<DT id="18"><B>--list-secret-keys</B>
|
|
|
|
<DD>
|
|
|
|
<B>-K</B>
|
|
|
|
List the specified secret keys. If no keys are specified, then all
|
|
known secret keys are listed. A <B>#</B> after the initial tags
|
|
<B>sec</B> or <B>ssb</B> means that the secret key or subkey is
|
|
currently not usable. We also say that this key has been taken
|
|
offline (for example, a primary key can be taken offline by exporting
|
|
the key using the command <B>--export-secret-subkeys</B>). A
|
|
<B>></B> after these tags indicate that the key is stored on a
|
|
smartcard. See also <B>--list-keys</B>.
|
|
<P>
|
|
<DT id="19"><B>--check-signatures</B>
|
|
|
|
<DD>
|
|
|
|
<B>--check-sigs</B>
|
|
|
|
Same as <B>--list-keys</B>, but the key signatures are verified and
|
|
listed too. Note that for performance reasons the revocation status
|
|
of a signing key is not shown. This command has the same effect as
|
|
using <B>--list-keys</B> with <B>--with-sig-check</B>.
|
|
<P>
|
|
The status of the verification is indicated by a flag directly
|
|
following the "sig" tag (and thus before the flags described below. A
|
|
"!" indicates that the signature has been successfully verified, a "-"
|
|
denotes a bad signature and a "%" is used if an error occurred while
|
|
checking the signature (e.g. a non supported algorithm). Signatures
|
|
where the public key is not available are not listed; to see their
|
|
keyids the command <B>--list-sigs</B> can be used.
|
|
<P>
|
|
For each signature listed, there are several flags in between the
|
|
signature status flag and keyid. These flags give additional
|
|
information about each key signature. From left to right, they are
|
|
the numbers 1-3 for certificate check level (see
|
|
<B>--ask-cert-level</B>), "L" for a local or non-exportable
|
|
signature (see <B>--lsign-key</B>), "R" for a nonRevocable signature
|
|
(see the <B>--edit-key</B> command "nrsign"), "P" for a signature
|
|
that contains a policy URL (see <B>--cert-policy-url</B>), "N" for a
|
|
signature that contains a notation (see <B>--cert-notation</B>), "X"
|
|
for an eXpired signature (see <B>--ask-cert-expire</B>), and the
|
|
numbers 1-9 or "T" for 10 and above to indicate trust signature levels
|
|
(see the <B>--edit-key</B> command "tsign").
|
|
<P>
|
|
<P>
|
|
<DT id="20"><B>--locate-keys</B>
|
|
|
|
<DD>
|
|
|
|
<B>--locate-external-keys</B>
|
|
|
|
Locate the keys given as arguments. This command basically uses the
|
|
same algorithm as used when locating keys for encryption or signing
|
|
and may thus be used to see what keys <B>gpg</B> might use.
|
|
In particular external methods as defined by
|
|
<B>--auto-key-locate</B> may be used to locate a key. Only public
|
|
keys are listed. The variant <B>--locate-external-keys</B> does not
|
|
consider a locally existing key and can thus be used to force the
|
|
refresh of a key via the defined external methods.
|
|
<P>
|
|
<DT id="21"><B>--show-keys</B>
|
|
|
|
<DD>
|
|
This commands takes OpenPGP keys as input and prints information about
|
|
them in the same way the command <B>--list-keys</B> does for locally
|
|
stored key. In addition the list options <B>show-unusable-uids</B>,
|
|
<B>show-unusable-subkeys</B>, <B>show-notations</B> and
|
|
<B>show-policy-urls</B> are also enabled. As usual for automated
|
|
processing, this command should be combined with the option
|
|
<B>--with-colons</B>.
|
|
<P>
|
|
<DT id="22"><B>--fingerprint</B>
|
|
|
|
<DD>
|
|
List all keys (or the specified ones) along with their
|
|
fingerprints. This is the same output as <B>--list-keys</B> but with
|
|
the additional output of a line with the fingerprint. May also be
|
|
combined with <B>--check-signatures</B>. If this
|
|
command is given twice, the fingerprints of all secondary keys are
|
|
listed too. This command also forces pretty printing of fingerprints
|
|
if the keyid format has been set to "none".
|
|
<P>
|
|
<DT id="23"><B>--list-packets</B>
|
|
|
|
<DD>
|
|
List only the sequence of packets. This command is only useful for
|
|
debugging. When used with option <B>--verbose</B> the actual MPI
|
|
values are dumped and not only their lengths. Note that the output of
|
|
this command may change with new releases.
|
|
<P>
|
|
<P>
|
|
<DT id="24"><B>--edit-card</B>
|
|
|
|
<DD>
|
|
|
|
<B>--card-edit</B>
|
|
|
|
Present a menu to work with a smartcard. The subcommand "help" provides
|
|
an overview on available commands. For a detailed description, please
|
|
see the Card HOWTO at
|
|
<A HREF="https://gnupg.org/documentation/howtos.html#GnuPG-cardHOWTO">https://gnupg.org/documentation/howtos.html#GnuPG-cardHOWTO</A> .
|
|
<P>
|
|
<DT id="25"><B>--card-status</B>
|
|
|
|
<DD>
|
|
Show the content of the smart card.
|
|
<P>
|
|
<DT id="26"><B>--change-pin</B>
|
|
|
|
<DD>
|
|
Present a menu to allow changing the PIN of a smartcard. This
|
|
functionality is also available as the subcommand "passwd" with the
|
|
<B>--edit-card</B> command.
|
|
<P>
|
|
<DT id="27"><B>--delete-keys </B><I>name</I>
|
|
|
|
<DD>
|
|
Remove key from the public keyring. In batch mode either <B>--yes</B> is
|
|
required or the key must be specified by fingerprint. This is a
|
|
safeguard against accidental deletion of multiple keys. If the
|
|
exclamation mark syntax is used with the fingerprint of a subkey only
|
|
that subkey is deleted; if the exclamation mark is used with the
|
|
fingerprint of the primary key the entire public key is deleted.
|
|
<P>
|
|
<DT id="28"><B>--delete-secret-keys </B><I>name</I>
|
|
|
|
<DD>
|
|
Remove key from the secret keyring. In batch mode the key must be
|
|
specified by fingerprint. The option <B>--yes</B> can be used to
|
|
advice gpg-agent not to request a confirmation. This extra
|
|
pre-caution is done because <B>gpg</B> can't be sure that the
|
|
secret key (as controlled by gpg-agent) is only used for the given
|
|
OpenPGP public key. If the exclamation mark syntax is used with the
|
|
fingerprint of a subkey only the secret part of that subkey is
|
|
deleted; if the exclamation mark is used with the fingerprint of the
|
|
primary key only the secret part of the primary key is deleted.
|
|
<P>
|
|
<P>
|
|
<DT id="29"><B>--delete-secret-and-public-key </B><I>name</I>
|
|
|
|
<DD>
|
|
Same as <B>--delete-key</B>, but if a secret key exists, it will be
|
|
removed first. In batch mode the key must be specified by fingerprint.
|
|
The option <B>--yes</B> can be used to advice gpg-agent not to
|
|
request a confirmation.
|
|
<P>
|
|
<DT id="30"><B>--export</B>
|
|
|
|
<DD>
|
|
Either export all keys from all keyrings (default keyrings and those
|
|
registered via option <B>--keyring</B>), or if at least one name is given,
|
|
those of the given name. The exported keys are written to STDOUT or to the
|
|
file given with option <B>--output</B>. Use together with
|
|
<B>--armor</B> to mail those keys.
|
|
<P>
|
|
<DT id="31"><B>--send-keys </B><I>keyIDs</I>
|
|
|
|
<DD>
|
|
Similar to <B>--export</B> but sends the keys to a keyserver.
|
|
Fingerprints may be used instead of key IDs.
|
|
Don't send your complete keyring to a keyserver --- select
|
|
only those keys which are new or changed by you. If no <I>keyIDs</I>
|
|
are given, <B>gpg</B> does nothing.
|
|
<P>
|
|
<DT id="32"><B>--export-secret-keys</B>
|
|
|
|
<DD>
|
|
|
|
<B>--export-secret-subkeys</B>
|
|
|
|
Same as <B>--export</B>, but exports the secret keys instead. The
|
|
exported keys are written to STDOUT or to the file given with option
|
|
<B>--output</B>. This command is often used along with the option
|
|
<B>--armor</B> to allow for easy printing of the key for paper backup;
|
|
however the external tool <B>paperkey</B> does a better job of
|
|
creating backups on paper. Note that exporting a secret key can be a
|
|
security risk if the exported keys are sent over an insecure channel.
|
|
<P>
|
|
The second form of the command has the special property to render the
|
|
secret part of the primary key useless; this is a GNU extension to
|
|
OpenPGP and other implementations can not be expected to successfully
|
|
import such a key. Its intended use is in generating a full key with
|
|
an additional signing subkey on a dedicated machine. This command
|
|
then exports the key without the primary key to the main machine.
|
|
<P>
|
|
GnuPG may ask you to enter the passphrase for the key. This is
|
|
required, because the internal protection method of the secret key is
|
|
different from the one specified by the OpenPGP protocol.
|
|
<P>
|
|
<DT id="33"><B>--export-ssh-key</B>
|
|
|
|
<DD>
|
|
This command is used to export a key in the OpenSSH public key format.
|
|
It requires the specification of one key by the usual means and
|
|
exports the latest valid subkey which has an authentication capability
|
|
to STDOUT or to the file given with option <B>--output</B>. That
|
|
output can directly be added to ssh's '<I>authorized_key</I>' file.
|
|
<P>
|
|
By specifying the key to export using a key ID or a fingerprint
|
|
suffixed with an exclamation mark (!), a specific subkey or the
|
|
primary key can be exported. This does not even require that the key
|
|
has the authentication capability flag set.
|
|
<P>
|
|
<DT id="34"><B>--import</B>
|
|
|
|
<DD>
|
|
|
|
<B>--fast-import</B>
|
|
|
|
Import/merge keys. This adds the given keys to the
|
|
keyring. The fast version is currently just a synonym.
|
|
<P>
|
|
There are a few other options which control how this command works.
|
|
Most notable here is the <B>--import-options merge-only</B> option
|
|
which does not insert new keys but does only the merging of new
|
|
signatures, user-IDs and subkeys.
|
|
<P>
|
|
<DT id="35"><B>--receive-keys </B><I>keyIDs</I>
|
|
|
|
<DD>
|
|
|
|
<B>--recv-keys </B><I>keyIDs</I>
|
|
|
|
Import the keys with the given <I>keyIDs</I> from a keyserver.
|
|
<P>
|
|
<DT id="36"><B>--refresh-keys</B>
|
|
|
|
<DD>
|
|
Request updates from a keyserver for keys that already exist on the
|
|
local keyring. This is useful for updating a key with the latest
|
|
signatures, user IDs, etc. Calling this with no arguments will refresh
|
|
the entire keyring.
|
|
<P>
|
|
<DT id="37"><B>--search-keys </B><I>names</I>
|
|
|
|
<DD>
|
|
Search the keyserver for the given <I>names</I>. Multiple names given
|
|
here will be joined together to create the search string for the
|
|
keyserver. Note that keyservers search for <I>names</I> in a different
|
|
and simpler way than gpg does. The best choice is to use a mail
|
|
address. Due to data privacy reasons keyservers may even not even
|
|
allow searching by user id or mail address and thus may only return
|
|
results when being used with the <B>--recv-key</B> command to
|
|
search by key fingerprint or keyid.
|
|
<P>
|
|
<DT id="38"><B>--fetch-keys </B><I>URIs</I>
|
|
|
|
<DD>
|
|
Retrieve keys located at the specified <I>URIs</I>. Note that different
|
|
installations of GnuPG may support different protocols (HTTP, FTP,
|
|
LDAP, etc.). When using HTTPS the system provided root certificates
|
|
are used by this command.
|
|
<P>
|
|
<DT id="39"><B>--update-trustdb</B>
|
|
|
|
<DD>
|
|
Do trust database maintenance. This command iterates over all keys and
|
|
builds the Web of Trust. This is an interactive command because it may
|
|
have to ask for the "ownertrust" values for keys. The user has to give
|
|
an estimation of how far she trusts the owner of the displayed key to
|
|
correctly certify (sign) other keys. GnuPG only asks for the ownertrust
|
|
value if it has not yet been assigned to a key. Using the
|
|
<B>--edit-key</B> menu, the assigned value can be changed at any time.
|
|
<P>
|
|
<DT id="40"><B>--check-trustdb</B>
|
|
|
|
<DD>
|
|
Do trust database maintenance without user interaction. From time to
|
|
time the trust database must be updated so that expired keys or
|
|
signatures and the resulting changes in the Web of Trust can be
|
|
tracked. Normally, GnuPG will calculate when this is required and do it
|
|
automatically unless <B>--no-auto-check-trustdb</B> is set. This
|
|
command can be used to force a trust database check at any time. The
|
|
processing is identical to that of <B>--update-trustdb</B> but it
|
|
skips keys with a not yet defined "ownertrust".
|
|
<P>
|
|
For use with cron jobs, this command can be used together with
|
|
<B>--batch</B> in which case the trust database check is done only if
|
|
a check is needed. To force a run even in batch mode add the option
|
|
<B>--yes</B>.
|
|
<P>
|
|
<P>
|
|
<DT id="41"><B>--export-ownertrust</B>
|
|
|
|
<DD>
|
|
Send the ownertrust values to STDOUT. This is useful for backup purposes
|
|
as these values are the only ones which can't be re-created from a
|
|
corrupted trustdb. Example:
|
|
<DL COMPACT><DT id="42"><DD>
|
|
<DL COMPACT><DT id="43"><DD>
|
|
<PRE>
|
|
gpg --export-ownertrust > otrust.txt
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="44"><B>--import-ownertrust</B>
|
|
|
|
<DD>
|
|
Update the trustdb with the ownertrust values stored in <B>files</B> (or
|
|
STDIN if not given); existing values will be overwritten. In case of a
|
|
severely damaged trustdb and if you have a recent backup of the
|
|
ownertrust values (e.g. in the file '<I>otrust.txt</I>'), you may re-create
|
|
the trustdb using these commands:
|
|
<DL COMPACT><DT id="45"><DD>
|
|
<DL COMPACT><DT id="46"><DD>
|
|
<PRE>
|
|
cd ~/.gnupg
|
|
rm trustdb.gpg
|
|
gpg --import-ownertrust < otrust.txt
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="47"><B>--rebuild-keydb-caches</B>
|
|
|
|
<DD>
|
|
When updating from version 1.0.6 to 1.0.7 this command should be used
|
|
to create signature caches in the keyring. It might be handy in other
|
|
situations too.
|
|
<P>
|
|
<DT id="48"><B>--print-md </B><I>algo</I>
|
|
|
|
<DD>
|
|
|
|
<B>--print-mds</B>
|
|
|
|
Print message digest of algorithm <I>algo</I> for all given files or STDIN.
|
|
With the second form (or a deprecated "*" for <I>algo</I>) digests for all
|
|
available algorithms are printed.
|
|
<P>
|
|
<DT id="49"><B>--gen-random </B><I>0|1|2</I> <I>count</I>
|
|
|
|
<DD>
|
|
Emit <I>count</I> random bytes of the given quality level 0, 1 or 2. If
|
|
<I>count</I> is not given or zero, an endless sequence of random bytes
|
|
will be emitted. If used with <B>--armor</B> the output will be
|
|
base64 encoded. PLEASE, don't use this command unless you know what
|
|
you are doing; it may remove precious entropy from the system!
|
|
<P>
|
|
<DT id="50"><B>--gen-prime </B><I>mode</I> <I>bits</I>
|
|
|
|
<DD>
|
|
Use the source, Luke :-). The output format is subject to change
|
|
with ant release.
|
|
<P>
|
|
<P>
|
|
<DT id="51"><B>--enarmor</B>
|
|
|
|
<DD>
|
|
|
|
<B>--dearmor</B>
|
|
|
|
Pack or unpack an arbitrary input into/from an OpenPGP ASCII armor.
|
|
This is a GnuPG extension to OpenPGP and in general not very useful.
|
|
<P>
|
|
<DT id="52"><B>--tofu-policy {auto|good|unknown|bad|ask} </B><I>keys</I>
|
|
|
|
<DD>
|
|
Set the TOFU policy for all the bindings associated with the specified
|
|
<I>keys</I>. For more information about the meaning of the policies,
|
|
see: [trust-model-tofu]. The <I>keys</I> may be specified either by their
|
|
fingerprint (preferred) or their keyid.
|
|
<P>
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAK"> </A>
|
|
<H3>How to manage your keys</H3>
|
|
|
|
|
|
<P>
|
|
This section explains the main commands for key management.
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="53"><B>--quick-generate-key </B><I>user-id</I> [<I>algo</I> [<I>usage</I> [<I>expire</I>]]]
|
|
|
|
<DD>
|
|
|
|
<B>--quick-gen-key</B>
|
|
|
|
This is a simple command to generate a standard key with one user id.
|
|
In contrast to <B>--generate-key</B> the key is generated directly
|
|
without the need to answer a bunch of prompts. Unless the option
|
|
<B>--yes</B> is given, the key creation will be canceled if the
|
|
given user id already exists in the keyring.
|
|
<P>
|
|
If invoked directly on the console without any special options an
|
|
answer to a ``Continue?'' style confirmation prompt is required. In
|
|
case the user id already exists in the keyring a second prompt to
|
|
force the creation of the key will show up.
|
|
<P>
|
|
If <I>algo</I> or <I>usage</I> are given, only the primary key is
|
|
created and no prompts are shown. To specify an expiration date but
|
|
still create a primary and subkey use ``default'' or
|
|
``future-default'' for <I>algo</I> and ``default'' for <I>usage</I>.
|
|
For a description of these optional arguments see the command
|
|
<B>--quick-add-key</B>. The <I>usage</I> accepts also the value
|
|
``cert'' which can be used to create a certification only primary key;
|
|
the default is to a create certification and signing key.
|
|
<P>
|
|
The <I>expire</I> argument can be used to specify an expiration date
|
|
for the key. Several formats are supported; commonly the ISO formats
|
|
``YYYY-MM-DD'' or ``YYYYMMDDThhmmss'' are used. To make the key
|
|
expire in N seconds, N days, N weeks, N months, or N years use
|
|
``seconds=N'', ``Nd'', ``Nw'', ``Nm'', or ``Ny'' respectively. Not
|
|
specifying a value, or using ``-'' results in a key expiring in a
|
|
reasonable default interval. The values ``never'', ``none'' can be
|
|
used for no expiration date.
|
|
<P>
|
|
If this command is used with <B>--batch</B>,
|
|
<B>--pinentry-mode</B> has been set to <B>loopback</B>, and one of
|
|
the passphrase options (<B>--passphrase</B>,
|
|
<B>--passphrase-fd</B>, or <B>passphrase-file</B>) is used, the
|
|
supplied passphrase is used for the new key and the agent does not ask
|
|
for it. To create a key without any protection <B>--passphrase ''</B>
|
|
may be used.
|
|
<P>
|
|
To create an OpenPGP key from the keys available on the currently
|
|
inserted smartcard, the special string ``card'' can be used for
|
|
<I>algo</I>. If the card features an encryption and a signing key, gpg
|
|
will figure them out and creates an OpenPGP key consisting of the
|
|
usual primary key and one subkey. This works only with certain
|
|
smartcards. Note that the interactive <B>--full-gen-key</B> command
|
|
allows to do the same but with greater flexibility in the selection of
|
|
the smartcard keys.
|
|
<P>
|
|
Note that it is possible to create a primary key and a subkey using
|
|
non-default algorithms by using ``default'' and changing the default
|
|
parameters using the option <B>--default-new-key-algo</B>.
|
|
<P>
|
|
<DT id="54"><B>--quick-set-expire </B><I>fpr</I> <I>expire</I> [*|<I>subfprs</I>]
|
|
|
|
<DD>
|
|
With two arguments given, directly set the expiration time of the
|
|
primary key identified by <I>fpr</I> to <I>expire</I>. To remove the
|
|
expiration time <B>0</B> can be used. With three arguments and the
|
|
third given as an asterisk, the expiration time of all non-revoked and
|
|
not yet expired subkeys are set to <I>expire</I>. With more than two
|
|
arguments and a list of fingerprints given for <I>subfprs</I>, all
|
|
non-revoked subkeys matching these fingerprints are set to
|
|
<I>expire</I>.
|
|
<P>
|
|
<P>
|
|
<DT id="55"><B>--quick-add-key </B><I>fpr</I> [<I>algo</I> [<I>usage</I> [<I>expire</I>]]]
|
|
|
|
<DD>
|
|
Directly add a subkey to the key identified by the fingerprint
|
|
<I>fpr</I>. Without the optional arguments an encryption subkey is
|
|
added. If any of the arguments are given a more specific subkey is
|
|
added.
|
|
<P>
|
|
<I>algo</I> may be any of the supported algorithms or curve names
|
|
given in the format as used by key listings. To use the default
|
|
algorithm the string ``default'' or ``-'' can be used. Supported
|
|
algorithms are ``rsa'', ``dsa'', ``elg'', ``ed25519'', ``cv25519'',
|
|
and other ECC curves. For example the string ``rsa'' adds an RSA key
|
|
with the default key length; a string ``rsa4096'' requests that the
|
|
key length is 4096 bits. The string ``future-default'' is an alias
|
|
for the algorithm which will likely be used as default algorithm in
|
|
future versions of gpg. To list the supported ECC curves the command
|
|
<B>gpg --with-colons --list-config curve</B> can be used.
|
|
<P>
|
|
Depending on the given <I>algo</I> the subkey may either be an
|
|
encryption subkey or a signing subkey. If an algorithm is capable of
|
|
signing and encryption and such a subkey is desired, a <I>usage</I>
|
|
string must be given. This string is either ``default'' or ``-'' to
|
|
keep the default or a comma delimited list (or space delimited list)
|
|
of keywords: ``sign'' for a signing subkey, ``auth'' for an
|
|
authentication subkey, and ``encr'' for an encryption subkey
|
|
(``encrypt'' can be used as alias for ``encr''). The valid
|
|
combinations depend on the algorithm.
|
|
<P>
|
|
The <I>expire</I> argument can be used to specify an expiration date
|
|
for the key. Several formats are supported; commonly the ISO formats
|
|
``YYYY-MM-DD'' or ``YYYYMMDDThhmmss'' are used. To make the key
|
|
expire in N seconds, N days, N weeks, N months, or N years use
|
|
``seconds=N'', ``Nd'', ``Nw'', ``Nm'', or ``Ny'' respectively. Not
|
|
specifying a value, or using ``-'' results in a key expiring in a
|
|
reasonable default interval. The values ``never'', ``none'' can be
|
|
used for no expiration date.
|
|
<P>
|
|
<DT id="56"><B>--generate-key</B>
|
|
|
|
<DD>
|
|
|
|
<B>--gen-key</B>
|
|
|
|
Generate a new key pair using the current default parameters. This is
|
|
the standard command to create a new key. In addition to the key a
|
|
revocation certificate is created and stored in the
|
|
'<I>openpgp-revocs.d</I>' directory below the GnuPG home directory.
|
|
<P>
|
|
<DT id="57"><B>--full-generate-key</B>
|
|
|
|
<DD>
|
|
|
|
<B>--full-gen-key</B>
|
|
|
|
Generate a new key pair with dialogs for all options. This is an
|
|
extended version of <B>--generate-key</B>.
|
|
<P>
|
|
There is also a feature which allows you to create keys in batch
|
|
mode. See the manual section ``Unattended key generation'' on how
|
|
to use this.
|
|
<P>
|
|
<P>
|
|
<DT id="58"><B>--generate-revocation </B><I>name</I>
|
|
|
|
<DD>
|
|
|
|
<B>--gen-revoke </B><I>name</I>
|
|
|
|
Generate a revocation certificate for the complete key. To only revoke
|
|
a subkey or a key signature, use the <B>--edit</B> command.
|
|
<P>
|
|
This command merely creates the revocation certificate so that it can
|
|
be used to revoke the key if that is ever needed. To actually revoke
|
|
a key the created revocation certificate needs to be merged with the
|
|
key to revoke. This is done by importing the revocation certificate
|
|
using the <B>--import</B> command. Then the revoked key needs to be
|
|
published, which is best done by sending the key to a keyserver
|
|
(command <B>--send-key</B>) and by exporting (<B>--export</B>) it
|
|
to a file which is then send to frequent communication partners.
|
|
<P>
|
|
<P>
|
|
<DT id="59"><B>--generate-designated-revocation </B><I>name</I>
|
|
|
|
<DD>
|
|
|
|
<B>--desig-revoke </B><I>name</I>
|
|
|
|
Generate a designated revocation certificate for a key. This allows a
|
|
user (with the permission of the keyholder) to revoke someone else's
|
|
key.
|
|
<P>
|
|
<P>
|
|
<DT id="60"><B>--edit-key</B>
|
|
|
|
<DD>
|
|
Present a menu which enables you to do most of the key management
|
|
related tasks. It expects the specification of a key on the command
|
|
line.
|
|
<P>
|
|
<DL COMPACT><DT id="61"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="62"><B>uid </B><I>n</I>
|
|
|
|
<DD>
|
|
Toggle selection of user ID or photographic user ID with index <I>n</I>.
|
|
Use <B>*</B> to select all and <B>0</B> to deselect all.
|
|
<P>
|
|
<DT id="63"><B>key </B><I>n</I>
|
|
|
|
<DD>
|
|
Toggle selection of subkey with index <I>n</I> or key ID <I>n</I>.
|
|
Use <B>*</B> to select all and <B>0</B> to deselect all.
|
|
<P>
|
|
<DT id="64"><B>sign</B>
|
|
|
|
<DD>
|
|
Make a signature on key of user <B>name</B>. If the key is not yet
|
|
signed by the default user (or the users given with <B>-u</B>), the program
|
|
displays the information of the key again, together with its
|
|
fingerprint and asks whether it should be signed. This question is
|
|
repeated for all users specified with
|
|
<B>-u</B>.
|
|
<P>
|
|
<DT id="65"><B>lsign</B>
|
|
|
|
<DD>
|
|
Same as "sign" but the signature is marked as non-exportable and will
|
|
therefore never be used by others. This may be used to make keys
|
|
valid only in the local environment.
|
|
<P>
|
|
<DT id="66"><B>nrsign</B>
|
|
|
|
<DD>
|
|
Same as "sign" but the signature is marked as non-revocable and can
|
|
therefore never be revoked.
|
|
<P>
|
|
<DT id="67"><B>tsign</B>
|
|
|
|
<DD>
|
|
Make a trust signature. This is a signature that combines the notions
|
|
of certification (like a regular signature), and trust (like the
|
|
"trust" command). It is generally only useful in distinct communities
|
|
or groups. For more information please read the sections
|
|
``Trust Signature'' and ``Regular Expression'' in RFC-4880.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DL COMPACT><DT id="68"><DD>
|
|
Note that "l" (for local / non-exportable), "nr" (for non-revocable,
|
|
and "t" (for trust) may be freely mixed and prefixed to "sign" to
|
|
create a signature of any type desired.
|
|
</DL>
|
|
|
|
<P>
|
|
If the option <B>--only-sign-text-ids</B> is specified, then any
|
|
non-text based user ids (e.g., photo IDs) will not be selected for
|
|
signing.
|
|
<P>
|
|
<DL COMPACT><DT id="69"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="70"><B>delsig</B>
|
|
|
|
<DD>
|
|
Delete a signature. Note that it is not possible to retract a signature,
|
|
once it has been send to the public (i.e. to a keyserver). In that case
|
|
you better use <B>revsig</B>.
|
|
<P>
|
|
<DT id="71"><B>revsig</B>
|
|
|
|
<DD>
|
|
Revoke a signature. For every signature which has been generated by
|
|
one of the secret keys, GnuPG asks whether a revocation certificate
|
|
should be generated.
|
|
<P>
|
|
<DT id="72"><B>check</B>
|
|
|
|
<DD>
|
|
Check the signatures on all selected user IDs. With the extra
|
|
option <B>selfsig</B> only self-signatures are shown.
|
|
<P>
|
|
<DT id="73"><B>adduid</B>
|
|
|
|
<DD>
|
|
Create an additional user ID.
|
|
<P>
|
|
<DT id="74"><B>addphoto</B>
|
|
|
|
<DD>
|
|
Create a photographic user ID. This will prompt for a JPEG file that
|
|
will be embedded into the user ID. Note that a very large JPEG will make
|
|
for a very large key. Also note that some programs will display your
|
|
JPEG unchanged (GnuPG), and some programs will scale it to fit in a
|
|
dialog box (PGP).
|
|
<P>
|
|
<DT id="75"><B>showphoto</B>
|
|
|
|
<DD>
|
|
Display the selected photographic user ID.
|
|
<P>
|
|
<DT id="76"><B>deluid</B>
|
|
|
|
<DD>
|
|
Delete a user ID or photographic user ID. Note that it is not
|
|
possible to retract a user id, once it has been send to the public
|
|
(i.e. to a keyserver). In that case you better use <B>revuid</B>.
|
|
<P>
|
|
<DT id="77"><B>revuid</B>
|
|
|
|
<DD>
|
|
Revoke a user ID or photographic user ID.
|
|
<P>
|
|
<DT id="78"><B>primary</B>
|
|
|
|
<DD>
|
|
Flag the current user id as the primary one, removes the primary user
|
|
id flag from all other user ids and sets the timestamp of all affected
|
|
self-signatures one second ahead. Note that setting a photo user ID
|
|
as primary makes it primary over other photo user IDs, and setting a
|
|
regular user ID as primary makes it primary over other regular user
|
|
IDs.
|
|
<P>
|
|
<DT id="79"><B>keyserver</B>
|
|
|
|
<DD>
|
|
Set a preferred keyserver for the specified user ID(s). This allows
|
|
other users to know where you prefer they get your key from. See
|
|
<B>--keyserver-options honor-keyserver-url</B> for more on how this
|
|
works. Setting a value of "none" removes an existing preferred
|
|
keyserver.
|
|
<P>
|
|
<DT id="80"><B>notation</B>
|
|
|
|
<DD>
|
|
Set a name=value notation for the specified user ID(s). See
|
|
<B>--cert-notation</B> for more on how this works. Setting a value of
|
|
"none" removes all notations, setting a notation prefixed with a minus
|
|
sign (-) removes that notation, and setting a notation name (without the
|
|
=value) prefixed with a minus sign removes all notations with that name.
|
|
<P>
|
|
<DT id="81"><B>pref</B>
|
|
|
|
<DD>
|
|
List preferences from the selected user ID. This shows the actual
|
|
preferences, without including any implied preferences.
|
|
<P>
|
|
<DT id="82"><B>showpref</B>
|
|
|
|
<DD>
|
|
More verbose preferences listing for the selected user ID. This shows
|
|
the preferences in effect by including the implied preferences of 3DES
|
|
(cipher), SHA-1 (digest), and Uncompressed (compression) if they are
|
|
not already included in the preference list. In addition, the
|
|
preferred keyserver and signature notations (if any) are shown.
|
|
<P>
|
|
<DT id="83"><B>setpref </B><I>string</I>
|
|
|
|
<DD>
|
|
Set the list of user ID preferences to <I>string</I> for all (or just
|
|
the selected) user IDs. Calling setpref with no arguments sets the
|
|
preference list to the default (either built-in or set via
|
|
<B>--default-preference-list</B>), and calling setpref with "none"
|
|
as the argument sets an empty preference list. Use <B>gpg
|
|
--version</B> to get a list of available algorithms. Note that while you
|
|
can change the preferences on an attribute user ID (aka "photo ID"),
|
|
GnuPG does not select keys via attribute user IDs so these preferences
|
|
will not be used by GnuPG.
|
|
<P>
|
|
When setting preferences, you should list the algorithms in the order
|
|
which you'd like to see them used by someone else when encrypting a
|
|
message to your key. If you don't include 3DES, it will be
|
|
automatically added at the end. Note that there are many factors that
|
|
go into choosing an algorithm (for example, your key may not be the
|
|
only recipient), and so the remote OpenPGP application being used to
|
|
send to you may or may not follow your exact chosen order for a given
|
|
message. It will, however, only choose an algorithm that is present
|
|
on the preference list of every recipient key. See also the
|
|
INTEROPERABILITY WITH OTHER OPENPGP PROGRAMS section below.
|
|
<P>
|
|
<DT id="84"><B>addkey</B>
|
|
|
|
<DD>
|
|
Add a subkey to this key.
|
|
<P>
|
|
<DT id="85"><B>addcardkey</B>
|
|
|
|
<DD>
|
|
Generate a subkey on a card and add it to this key.
|
|
<P>
|
|
<DT id="86"><B>keytocard</B>
|
|
|
|
<DD>
|
|
Transfer the selected secret subkey (or the primary key if no subkey
|
|
has been selected) to a smartcard. The secret key in the keyring will
|
|
be replaced by a stub if the key could be stored successfully on the
|
|
card and you use the save command later. Only certain key types may be
|
|
transferred to the card. A sub menu allows you to select on what card
|
|
to store the key. Note that it is not possible to get that key back
|
|
from the card - if the card gets broken your secret key will be lost
|
|
unless you have a backup somewhere.
|
|
<P>
|
|
<DT id="87"><B>bkuptocard </B><I>file</I>
|
|
|
|
<DD>
|
|
Restore the given <I>file</I> to a card. This command may be used to restore a
|
|
backup key (as generated during card initialization) to a new card. In
|
|
almost all cases this will be the encryption key. You should use this
|
|
command only with the corresponding public key and make sure that the
|
|
file given as argument is indeed the backup to restore. You should then
|
|
select 2 to restore as encryption key. You will first be asked to enter
|
|
the passphrase of the backup key and then for the Admin PIN of the card.
|
|
<P>
|
|
<DT id="88"><B>delkey</B>
|
|
|
|
<DD>
|
|
Remove a subkey (secondary key). Note that it is not possible to retract
|
|
a subkey, once it has been send to the public (i.e. to a keyserver). In
|
|
that case you better use <B>revkey</B>. Also note that this only
|
|
deletes the public part of a key.
|
|
<P>
|
|
<DT id="89"><B>revkey</B>
|
|
|
|
<DD>
|
|
Revoke a subkey.
|
|
<P>
|
|
<DT id="90"><B>expire</B>
|
|
|
|
<DD>
|
|
Change the key or subkey expiration time. If a subkey is selected, the
|
|
expiration time of this subkey will be changed. With no selection, the
|
|
key expiration of the primary key is changed.
|
|
<P>
|
|
<DT id="91"><B>trust</B>
|
|
|
|
<DD>
|
|
Change the owner trust value for the key. This updates the trust-db
|
|
immediately and no save is required.
|
|
<P>
|
|
<DT id="92"><B>disable</B>
|
|
|
|
<DD>
|
|
|
|
<B>enable</B>
|
|
|
|
Disable or enable an entire key. A disabled key can not normally be
|
|
used for encryption.
|
|
<P>
|
|
<DT id="93"><B>addrevoker</B>
|
|
|
|
<DD>
|
|
Add a designated revoker to the key. This takes one optional argument:
|
|
"sensitive". If a designated revoker is marked as sensitive, it will
|
|
not be exported by default (see export-options).
|
|
<P>
|
|
<DT id="94"><B>passwd</B>
|
|
|
|
<DD>
|
|
Change the passphrase of the secret key.
|
|
<P>
|
|
<DT id="95"><B>toggle</B>
|
|
|
|
<DD>
|
|
This is dummy command which exists only for backward compatibility.
|
|
<P>
|
|
<DT id="96"><B>clean</B>
|
|
|
|
<DD>
|
|
Compact (by removing all signatures except the selfsig) any user ID
|
|
that is no longer usable (e.g. revoked, or expired). Then, remove any
|
|
signatures that are not usable by the trust calculations.
|
|
Specifically, this removes any signature that does not validate, any
|
|
signature that is superseded by a later signature, revoked signatures,
|
|
and signatures issued by keys that are not present on the keyring.
|
|
<P>
|
|
<DT id="97"><B>minimize</B>
|
|
|
|
<DD>
|
|
Make the key as small as possible. This removes all signatures from
|
|
each user ID except for the most recent self-signature.
|
|
<P>
|
|
<DT id="98"><B>change-usage</B>
|
|
|
|
<DD>
|
|
Change the usage flags (capabilities) of the primary key or of
|
|
subkeys. These usage flags (e.g. Certify, Sign, Authenticate,
|
|
Encrypt) are set during key creation. Sometimes it is useful to
|
|
have the opportunity to change them (for example to add
|
|
Authenticate) after they have been created. Please take care when
|
|
doing this; the allowed usage flags depend on the key algorithm.
|
|
<P>
|
|
<DT id="99"><B>cross-certify</B>
|
|
|
|
<DD>
|
|
Add cross-certification signatures to signing subkeys that may not
|
|
currently have them. Cross-certification signatures protect against a
|
|
subtle attack against signing subkeys. See
|
|
<B>--require-cross-certification</B>. All new keys generated have
|
|
this signature by default, so this command is only useful to bring
|
|
older keys up to date.
|
|
<P>
|
|
<DT id="100"><B>save</B>
|
|
|
|
<DD>
|
|
Save all changes to the keyrings and quit.
|
|
<P>
|
|
<DT id="101"><B>quit</B>
|
|
|
|
<DD>
|
|
Quit the program without updating the
|
|
keyrings.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DL COMPACT><DT id="102"><DD>
|
|
The listing shows you the key with its secondary keys and all user
|
|
IDs. The primary user ID is indicated by a dot, and selected keys or
|
|
user IDs are indicated by an asterisk. The trust
|
|
value is displayed with the primary key: "trust" is the assigned owner
|
|
trust and "validity" is the calculated validity of the key. Validity
|
|
values are also displayed for all user IDs.
|
|
For possible values of trust, see: [trust-values].
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="103"><B>--sign-key </B><I>name</I>
|
|
|
|
<DD>
|
|
Signs a public key with your secret key. This is a shortcut version of
|
|
the subcommand "sign" from <B>--edit</B>.
|
|
<P>
|
|
<DT id="104"><B>--lsign-key </B><I>name</I>
|
|
|
|
<DD>
|
|
Signs a public key with your secret key but marks it as
|
|
non-exportable. This is a shortcut version of the subcommand "lsign"
|
|
from <B>--edit-key</B>.
|
|
<P>
|
|
<DT id="105"><B>--quick-sign-key </B><I>fpr</I> [<I>names</I>]
|
|
|
|
<DD>
|
|
|
|
<B>--quick-lsign-key </B><I>fpr</I> [<I>names</I>]
|
|
|
|
Directly sign a key from the passphrase without any further user
|
|
interaction. The <I>fpr</I> must be the verified primary fingerprint
|
|
of a key in the local keyring. If no <I>names</I> are given, all
|
|
useful user ids are signed; with given [<I>names</I>] only useful user
|
|
ids matching one of theses names are signed. By default, or if a name
|
|
is prefixed with a '*', a case insensitive substring match is used.
|
|
If a name is prefixed with a '=' a case sensitive exact match is done.
|
|
<P>
|
|
The command <B>--quick-lsign-key</B> marks the signatures as
|
|
non-exportable. If such a non-exportable signature already exists the
|
|
<B>--quick-sign-key</B> turns it into a exportable signature.
|
|
<P>
|
|
This command uses reasonable defaults and thus does not provide the
|
|
full flexibility of the "sign" subcommand from <B>--edit-key</B>.
|
|
Its intended use is to help unattended key signing by utilizing a list
|
|
of verified fingerprints.
|
|
<P>
|
|
<DT id="106"><B>--quick-add-uid </B><I>user-id</I> <I>new-user-id</I>
|
|
|
|
<DD>
|
|
This command adds a new user id to an existing key. In contrast to
|
|
the interactive sub-command <B>adduid</B> of <B>--edit-key</B> the
|
|
<I>new-user-id</I> is added verbatim with only leading and trailing
|
|
white space removed, it is expected to be UTF-8 encoded, and no checks
|
|
on its form are applied.
|
|
<P>
|
|
<DT id="107"><B>--quick-revoke-uid </B><I>user-id</I> <I>user-id-to-revoke</I>
|
|
|
|
<DD>
|
|
This command revokes a user ID on an existing key. It cannot be used
|
|
to revoke the last user ID on key (some non-revoked user ID must
|
|
remain), with revocation reason ``User ID is no longer valid''. If
|
|
you want to specify a different revocation reason, or to supply
|
|
supplementary revocation text, you should use the interactive
|
|
sub-command <B>revuid</B> of <B>--edit-key</B>.
|
|
<P>
|
|
<DT id="108"><B>--quick-set-primary-uid </B><I>user-id</I> <I>primary-user-id</I>
|
|
|
|
<DD>
|
|
This command sets or updates the primary user ID flag on an existing
|
|
key. <I>user-id</I> specifies the key and <I>primary-user-id</I> the
|
|
user ID which shall be flagged as the primary user ID. The primary
|
|
user ID flag is removed from all other user ids and the timestamp of
|
|
all affected self-signatures is set one second ahead.
|
|
<P>
|
|
<P>
|
|
<DT id="109"><B>--change-passphrase </B><I>user-id</I>
|
|
|
|
<DD>
|
|
|
|
<B>--passwd </B><I>user-id</I>
|
|
|
|
Change the passphrase of the secret key belonging to the certificate
|
|
specified as <I>user-id</I>. This is a shortcut for the sub-command
|
|
<B>passwd</B> of the edit key menu. When using together with the
|
|
option <B>--dry-run</B> this will not actually change the passphrase
|
|
but check that the current passphrase is correct.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAL"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
<P>
|
|
<B>gpg</B> features a bunch of options to control the exact
|
|
behaviour and to change the default configuration.
|
|
<P>
|
|
<P>
|
|
Long options can be put in an options file (default
|
|
"~/.gnupg/gpg.conf"). Short option names will not work - for example,
|
|
"armor" is a valid option for the options file, while "a" is not. Do not
|
|
write the 2 dashes, but simply the name of the option and any required
|
|
arguments. Lines with a hash ('#') as the first non-white-space
|
|
character are ignored. Commands may be put in this file too, but that is
|
|
not generally useful as the command will execute automatically with
|
|
every execution of gpg.
|
|
<P>
|
|
Please remember that option parsing stops as soon as a non-option is
|
|
encountered, you can explicitly stop parsing by using the special option
|
|
<B>--</B>.
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAM"> </A>
|
|
<H3>How to change the configuration</H3>
|
|
|
|
|
|
<P>
|
|
These options are used to change the configuration and are usually found
|
|
in the option file.
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="110"><B>--default-key </B><I>name</I>
|
|
|
|
<DD>
|
|
Use <I>name</I> as the default key to sign with. If this option is not
|
|
used, the default key is the first key found in the secret keyring.
|
|
Note that <B>-u</B> or <B>--local-user</B> overrides this option.
|
|
This option may be given multiple times. In this case, the last key
|
|
for which a secret key is available is used. If there is no secret
|
|
key available for any of the specified values, GnuPG will not emit an
|
|
error message but continue as if this option wasn't given.
|
|
<P>
|
|
<DT id="111"><B>--default-recipient </B><I>name</I>
|
|
|
|
<DD>
|
|
Use <I>name</I> as default recipient if option <B>--recipient</B> is
|
|
not used and don't ask if this is a valid one. <I>name</I> must be
|
|
non-empty.
|
|
<P>
|
|
<DT id="112"><B>--default-recipient-self</B>
|
|
|
|
<DD>
|
|
Use the default key as default recipient if option <B>--recipient</B> is not
|
|
used and don't ask if this is a valid one. The default key is the first
|
|
one from the secret keyring or the one set with <B>--default-key</B>.
|
|
<P>
|
|
<DT id="113"><B>--no-default-recipient</B>
|
|
|
|
<DD>
|
|
Reset <B>--default-recipient</B> and <B>--default-recipient-self</B>.
|
|
<P>
|
|
<DT id="114"><B>-v, --verbose</B>
|
|
|
|
<DD>
|
|
Give more information during processing. If used
|
|
twice, the input data is listed in detail.
|
|
<P>
|
|
<DT id="115"><B>--no-verbose</B>
|
|
|
|
<DD>
|
|
Reset verbose level to 0.
|
|
<P>
|
|
<DT id="116"><B>-q, --quiet</B>
|
|
|
|
<DD>
|
|
Try to be as quiet as possible.
|
|
<P>
|
|
<DT id="117"><B>--batch</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-batch</B>
|
|
|
|
Use batch mode. Never ask, do not allow interactive commands.
|
|
<B>--no-batch</B> disables this option. Note that even with a
|
|
filename given on the command line, gpg might still need to read from
|
|
STDIN (in particular if gpg figures that the input is a
|
|
detached signature and no data file has been specified). Thus if you
|
|
do not want to feed data via STDIN, you should connect STDIN to
|
|
g'<I>/dev/null</I>'.
|
|
<P>
|
|
It is highly recommended to use this option along with the options
|
|
<B>--status-fd</B> and <B>--with-colons</B> for any unattended use of
|
|
<B>gpg</B>.
|
|
<P>
|
|
<DT id="118"><B>--no-tty</B>
|
|
|
|
<DD>
|
|
Make sure that the TTY (terminal) is never used for any output.
|
|
This option is needed in some cases because GnuPG sometimes prints
|
|
warnings to the TTY even if <B>--batch</B> is used.
|
|
<P>
|
|
<DT id="119"><B>--yes</B>
|
|
|
|
<DD>
|
|
Assume "yes" on most questions.
|
|
<P>
|
|
<DT id="120"><B>--no</B>
|
|
|
|
<DD>
|
|
Assume "no" on most questions.
|
|
<P>
|
|
<P>
|
|
<DT id="121"><B>--list-options </B><I>parameters</I>
|
|
|
|
<DD>
|
|
This is a space or comma delimited string that gives options used when
|
|
listing keys and signatures (that is, <B>--list-keys</B>,
|
|
<B>--check-signatures</B>, <B>--list-public-keys</B>,
|
|
<B>--list-secret-keys</B>, and the <B>--edit-key</B> functions).
|
|
Options can be prepended with a <B>no-</B> (after the two dashes) to
|
|
give the opposite meaning. The options are:
|
|
<P>
|
|
<DL COMPACT><DT id="122"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="123"><B>show-photos</B>
|
|
|
|
<DD>
|
|
Causes <B>--list-keys</B>, <B>--check-signatures</B>,
|
|
<B>--list-public-keys</B>, and <B>--list-secret-keys</B> to
|
|
display any photo IDs attached to the key. Defaults to no. See also
|
|
<B>--photo-viewer</B>. Does not work with <B>--with-colons</B>:
|
|
see <B>--attribute-fd</B> for the appropriate way to get photo data
|
|
for scripts and other frontends.
|
|
<P>
|
|
<DT id="124"><B>show-usage</B>
|
|
|
|
<DD>
|
|
Show usage information for keys and subkeys in the standard key
|
|
listing. This is a list of letters indicating the allowed usage for a
|
|
key (<B>E</B>=encryption, <B>S</B>=signing, <B>C</B>=certification,
|
|
<B>A</B>=authentication). Defaults to yes.
|
|
<P>
|
|
<DT id="125"><B>show-policy-urls</B>
|
|
|
|
<DD>
|
|
Show policy URLs in the <B>--check-signatures</B>
|
|
listings. Defaults to no.
|
|
<P>
|
|
<DT id="126"><B>show-notations</B>
|
|
|
|
<DD>
|
|
|
|
<B>show-std-notations</B>
|
|
|
|
|
|
<B>show-user-notations</B>
|
|
|
|
Show all, IETF standard, or user-defined signature notations in the
|
|
<B>--check-signatures</B> listings. Defaults to no.
|
|
<P>
|
|
<DT id="127"><B>show-keyserver-urls</B>
|
|
|
|
<DD>
|
|
Show any preferred keyserver URL in the
|
|
<B>--check-signatures</B> listings. Defaults to no.
|
|
<P>
|
|
<DT id="128"><B>show-uid-validity</B>
|
|
|
|
<DD>
|
|
Display the calculated validity of user IDs during key listings.
|
|
Defaults to yes.
|
|
<P>
|
|
<DT id="129"><B>show-unusable-uids</B>
|
|
|
|
<DD>
|
|
Show revoked and expired user IDs in key listings. Defaults to no.
|
|
<P>
|
|
<DT id="130"><B>show-unusable-subkeys</B>
|
|
|
|
<DD>
|
|
Show revoked and expired subkeys in key listings. Defaults to no.
|
|
<P>
|
|
<DT id="131"><B>show-keyring</B>
|
|
|
|
<DD>
|
|
Display the keyring name at the head of key listings to show which
|
|
keyring a given key resides on. Defaults to no.
|
|
<P>
|
|
<DT id="132"><B>show-sig-expire</B>
|
|
|
|
<DD>
|
|
Show signature expiration dates (if any) during
|
|
<B>--check-signatures</B> listings. Defaults to no.
|
|
<P>
|
|
<DT id="133"><B>show-sig-subpackets</B>
|
|
|
|
<DD>
|
|
Include signature subpackets in the key listing. This option can take an
|
|
optional argument list of the subpackets to list. If no argument is
|
|
passed, list all subpackets. Defaults to no. This option is only
|
|
meaningful when using <B>--with-colons</B> along with
|
|
<B>--check-signatures</B>.
|
|
<P>
|
|
<DT id="134"><B>show-only-fpr-mbox</B>
|
|
|
|
<DD>
|
|
For each user-id which has a valid mail address print
|
|
only the fingerprint followed by the mail address.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="135"><B>--verify-options </B><I>parameters</I>
|
|
|
|
<DD>
|
|
This is a space or comma delimited string that gives options used when
|
|
verifying signatures. Options can be prepended with a `no-' to give
|
|
the opposite meaning. The options are:
|
|
<P>
|
|
<DL COMPACT><DT id="136"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="137"><B>show-photos</B>
|
|
|
|
<DD>
|
|
Display any photo IDs present on the key that issued the signature.
|
|
Defaults to no. See also <B>--photo-viewer</B>.
|
|
<P>
|
|
<DT id="138"><B>show-policy-urls</B>
|
|
|
|
<DD>
|
|
Show policy URLs in the signature being verified. Defaults to yes.
|
|
<P>
|
|
<DT id="139"><B>show-notations</B>
|
|
|
|
<DD>
|
|
|
|
<B>show-std-notations</B>
|
|
|
|
|
|
<B>show-user-notations</B>
|
|
|
|
Show all, IETF standard, or user-defined signature notations in the
|
|
signature being verified. Defaults to IETF standard.
|
|
<P>
|
|
<DT id="140"><B>show-keyserver-urls</B>
|
|
|
|
<DD>
|
|
Show any preferred keyserver URL in the signature being verified.
|
|
Defaults to yes.
|
|
<P>
|
|
<DT id="141"><B>show-uid-validity</B>
|
|
|
|
<DD>
|
|
Display the calculated validity of the user IDs on the key that issued
|
|
the signature. Defaults to yes.
|
|
<P>
|
|
<DT id="142"><B>show-unusable-uids</B>
|
|
|
|
<DD>
|
|
Show revoked and expired user IDs during signature verification.
|
|
Defaults to no.
|
|
<P>
|
|
<DT id="143"><B>show-primary-uid-only</B>
|
|
|
|
<DD>
|
|
Show only the primary user ID during signature verification. That is
|
|
all the AKA lines as well as photo Ids are not shown with the signature
|
|
verification status.
|
|
<P>
|
|
<DT id="144"><B>pka-lookups</B>
|
|
|
|
<DD>
|
|
Enable PKA lookups to verify sender addresses. Note that PKA is based
|
|
on DNS, and so enabling this option may disclose information on when
|
|
and what signatures are verified or to whom data is encrypted. This
|
|
is similar to the "web bug" described for the <B>--auto-key-retrieve</B>
|
|
option.
|
|
<P>
|
|
<DT id="145"><B>pka-trust-increase</B>
|
|
|
|
<DD>
|
|
Raise the trust in a signature to full if the signature passes PKA
|
|
validation. This option is only meaningful if pka-lookups is set.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="146"><B>--enable-large-rsa</B>
|
|
|
|
<DD>
|
|
|
|
<B>--disable-large-rsa</B>
|
|
|
|
With --generate-key and --batch, enable the creation of RSA secret keys as
|
|
large as 8192 bit. Note: 8192 bit is more than is generally
|
|
recommended. These large keys don't significantly improve security,
|
|
but they are more expensive to use, and their signatures and
|
|
certifications are larger. This option is only available if the
|
|
binary was build with large-secmem support.
|
|
<P>
|
|
<DT id="147"><B>--enable-dsa2</B>
|
|
|
|
<DD>
|
|
|
|
<B>--disable-dsa2</B>
|
|
|
|
Enable hash truncation for all DSA keys even for old DSA Keys up to
|
|
1024 bit. This is also the default with <B>--openpgp</B>. Note
|
|
that older versions of GnuPG also required this flag to allow the
|
|
generation of DSA larger than 1024 bit.
|
|
<P>
|
|
<DT id="148"><B>--photo-viewer </B><I>string</I>
|
|
|
|
<DD>
|
|
This is the command line that should be run to view a photo ID. "%i"
|
|
will be expanded to a filename containing the photo. "%I" does the
|
|
same, except the file will not be deleted once the viewer exits.
|
|
Other flags are "%k" for the key ID, "%K" for the long key ID, "%f"
|
|
for the key fingerprint, "%t" for the extension of the image type
|
|
(e.g. "jpg"), "%T" for the MIME type of the image (e.g. "image/jpeg"),
|
|
"%v" for the single-character calculated validity of the image being
|
|
viewed (e.g. "f"), "%V" for the calculated validity as a string (e.g.
|
|
"full"), "%U" for a base32 encoded hash of the user ID,
|
|
and "%%" for an actual percent sign. If neither %i or %I are present,
|
|
then the photo will be supplied to the viewer on standard input.
|
|
<P>
|
|
On Unix the default viewer is
|
|
<B>xloadimage -fork -quiet -title 'KeyID 0x%k' STDIN</B>
|
|
with a fallback to
|
|
<B>display -title 'KeyID 0x%k' %i</B>
|
|
and finally to
|
|
<B>xdg-open %i</B>.
|
|
On Windows
|
|
<B>!ShellExecute 400 %i</B> is used; here the command is a meta
|
|
command to use that API call followed by a wait time in milliseconds
|
|
which is used to give the viewer time to read the temporary image file
|
|
before gpg deletes it again. Note that if your image viewer program
|
|
is not secure, then executing it from gpg does not make it secure.
|
|
<P>
|
|
<DT id="149"><B>--exec-path </B><I>string</I>
|
|
|
|
<DD>
|
|
Sets a list of directories to search for photo viewers If not provided
|
|
photo viewers use the <B>PATH</B> environment variable.
|
|
<P>
|
|
<DT id="150"><B>--keyring </B><I>file</I>
|
|
|
|
<DD>
|
|
Add <I>file</I> to the current list of keyrings. If <I>file</I> begins
|
|
with a tilde and a slash, these are replaced by the $HOME directory. If
|
|
the filename does not contain a slash, it is assumed to be in the GnuPG
|
|
home directory ("~/.gnupg" if <B>--homedir</B> or $GNUPGHOME is not
|
|
used).
|
|
<P>
|
|
Note that this adds a keyring to the current list. If the intent is to
|
|
use the specified keyring alone, use <B>--keyring</B> along with
|
|
<B>--no-default-keyring</B>.
|
|
<P>
|
|
If the option <B>--no-keyring</B> has been used no keyrings will
|
|
be used at all.
|
|
<P>
|
|
<P>
|
|
<DT id="151"><B>--secret-keyring </B><I>file</I>
|
|
|
|
<DD>
|
|
This is an obsolete option and ignored. All secret keys are stored in
|
|
the '<I>private-keys-v1.d</I>' directory below the GnuPG home directory.
|
|
<P>
|
|
<DT id="152"><B>--primary-keyring </B><I>file</I>
|
|
|
|
<DD>
|
|
Designate <I>file</I> as the primary public keyring. This means that
|
|
newly imported keys (via <B>--import</B> or keyserver
|
|
<B>--recv-from</B>) will go to this keyring.
|
|
<P>
|
|
<DT id="153"><B>--trustdb-name </B><I>file</I>
|
|
|
|
<DD>
|
|
Use <I>file</I> instead of the default trustdb. If <I>file</I> begins
|
|
with a tilde and a slash, these are replaced by the $HOME directory. If
|
|
the filename does not contain a slash, it is assumed to be in the GnuPG
|
|
home directory ('<I>~/.gnupg</I>' if <B>--homedir</B> or $GNUPGHOME is
|
|
not used).
|
|
<P>
|
|
<DT id="154"><B>--homedir </B><I>dir</I>
|
|
|
|
<DD>
|
|
Set the name of the home directory to <I>dir</I>. If this option is not
|
|
used, the home directory defaults to '<I>~/.gnupg</I>'. It is only
|
|
recognized when given on the command line. It also overrides any home
|
|
directory stated through the environment variable '<I>GNUPGHOME</I>' or
|
|
(on Windows systems) by means of the Registry entry
|
|
<I>HKCU\Software\GNU\GnuPG:HomeDir</I>.
|
|
<P>
|
|
On Windows systems it is possible to install GnuPG as a portable
|
|
application. In this case only this command line option is
|
|
considered, all other ways to set a home directory are ignored.
|
|
<P>
|
|
To install GnuPG as a portable application under Windows, create an
|
|
empty file named '<I>gpgconf.ctl</I>' in the same directory as the tool
|
|
'<I>gpgconf.exe</I>'. The root of the installation is then that
|
|
directory; or, if '<I>gpgconf.exe</I>' has been installed directly below
|
|
a directory named '<I>bin</I>', its parent directory. You also need to
|
|
make sure that the following directories exist and are writable:
|
|
'<I>ROOT/home</I>' for the GnuPG home and '<I>ROOT/var/cache/gnupg</I>'
|
|
for internal cache files.
|
|
<P>
|
|
<P>
|
|
<DT id="155"><B>--display-charset </B><I>name</I>
|
|
|
|
<DD>
|
|
Set the name of the native character set. This is used to convert
|
|
some informational strings like user IDs to the proper UTF-8 encoding.
|
|
Note that this has nothing to do with the character set of data to be
|
|
encrypted or signed; GnuPG does not recode user-supplied data. If
|
|
this option is not used, the default character set is determined from
|
|
the current locale. A verbosity level of 3 shows the chosen set.
|
|
Valid values for <I>name</I> are:
|
|
<P>
|
|
<DL COMPACT><DT id="156"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="157"><B>iso-8859-1</B>
|
|
|
|
<DD>
|
|
This is the Latin 1 set.
|
|
<P>
|
|
<DT id="158"><B>iso-8859-2</B>
|
|
|
|
<DD>
|
|
The Latin 2 set.
|
|
<P>
|
|
<DT id="159"><B>iso-8859-15</B>
|
|
|
|
<DD>
|
|
This is currently an alias for
|
|
the Latin 1 set.
|
|
<P>
|
|
<DT id="160"><B>koi8-r</B>
|
|
|
|
<DD>
|
|
The usual Russian set (RFC-1489).
|
|
<P>
|
|
<DT id="161"><B>utf-8</B>
|
|
|
|
<DD>
|
|
Bypass all translations and assume
|
|
that the OS uses native UTF-8 encoding.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="162"><B>--utf8-strings</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-utf8-strings</B>
|
|
|
|
Assume that command line arguments are given as UTF-8 strings. The
|
|
default (<B>--no-utf8-strings</B>) is to assume that arguments are
|
|
encoded in the character set as specified by
|
|
<B>--display-charset</B>. These options affect all following
|
|
arguments. Both options may be used multiple times.
|
|
<P>
|
|
<P>
|
|
<DT id="163"><B>--options </B><I>file</I>
|
|
|
|
<DD>
|
|
Read options from <I>file</I> and do not try to read them from the
|
|
default options file in the homedir (see <B>--homedir</B>). This
|
|
option is ignored if used in an options file.
|
|
<P>
|
|
<DT id="164"><B>--no-options</B>
|
|
|
|
<DD>
|
|
Shortcut for <B>--options /dev/null</B>. This option is detected
|
|
before an attempt to open an option file. Using this option will also
|
|
prevent the creation of a '<I>~/.gnupg</I>' homedir.
|
|
<P>
|
|
<DT id="165"><B>-z </B><I>n</I>
|
|
|
|
<DD>
|
|
|
|
<B>--compress-level </B><I>n</I>
|
|
|
|
|
|
<B>--bzip2-compress-level </B><I>n</I>
|
|
|
|
Set compression level to <I>n</I> for the ZIP and ZLIB compression
|
|
algorithms. The default is to use the default compression level of zlib
|
|
(normally 6). <B>--bzip2-compress-level</B> sets the compression level
|
|
for the BZIP2 compression algorithm (defaulting to 6 as well). This is a
|
|
different option from <B>--compress-level</B> since BZIP2 uses a
|
|
significant amount of memory for each additional compression level.
|
|
<B>-z</B> sets both. A value of 0 for <I>n</I> disables compression.
|
|
<P>
|
|
<DT id="166"><B>--bzip2-decompress-lowmem</B>
|
|
|
|
<DD>
|
|
Use a different decompression method for BZIP2 compressed files. This
|
|
alternate method uses a bit more than half the memory, but also runs
|
|
at half the speed. This is useful under extreme low memory
|
|
circumstances when the file was originally compressed at a high
|
|
<B>--bzip2-compress-level</B>.
|
|
<P>
|
|
<P>
|
|
<DT id="167"><B>--mangle-dos-filenames</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-mangle-dos-filenames</B>
|
|
|
|
Older version of Windows cannot handle filenames with more than one
|
|
dot. <B>--mangle-dos-filenames</B> causes GnuPG to replace (rather
|
|
than add to) the extension of an output filename to avoid this
|
|
problem. This option is off by default and has no effect on non-Windows
|
|
platforms.
|
|
<P>
|
|
<DT id="168"><B>--ask-cert-level</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-ask-cert-level</B>
|
|
|
|
When making a key signature, prompt for a certification level. If this
|
|
option is not specified, the certification level used is set via
|
|
<B>--default-cert-level</B>. See <B>--default-cert-level</B> for
|
|
information on the specific levels and how they are
|
|
used. <B>--no-ask-cert-level</B> disables this option. This option
|
|
defaults to no.
|
|
<P>
|
|
<DT id="169"><B>--default-cert-level </B><I>n</I>
|
|
|
|
<DD>
|
|
The default to use for the check level when signing a key.
|
|
<P>
|
|
0 means you make no particular claim as to how carefully you verified
|
|
the key.
|
|
<P>
|
|
1 means you believe the key is owned by the person who claims to own
|
|
it but you could not, or did not verify the key at all. This is
|
|
useful for a "persona" verification, where you sign the key of a
|
|
pseudonymous user.
|
|
<P>
|
|
2 means you did casual verification of the key. For example, this
|
|
could mean that you verified the key fingerprint and checked the
|
|
user ID on the key against a photo ID.
|
|
<P>
|
|
3 means you did extensive verification of the key. For example, this
|
|
could mean that you verified the key fingerprint with the owner of the
|
|
key in person, and that you checked, by means of a hard to forge
|
|
document with a photo ID (such as a passport) that the name of the key
|
|
owner matches the name in the user ID on the key, and finally that you
|
|
verified (by exchange of email) that the email address on the key
|
|
belongs to the key owner.
|
|
<P>
|
|
Note that the examples given above for levels 2 and 3 are just that:
|
|
examples. In the end, it is up to you to decide just what "casual"
|
|
and "extensive" mean to you.
|
|
<P>
|
|
This option defaults to 0 (no particular claim).
|
|
<P>
|
|
<DT id="170"><B>--min-cert-level</B>
|
|
|
|
<DD>
|
|
When building the trust database, treat any signatures with a
|
|
certification level below this as invalid. Defaults to 2, which
|
|
disregards level 1 signatures. Note that level 0 "no particular
|
|
claim" signatures are always accepted.
|
|
<P>
|
|
<DT id="171"><B>--trusted-key </B><I>long key ID</I>
|
|
|
|
<DD>
|
|
Assume that the specified key (which must be given
|
|
as a full 8 byte key ID) is as trustworthy as one of
|
|
your own secret keys. This option is useful if you
|
|
don't want to keep your secret keys (or one of them)
|
|
online but still want to be able to check the validity of a given
|
|
recipient's or signator's key.
|
|
<P>
|
|
<DT id="172"><B>--trust-model {pgp|classic|tofu|tofu+pgp|direct|always|auto}</B>
|
|
|
|
<DD>
|
|
Set what trust model GnuPG should follow. The models are:
|
|
<P>
|
|
<DL COMPACT><DT id="173"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="174"><B>pgp</B>
|
|
|
|
<DD>
|
|
This is the Web of Trust combined with trust signatures as used in PGP
|
|
5.x and later. This is the default trust model when creating a new
|
|
trust database.
|
|
<P>
|
|
<DT id="175"><B>classic</B>
|
|
|
|
<DD>
|
|
This is the standard Web of Trust as introduced by PGP 2.
|
|
<P>
|
|
<DT id="176"><B>tofu</B>
|
|
|
|
<DD>
|
|
<P>
|
|
TOFU stands for Trust On First Use. In this trust model, the first
|
|
time a key is seen, it is memorized. If later another key with a
|
|
user id with the same email address is seen, both keys are marked as
|
|
suspect. In that case, the next time either is used, a warning is
|
|
displayed describing the conflict, why it might have occurred
|
|
(either the user generated a new key and failed to cross sign the
|
|
old and new keys, the key is forgery, or a man-in-the-middle attack
|
|
is being attempted), and the user is prompted to manually confirm
|
|
the validity of the key in question.
|
|
<P>
|
|
Because a potential attacker is able to control the email address
|
|
and thereby circumvent the conflict detection algorithm by using an
|
|
email address that is similar in appearance to a trusted email
|
|
address, whenever a message is verified, statistics about the number
|
|
of messages signed with the key are shown. In this way, a user can
|
|
easily identify attacks using fake keys for regular correspondents.
|
|
<P>
|
|
When compared with the Web of Trust, TOFU offers significantly
|
|
weaker security guarantees. In particular, TOFU only helps ensure
|
|
consistency (that is, that the binding between a key and email
|
|
address doesn't change). A major advantage of TOFU is that it
|
|
requires little maintenance to use correctly. To use the web of
|
|
trust properly, you need to actively sign keys and mark users as
|
|
trusted introducers. This is a time-consuming process and anecdotal
|
|
evidence suggests that even security-conscious users rarely take the
|
|
time to do this thoroughly and instead rely on an ad-hoc TOFU
|
|
process.
|
|
<P>
|
|
In the TOFU model, policies are associated with bindings between
|
|
keys and email addresses (which are extracted from user ids and
|
|
normalized). There are five policies, which can be set manually
|
|
using the <B>--tofu-policy</B> option. The default policy can be
|
|
set using the <B>--tofu-default-policy</B> option.
|
|
<P>
|
|
The TOFU policies are: <B>auto</B>, <B>good</B>, <B>unknown</B>,
|
|
<B>bad</B> and <B>ask</B>. The <B>auto</B> policy is used by
|
|
default (unless overridden by <B>--tofu-default-policy</B>) and
|
|
marks a binding as marginally trusted. The <B>good</B>,
|
|
<B>unknown</B> and <B>bad</B> policies mark a binding as fully
|
|
trusted, as having unknown trust or as having trust never,
|
|
respectively. The <B>unknown</B> policy is useful for just using
|
|
TOFU to detect conflicts, but to never assign positive trust to a
|
|
binding. The final policy, <B>ask</B> prompts the user to indicate
|
|
the binding's trust. If batch mode is enabled (or input is
|
|
inappropriate in the context), then the user is not prompted and the
|
|
<B>undefined</B> trust level is returned.
|
|
<P>
|
|
<DT id="177"><B>tofu+pgp</B>
|
|
|
|
<DD>
|
|
This trust model combines TOFU with the Web of Trust. This is done
|
|
by computing the trust level for each model and then taking the
|
|
maximum trust level where the trust levels are ordered as follows:
|
|
<B>unknown < undefined < marginal < fully < ultimate < expired <
|
|
never</B>.
|
|
<P>
|
|
By setting <B>--tofu-default-policy=unknown</B>, this model can be
|
|
used to implement the web of trust with TOFU's conflict detection
|
|
algorithm, but without its assignment of positive trust values,
|
|
which some security-conscious users don't like.
|
|
<P>
|
|
<DT id="178"><B>direct</B>
|
|
|
|
<DD>
|
|
Key validity is set directly by the user and not calculated via the
|
|
Web of Trust. This model is solely based on the key and does
|
|
not distinguish user IDs. Note that when changing to another trust
|
|
model the trust values assigned to a key are transformed into
|
|
ownertrust values, which also indicate how you trust the owner of
|
|
the key to sign other keys.
|
|
<P>
|
|
<DT id="179"><B>always</B>
|
|
|
|
<DD>
|
|
Skip key validation and assume that used keys are always fully
|
|
valid. You generally won't use this unless you are using some
|
|
external validation scheme. This option also suppresses the
|
|
"[uncertain]" tag printed with signature checks when there is no
|
|
evidence that the user ID is bound to the key. Note that this
|
|
trust model still does not allow the use of expired, revoked, or
|
|
disabled keys.
|
|
<P>
|
|
<DT id="180"><B>auto</B>
|
|
|
|
<DD>
|
|
Select the trust model depending on whatever the internal trust
|
|
database says. This is the default model if such a database already
|
|
exists. Note that a tofu trust model is not considered here and
|
|
must be enabled explicitly.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="181"><B>--auto-key-locate </B><I>mechanisms</I>
|
|
|
|
<DD>
|
|
|
|
<B>--no-auto-key-locate</B>
|
|
|
|
GnuPG can automatically locate and retrieve keys as needed using this
|
|
option. This happens when encrypting to an email address (in the
|
|
"<A HREF="mailto:user@example.com">user@example.com</A>" form), and there are no "<A HREF="mailto:user@example.com">user@example.com</A>" keys
|
|
on the local keyring. This option takes any number of the mechanisms
|
|
listed below, in the order they are to be tried. Instead of listing
|
|
the mechanisms as comma delimited arguments, the option may also be
|
|
given several times to add more mechanism. The option
|
|
<B>--no-auto-key-locate</B> or the mechanism "clear" resets the
|
|
list. The default is "local,wkd".
|
|
<P>
|
|
<DL COMPACT><DT id="182"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="183"><B>cert</B>
|
|
|
|
<DD>
|
|
Locate a key using DNS CERT, as specified in RFC-4398.
|
|
<P>
|
|
<DT id="184"><B>pka</B>
|
|
|
|
<DD>
|
|
Locate a key using DNS PKA.
|
|
<P>
|
|
<DT id="185"><B>dane</B>
|
|
|
|
<DD>
|
|
Locate a key using DANE, as specified
|
|
in draft-ietf-dane-openpgpkey-05.txt.
|
|
<P>
|
|
<DT id="186"><B>wkd</B>
|
|
|
|
<DD>
|
|
Locate a key using the Web Key Directory protocol.
|
|
<P>
|
|
<DT id="187"><B>ldap</B>
|
|
|
|
<DD>
|
|
Using DNS Service Discovery, check the domain in question for any LDAP
|
|
keyservers to use. If this fails, attempt to locate the key using the
|
|
PGP Universal method of checking '<A HREF="ldap://keys.(thedomain)'.">ldap://keys.(thedomain)'.</A>
|
|
<P>
|
|
<DT id="188"><B>keyserver</B>
|
|
|
|
<DD>
|
|
Locate a key using a keyserver.
|
|
<P>
|
|
<DT id="189"><B>keyserver-URL</B>
|
|
|
|
<DD>
|
|
In addition, a keyserver URL as used in the <B>dirmngr</B>
|
|
configuration may be used here to query that particular keyserver.
|
|
<P>
|
|
<DT id="190"><B>local</B>
|
|
|
|
<DD>
|
|
Locate the key using the local keyrings. This mechanism allows the user to
|
|
select the order a local key lookup is done. Thus using
|
|
'--auto-key-locate local' is identical to
|
|
<B>--no-auto-key-locate</B>.
|
|
<P>
|
|
<DT id="191"><B>nodefault</B>
|
|
|
|
<DD>
|
|
This flag disables the standard local key lookup, done before any of the
|
|
mechanisms defined by the <B>--auto-key-locate</B> are tried. The
|
|
position of this mechanism in the list does not matter. It is not
|
|
required if <B>local</B> is also used.
|
|
<P>
|
|
<DT id="192"><B>clear</B>
|
|
|
|
<DD>
|
|
Clear all defined mechanisms. This is useful to override
|
|
mechanisms given in a config file. Note that a <B>nodefault</B> in
|
|
<I>mechanisms</I> will also be cleared unless it is given after the
|
|
<B>clear</B>.
|
|
<P>
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="193"><B>--auto-key-retrieve</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-auto-key-retrieve</B>
|
|
|
|
These options enable or disable the automatic retrieving of keys from
|
|
a keyserver when verifying signatures made by keys that are not on the
|
|
local keyring. The default is <B>--no-auto-key-retrieve</B>.
|
|
<P>
|
|
The order of methods tried to lookup the key is:
|
|
<P>
|
|
1. If a preferred keyserver is specified in the signature and the
|
|
option <B>honor-keyserver-url</B> is active (which is not the
|
|
default), that keyserver is tried. Note that the creator of the
|
|
signature uses the option <B>--sig-keyserver-url</B> to specify the
|
|
preferred keyserver for data signatures.
|
|
<P>
|
|
2. If the signature has the Signer's UID set (e.g. using
|
|
<B>--sender</B> while creating the signature) a Web Key Directory
|
|
(WKD) lookup is done. This is the default configuration but can be
|
|
disabled by removing WKD from the auto-key-locate list or by using the
|
|
option <B>--disable-signer-uid</B>.
|
|
<P>
|
|
3. If the option <B>honor-pka-record</B> is active, the legacy PKA
|
|
method is used.
|
|
<P>
|
|
4. If any keyserver is configured and the Issuer Fingerprint is part
|
|
of the signature (since GnuPG 2.1.16), the configured keyservers are
|
|
tried.
|
|
<P>
|
|
Note that this option makes a "web bug" like behavior possible.
|
|
Keyserver or Web Key Directory operators can see which keys you
|
|
request, so by sending you a message signed by a brand new key (which
|
|
you naturally will not have on your local keyring), the operator can
|
|
tell both your IP address and the time when you verified the
|
|
signature.
|
|
<P>
|
|
<DT id="194"><B>--keyid-format {none|short|0xshort|long|0xlong}</B>
|
|
|
|
<DD>
|
|
Select how to display key IDs. "none" does not show the key ID at all
|
|
but shows the fingerprint in a separate line. "short" is the
|
|
traditional 8-character key ID. "long" is the more accurate (but less
|
|
convenient) 16-character key ID. Add an "0x" to either to include an
|
|
"0x" at the beginning of the key ID, as in 0x99242560. Note that this
|
|
option is ignored if the option <B>--with-colons</B> is used.
|
|
<P>
|
|
<DT id="195"><B>--keyserver </B><I>name</I>
|
|
|
|
<DD>
|
|
This option is deprecated - please use the <B>--keyserver</B> in
|
|
'<I>dirmngr.conf</I>' instead.
|
|
<P>
|
|
Use <I>name</I> as your keyserver. This is the server that
|
|
<B>--receive-keys</B>, <B>--send-keys</B>, and <B>--search-keys</B>
|
|
will communicate with to receive keys from, send keys to, and search for
|
|
keys on. The format of the <I>name</I> is a URI:
|
|
`scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
|
|
"hkp" for the HTTP (or compatible) keyservers, "ldap" for the LDAP
|
|
keyservers, or "mailto" for the Graff email keyserver. Note that your
|
|
particular installation of GnuPG may have other keyserver types
|
|
available as well. Keyserver schemes are case-insensitive. After the
|
|
keyserver name, optional keyserver configuration options may be
|
|
provided. These are the same as the global <B>--keyserver-options</B>
|
|
from below, but apply only to this particular keyserver.
|
|
<P>
|
|
Most keyservers synchronize with each other, so there is generally no
|
|
need to send keys to more than one server. The keyserver
|
|
<B><A HREF="hkp://keys.gnupg.net">hkp://keys.gnupg.net</A></B> uses round robin DNS to give a different
|
|
keyserver each time you use it.
|
|
<P>
|
|
<DT id="196"><B>--keyserver-options {</B><I>name</I>=<I>value</I>}
|
|
|
|
<DD>
|
|
This is a space or comma delimited string that gives options for the
|
|
keyserver. Options can be prefixed with a `no-' to give the opposite
|
|
meaning. Valid import-options or export-options may be used here as
|
|
well to apply to importing (<B>--recv-key</B>) or exporting
|
|
(<B>--send-key</B>) a key from a keyserver. While not all options
|
|
are available for all keyserver types, some common options are:
|
|
<P>
|
|
<DL COMPACT><DT id="197"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="198"><B>include-revoked</B>
|
|
|
|
<DD>
|
|
When searching for a key with <B>--search-keys</B>, include keys that
|
|
are marked on the keyserver as revoked. Note that not all keyservers
|
|
differentiate between revoked and unrevoked keys, and for such
|
|
keyservers this option is meaningless. Note also that most keyservers do
|
|
not have cryptographic verification of key revocations, and so turning
|
|
this option off may result in skipping keys that are incorrectly marked
|
|
as revoked.
|
|
<P>
|
|
<DT id="199"><B>include-disabled</B>
|
|
|
|
<DD>
|
|
When searching for a key with <B>--search-keys</B>, include keys that
|
|
are marked on the keyserver as disabled. Note that this option is not
|
|
used with HKP keyservers.
|
|
<P>
|
|
<DT id="200"><B>auto-key-retrieve</B>
|
|
|
|
<DD>
|
|
This is an obsolete alias for the option <B>auto-key-retrieve</B>.
|
|
Please do not use it; it will be removed in future versions..
|
|
<P>
|
|
<DT id="201"><B>honor-keyserver-url</B>
|
|
|
|
<DD>
|
|
When using <B>--refresh-keys</B>, if the key in question has a preferred
|
|
keyserver URL, then use that preferred keyserver to refresh the key
|
|
from. In addition, if auto-key-retrieve is set, and the signature
|
|
being verified has a preferred keyserver URL, then use that preferred
|
|
keyserver to fetch the key from. Note that this option introduces a
|
|
"web bug": The creator of the key can see when the keys is
|
|
refreshed. Thus this option is not enabled by default.
|
|
<P>
|
|
<DT id="202"><B>honor-pka-record</B>
|
|
|
|
<DD>
|
|
If <B>--auto-key-retrieve</B> is used, and the signature being
|
|
verified has a PKA record, then use the PKA information to fetch
|
|
the key. Defaults to "yes".
|
|
<P>
|
|
<DT id="203"><B>include-subkeys</B>
|
|
|
|
<DD>
|
|
When receiving a key, include subkeys as potential targets. Note that
|
|
this option is not used with HKP keyservers, as they do not support
|
|
retrieving keys by subkey id.
|
|
<P>
|
|
<DT id="204"><B>timeout</B>
|
|
|
|
<DD>
|
|
|
|
<B>http-proxy=</B><I>value</I>
|
|
|
|
|
|
<B>verbose</B>
|
|
|
|
|
|
<B>debug</B>
|
|
|
|
|
|
<B>check-cert</B>
|
|
|
|
<DT id="205"><B>ca-cert-file</B>
|
|
|
|
<DD>
|
|
These options have no more function since GnuPG 2.1. Use the
|
|
<B>dirmngr</B> configuration options instead.
|
|
<P>
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
The default list of options is: "self-sigs-only,
|
|
repair-keys, repair-pks-subkey-bug, export-attributes,
|
|
honor-pka-record".
|
|
<P>
|
|
<P>
|
|
<DT id="206"><B>--completes-needed </B><I>n</I>
|
|
|
|
<DD>
|
|
Number of completely trusted users to introduce a new
|
|
key signer (defaults to 1).
|
|
<P>
|
|
<DT id="207"><B>--marginals-needed </B><I>n</I>
|
|
|
|
<DD>
|
|
Number of marginally trusted users to introduce a new
|
|
key signer (defaults to 3)
|
|
<P>
|
|
<DT id="208"><B>--tofu-default-policy {auto|good|unknown|bad|ask}</B>
|
|
|
|
<DD>
|
|
The default TOFU policy (defaults to <B>auto</B>). For more
|
|
information about the meaning of this option, see: [trust-model-tofu].
|
|
<P>
|
|
<DT id="209"><B>--max-cert-depth </B><I>n</I>
|
|
|
|
<DD>
|
|
Maximum depth of a certification chain (default is 5).
|
|
<P>
|
|
<DT id="210"><B>--no-sig-cache</B>
|
|
|
|
<DD>
|
|
Do not cache the verification status of key signatures.
|
|
Caching gives a much better performance in key listings. However, if
|
|
you suspect that your public keyring is not safe against write
|
|
modifications, you can use this option to disable the caching. It
|
|
probably does not make sense to disable it because all kind of damage
|
|
can be done if someone else has write access to your public keyring.
|
|
<P>
|
|
<DT id="211"><B>--auto-check-trustdb</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-auto-check-trustdb</B>
|
|
|
|
If GnuPG feels that its information about the Web of Trust has to be
|
|
updated, it automatically runs the <B>--check-trustdb</B> command
|
|
internally. This may be a time consuming
|
|
process. <B>--no-auto-check-trustdb</B> disables this option.
|
|
<P>
|
|
<DT id="212"><B>--use-agent</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-use-agent</B>
|
|
|
|
This is dummy option. <B>gpg</B> always requires the agent.
|
|
<P>
|
|
<DT id="213"><B>--gpg-agent-info</B>
|
|
|
|
<DD>
|
|
This is dummy option. It has no effect when used with <B>gpg</B>.
|
|
<P>
|
|
<P>
|
|
<DT id="214"><B>--agent-program </B><I>file</I>
|
|
|
|
<DD>
|
|
Specify an agent program to be used for secret key operations. The
|
|
default value is determined by running <B>gpgconf</B> with the
|
|
option <B>--list-dirs</B>. Note that the pipe symbol (<B>|</B>) is
|
|
used for a regression test suite hack and may thus not be used in the
|
|
file name.
|
|
<P>
|
|
<DT id="215"><B>--dirmngr-program </B><I>file</I>
|
|
|
|
<DD>
|
|
Specify a dirmngr program to be used for keyserver access. The
|
|
default value is '<I>/usr/bin/dirmngr</I>'.
|
|
<P>
|
|
<DT id="216"><B>--disable-dirmngr</B>
|
|
|
|
<DD>
|
|
Entirely disable the use of the Dirmngr.
|
|
<P>
|
|
<DT id="217"><B>--no-autostart</B>
|
|
|
|
<DD>
|
|
Do not start the gpg-agent or the dirmngr if it has not yet been
|
|
started and its service is required. This option is mostly useful on
|
|
machines where the connection to gpg-agent has been redirected to
|
|
another machines. If dirmngr is required on the remote machine, it
|
|
may be started manually using <B>gpgconf --launch dirmngr</B>.
|
|
<P>
|
|
<DT id="218"><B>--lock-once</B>
|
|
|
|
<DD>
|
|
Lock the databases the first time a lock is requested
|
|
and do not release the lock until the process
|
|
terminates.
|
|
<P>
|
|
<DT id="219"><B>--lock-multiple</B>
|
|
|
|
<DD>
|
|
Release the locks every time a lock is no longer
|
|
needed. Use this to override a previous <B>--lock-once</B>
|
|
from a config file.
|
|
<P>
|
|
<DT id="220"><B>--lock-never</B>
|
|
|
|
<DD>
|
|
Disable locking entirely. This option should be used only in very
|
|
special environments, where it can be assured that only one process
|
|
is accessing those files. A bootable floppy with a stand-alone
|
|
encryption system will probably use this. Improper usage of this
|
|
option may lead to data and key corruption.
|
|
<P>
|
|
<DT id="221"><B>--exit-on-status-write-error</B>
|
|
|
|
<DD>
|
|
This option will cause write errors on the status FD to immediately
|
|
terminate the process. That should in fact be the default but it never
|
|
worked this way and thus we need an option to enable this, so that the
|
|
change won't break applications which close their end of a status fd
|
|
connected pipe too early. Using this option along with
|
|
<B>--enable-progress-filter</B> may be used to cleanly cancel long
|
|
running gpg operations.
|
|
<P>
|
|
<DT id="222"><B>--limit-card-insert-tries </B><I>n</I>
|
|
|
|
<DD>
|
|
With <I>n</I> greater than 0 the number of prompts asking to insert a
|
|
smartcard gets limited to N-1. Thus with a value of 1 gpg won't at
|
|
all ask to insert a card if none has been inserted at startup. This
|
|
option is useful in the configuration file in case an application does
|
|
not know about the smartcard support and waits ad infinitum for an
|
|
inserted card.
|
|
<P>
|
|
<DT id="223"><B>--no-random-seed-file</B>
|
|
|
|
<DD>
|
|
GnuPG uses a file to store its internal random pool over invocations.
|
|
This makes random generation faster; however sometimes write operations
|
|
are not desired. This option can be used to achieve that with the cost of
|
|
slower random generation.
|
|
<P>
|
|
<DT id="224"><B>--no-greeting</B>
|
|
|
|
<DD>
|
|
Suppress the initial copyright message.
|
|
<P>
|
|
<DT id="225"><B>--no-secmem-warning</B>
|
|
|
|
<DD>
|
|
Suppress the warning about "using insecure memory".
|
|
<P>
|
|
<DT id="226"><B>--no-permission-warning</B>
|
|
|
|
<DD>
|
|
Suppress the warning about unsafe file and home directory (<B>--homedir</B>)
|
|
permissions. Note that the permission checks that GnuPG performs are
|
|
not intended to be authoritative, but rather they simply warn about
|
|
certain common permission problems. Do not assume that the lack of a
|
|
warning means that your system is secure.
|
|
<P>
|
|
Note that the warning for unsafe <B>--homedir</B> permissions cannot be
|
|
suppressed in the gpg.conf file, as this would allow an attacker to
|
|
place an unsafe gpg.conf file in place, and use this file to suppress
|
|
warnings about itself. The <B>--homedir</B> permissions warning may only be
|
|
suppressed on the command line.
|
|
<P>
|
|
<DT id="227"><B>--require-secmem</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-require-secmem</B>
|
|
|
|
Refuse to run if GnuPG cannot get secure memory. Defaults to no
|
|
(i.e. run, but give a warning).
|
|
<P>
|
|
<P>
|
|
<DT id="228"><B>--require-cross-certification</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-require-cross-certification</B>
|
|
|
|
When verifying a signature made from a subkey, ensure that the cross
|
|
certification "back signature" on the subkey is present and valid. This
|
|
protects against a subtle attack against subkeys that can sign.
|
|
Defaults to <B>--require-cross-certification</B> for
|
|
<B>gpg</B>.
|
|
<P>
|
|
<DT id="229"><B>--expert</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-expert</B>
|
|
|
|
Allow the user to do certain nonsensical or "silly" things like
|
|
signing an expired or revoked key, or certain potentially incompatible
|
|
things like generating unusual key types. This also disables certain
|
|
warning messages about potentially incompatible actions. As the name
|
|
implies, this option is for experts only. If you don't fully
|
|
understand the implications of what it allows you to do, leave this
|
|
off. <B>--no-expert</B> disables this option.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAN"> </A>
|
|
<H3>Key related options</H3>
|
|
|
|
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="230"><B>--recipient </B><I>name</I>
|
|
|
|
<DD>
|
|
|
|
<B>-r</B>
|
|
|
|
Encrypt for user id <I>name</I>. If this option or
|
|
<B>--hidden-recipient</B> is not specified, GnuPG asks for the user-id
|
|
unless <B>--default-recipient</B> is given.
|
|
<P>
|
|
<DT id="231"><B>--hidden-recipient </B><I>name</I>
|
|
|
|
<DD>
|
|
|
|
<B>-R</B>
|
|
|
|
Encrypt for user ID <I>name</I>, but hide the key ID of this user's
|
|
key. This option helps to hide the receiver of the message and is a
|
|
limited countermeasure against traffic analysis. If this option or
|
|
<B>--recipient</B> is not specified, GnuPG asks for the user ID unless
|
|
<B>--default-recipient</B> is given.
|
|
<P>
|
|
<DT id="232"><B>--recipient-file </B><I>file</I>
|
|
|
|
<DD>
|
|
|
|
<B>-f</B>
|
|
|
|
This option is similar to <B>--recipient</B> except that it
|
|
encrypts to a key stored in the given file. <I>file</I> must be the
|
|
name of a file containing exactly one key. <B>gpg</B> assumes that
|
|
the key in this file is fully valid.
|
|
<P>
|
|
<DT id="233"><B>--hidden-recipient-file </B><I>file</I>
|
|
|
|
<DD>
|
|
|
|
<B>-F</B>
|
|
|
|
This option is similar to <B>--hidden-recipient</B> except that it
|
|
encrypts to a key stored in the given file. <I>file</I> must be the
|
|
name of a file containing exactly one key. <B>gpg</B> assumes that
|
|
the key in this file is fully valid.
|
|
<P>
|
|
<DT id="234"><B>--encrypt-to </B><I>name</I>
|
|
|
|
<DD>
|
|
Same as <B>--recipient</B> but this one is intended for use in the
|
|
options file and may be used with your own user-id as an
|
|
"encrypt-to-self". These keys are only used when there are other
|
|
recipients given either by use of <B>--recipient</B> or by the asked
|
|
user id. No trust checking is performed for these user ids and even
|
|
disabled keys can be used.
|
|
<P>
|
|
<DT id="235"><B>--hidden-encrypt-to </B><I>name</I>
|
|
|
|
<DD>
|
|
Same as <B>--hidden-recipient</B> but this one is intended for use in the
|
|
options file and may be used with your own user-id as a hidden
|
|
"encrypt-to-self". These keys are only used when there are other
|
|
recipients given either by use of <B>--recipient</B> or by the asked user id.
|
|
No trust checking is performed for these user ids and even disabled
|
|
keys can be used.
|
|
<P>
|
|
<DT id="236"><B>--no-encrypt-to</B>
|
|
|
|
<DD>
|
|
Disable the use of all <B>--encrypt-to</B> and
|
|
<B>--hidden-encrypt-to</B> keys.
|
|
<P>
|
|
<DT id="237"><B>--group {</B><I>name</I>=<I>value</I>}
|
|
|
|
<DD>
|
|
Sets up a named group, which is similar to aliases in email programs.
|
|
Any time the group name is a recipient (<B>-r</B> or
|
|
<B>--recipient</B>), it will be expanded to the values
|
|
specified. Multiple groups with the same name are automatically merged
|
|
into a single group.
|
|
<P>
|
|
The values are <B>key IDs</B> or fingerprints, but any key description
|
|
is accepted. Note that a value with spaces in it will be treated as
|
|
two different values. Note also there is only one level of expansion
|
|
--- you cannot make an group that points to another group. When used
|
|
from the command line, it may be necessary to quote the argument to
|
|
this option to prevent the shell from treating it as multiple
|
|
arguments.
|
|
<P>
|
|
<DT id="238"><B>--ungroup </B><I>name</I>
|
|
|
|
<DD>
|
|
Remove a given entry from the <B>--group</B> list.
|
|
<P>
|
|
<DT id="239"><B>--no-groups</B>
|
|
|
|
<DD>
|
|
Remove all entries from the <B>--group</B> list.
|
|
<P>
|
|
<DT id="240"><B>--local-user </B><I>name</I>
|
|
|
|
<DD>
|
|
|
|
<B>-u</B>
|
|
|
|
Use <I>name</I> as the key to sign with. Note that this option overrides
|
|
<B>--default-key</B>.
|
|
<P>
|
|
<DT id="241"><B>--sender </B><I>mbox</I>
|
|
|
|
<DD>
|
|
This option has two purposes. <I>mbox</I> must either be a complete
|
|
user id with a proper mail address or just a mail address. When
|
|
creating a signature this option tells gpg the user id of a key used
|
|
to make a signature if the key was not directly specified by a user
|
|
id. When verifying a signature the <I>mbox</I> is used to restrict the
|
|
information printed by the TOFU code to matching user ids.
|
|
<P>
|
|
<DT id="242"><B>--try-secret-key </B><I>name</I>
|
|
|
|
<DD>
|
|
For hidden recipients GPG needs to know the keys to use for trial
|
|
decryption. The key set with <B>--default-key</B> is always tried
|
|
first, but this is often not sufficient. This option allows setting more
|
|
keys to be used for trial decryption. Although any valid user-id
|
|
specification may be used for <I>name</I> it makes sense to use at least
|
|
the long keyid to avoid ambiguities. Note that gpg-agent might pop up a
|
|
pinentry for a lot keys to do the trial decryption. If you want to stop
|
|
all further trial decryption you may use close-window button instead of
|
|
the cancel button.
|
|
<P>
|
|
<DT id="243"><B>--try-all-secrets</B>
|
|
|
|
<DD>
|
|
Don't look at the key ID as stored in the message but try all secret
|
|
keys in turn to find the right decryption key. This option forces the
|
|
behaviour as used by anonymous recipients (created by using
|
|
<B>--throw-keyids</B> or <B>--hidden-recipient</B>) and might come
|
|
handy in case where an encrypted message contains a bogus key ID.
|
|
<P>
|
|
<DT id="244"><B>--skip-hidden-recipients</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-skip-hidden-recipients</B>
|
|
|
|
During decryption skip all anonymous recipients. This option helps in
|
|
the case that people use the hidden recipients feature to hide their
|
|
own encrypt-to key from others. If one has many secret keys this
|
|
may lead to a major annoyance because all keys are tried in turn to
|
|
decrypt something which was not really intended for it. The drawback
|
|
of this option is that it is currently not possible to decrypt a
|
|
message which includes real anonymous recipients.
|
|
<P>
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAO"> </A>
|
|
<H3>Input and Output</H3>
|
|
|
|
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="245"><B>--armor</B>
|
|
|
|
<DD>
|
|
|
|
<B>-a</B>
|
|
|
|
Create ASCII armored output. The default is to create the binary
|
|
OpenPGP format.
|
|
<P>
|
|
<DT id="246"><B>--no-armor</B>
|
|
|
|
<DD>
|
|
Assume the input data is not in ASCII armored format.
|
|
<P>
|
|
<DT id="247"><B>--output </B><I>file</I>
|
|
|
|
<DD>
|
|
|
|
<B>-o </B><I>file</I>
|
|
|
|
Write output to <I>file</I>. To write to stdout use <B>-</B> as the
|
|
filename.
|
|
<P>
|
|
<DT id="248"><B>--max-output </B><I>n</I>
|
|
|
|
<DD>
|
|
This option sets a limit on the number of bytes that will be generated
|
|
when processing a file. Since OpenPGP supports various levels of
|
|
compression, it is possible that the plaintext of a given message may be
|
|
significantly larger than the original OpenPGP message. While GnuPG
|
|
works properly with such messages, there is often a desire to set a
|
|
maximum file size that will be generated before processing is forced to
|
|
stop by the OS limits. Defaults to 0, which means "no limit".
|
|
<P>
|
|
<DT id="249"><B>--input-size-hint </B><I>n</I>
|
|
|
|
<DD>
|
|
This option can be used to tell GPG the size of the input data in
|
|
bytes. <I>n</I> must be a positive base-10 number. This option is
|
|
only useful if the input is not taken from a file. GPG may use this
|
|
hint to optimize its buffer allocation strategy. It is also used by
|
|
the <B>--status-fd</B> line ``PROGRESS'' to provide a value for
|
|
``total'' if that is not available by other means.
|
|
<P>
|
|
<DT id="250"><B>--key-origin </B><I>string</I>[,<I>url</I>]
|
|
|
|
<DD>
|
|
gpg can track the origin of a key. Certain origins are implicitly
|
|
known (e.g. keyserver, web key directory) and set. For a standard
|
|
import the origin of the keys imported can be set with this option.
|
|
To list the possible values use "help" for <I>string</I>. Some origins
|
|
can store an optional <I>url</I> argument. That URL can appended to
|
|
<I>string</I> after a comma.
|
|
<P>
|
|
<DT id="251"><B>--import-options </B><I>parameters</I>
|
|
|
|
<DD>
|
|
This is a space or comma delimited string that gives options for
|
|
importing keys. Options can be prepended with a `no-' to give the
|
|
opposite meaning. The options are:
|
|
<P>
|
|
<DL COMPACT><DT id="252"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="253"><B>import-local-sigs</B>
|
|
|
|
<DD>
|
|
Allow importing key signatures marked as "local". This is not
|
|
generally useful unless a shared keyring scheme is being used.
|
|
Defaults to no.
|
|
<P>
|
|
<DT id="254"><B>keep-ownertrust</B>
|
|
|
|
<DD>
|
|
Normally possible still existing ownertrust values of a key are
|
|
cleared if a key is imported. This is in general desirable so that
|
|
a formerly deleted key does not automatically gain an ownertrust
|
|
values merely due to import. On the other hand it is sometimes
|
|
necessary to re-import a trusted set of keys again but keeping
|
|
already assigned ownertrust values. This can be achieved by using
|
|
this option.
|
|
<P>
|
|
<DT id="255"><B>repair-pks-subkey-bug</B>
|
|
|
|
<DD>
|
|
During import, attempt to repair the damage caused by the PKS keyserver
|
|
bug (pre version 0.9.6) that mangles keys with multiple subkeys. Note
|
|
that this cannot completely repair the damaged key as some crucial data
|
|
is removed by the keyserver, but it does at least give you back one
|
|
subkey. Defaults to no for regular <B>--import</B> and to yes for
|
|
keyserver <B>--receive-keys</B>.
|
|
<P>
|
|
<DT id="256"><B>import-show</B>
|
|
|
|
<DD>
|
|
|
|
<B>show-only</B>
|
|
|
|
Show a listing of the key as imported right before it is stored.
|
|
This can be combined with the option <B>--dry-run</B> to only look
|
|
at keys; the option <B>show-only</B> is a shortcut for this
|
|
combination. The command <B>--show-keys</B> is another shortcut
|
|
for this. Note that suffixes like '#' for "sec" and "sbb" lines
|
|
may or may not be printed.
|
|
<P>
|
|
<DT id="257"><B>import-export</B>
|
|
|
|
<DD>
|
|
Run the entire import code but instead of storing the key to the
|
|
local keyring write it to the output. The export options
|
|
<B>export-pka</B> and <B>export-dane</B> affect the output. This
|
|
option can be used to remove all invalid parts from a key without the
|
|
need to store it.
|
|
<P>
|
|
<DT id="258"><B>merge-only</B>
|
|
|
|
<DD>
|
|
During import, allow key updates to existing keys, but do not allow
|
|
any new keys to be imported. Defaults to no.
|
|
<P>
|
|
<DT id="259"><B>import-clean</B>
|
|
|
|
<DD>
|
|
After import, compact (remove all signatures except the
|
|
self-signature) any user IDs from the new key that are not usable.
|
|
Then, remove any signatures from the new key that are not usable.
|
|
This includes signatures that were issued by keys that are not present
|
|
on the keyring. This option is the same as running the <B>--edit-key</B>
|
|
command "clean" after import. Defaults to no.
|
|
<P>
|
|
<DT id="260"><B>self-sigs-only</B>
|
|
|
|
<DD>
|
|
Accept only self-signatures while importing a key. All other key
|
|
signatures are skipped at an early import stage. This option can be
|
|
used with <B>keyserver-options</B> to mitigate attempts to flood a
|
|
key with bogus signatures from a keyserver. The drawback is that
|
|
all other valid key signatures, as required by the Web of Trust are
|
|
also not imported. Note that when using this option along with
|
|
import-clean it suppresses the final clean step after merging the
|
|
imported key into the existing key.
|
|
<P>
|
|
<DT id="261"><B>repair-keys</B>
|
|
|
|
<DD>
|
|
After import, fix various problems with the
|
|
keys. For example, this reorders signatures, and strips duplicate
|
|
signatures. Defaults to yes.
|
|
<P>
|
|
<DT id="262"><B>import-minimal</B>
|
|
|
|
<DD>
|
|
Import the smallest key possible. This removes all signatures except
|
|
the most recent self-signature on each user ID. This option is the
|
|
same as running the <B>--edit-key</B> command "minimize" after import.
|
|
Defaults to no.
|
|
<P>
|
|
<DT id="263"><B>restore</B>
|
|
|
|
<DD>
|
|
|
|
<B>import-restore</B>
|
|
|
|
Import in key restore mode. This imports all data which is usually
|
|
skipped during import; including all GnuPG specific data. All other
|
|
contradicting options are overridden.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="264"><B>--import-filter {</B><I>name</I>=<I>expr</I>}
|
|
|
|
<DD>
|
|
|
|
<B>--export-filter {</B><I>name</I>=<I>expr</I>}
|
|
|
|
These options define an import/export filter which are applied to the
|
|
imported/exported keyblock right before it will be stored/written.
|
|
<I>name</I> defines the type of filter to use, <I>expr</I> the
|
|
expression to evaluate. The option can be used several times which
|
|
then appends more expression to the same <I>name</I>.
|
|
<P>
|
|
<P>
|
|
The available filter types are:
|
|
<P>
|
|
<DL COMPACT><DT id="265"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="266"><B>keep-uid</B>
|
|
|
|
<DD>
|
|
This filter will keep a user id packet and its dependent packets in
|
|
the keyblock if the expression evaluates to true.
|
|
<P>
|
|
<DT id="267"><B>drop-subkey</B>
|
|
|
|
<DD>
|
|
This filter drops the selected subkeys.
|
|
Currently only implemented for --export-filter.
|
|
<P>
|
|
<DT id="268"><B>drop-sig</B>
|
|
|
|
<DD>
|
|
This filter drops the selected key signatures on user ids.
|
|
Self-signatures are not considered.
|
|
Currently only implemented for --import-filter.
|
|
<P>
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
For the syntax of the expression see the chapter "FILTER EXPRESSIONS".
|
|
The property names for the expressions depend on the actual filter
|
|
type and are indicated in the following table.
|
|
<P>
|
|
The available properties are:
|
|
<P>
|
|
<DL COMPACT><DT id="269"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="270"><B>uid</B>
|
|
|
|
<DD>
|
|
A string with the user id. (keep-uid)
|
|
<P>
|
|
<DT id="271"><B>mbox</B>
|
|
|
|
<DD>
|
|
The addr-spec part of a user id with mailbox or the empty string.
|
|
(keep-uid)
|
|
<P>
|
|
<DT id="272"><B>key_algo</B>
|
|
|
|
<DD>
|
|
A number with the public key algorithm of a key or subkey packet.
|
|
(drop-subkey)
|
|
<P>
|
|
<DT id="273"><B>key_created</B>
|
|
|
|
<DD>
|
|
|
|
<B>key_created_d</B>
|
|
|
|
The first is the timestamp a public key or subkey packet was
|
|
created. The second is the same but given as an ISO string,
|
|
e.g. "2016-08-17". (drop-subkey)
|
|
<P>
|
|
<DT id="274"><B>primary</B>
|
|
|
|
<DD>
|
|
Boolean indicating whether the user id is the primary one. (keep-uid)
|
|
<P>
|
|
<DT id="275"><B>expired</B>
|
|
|
|
<DD>
|
|
Boolean indicating whether a user id (keep-uid), a key (drop-subkey), or a
|
|
signature (drop-sig) expired.
|
|
<P>
|
|
<DT id="276"><B>revoked</B>
|
|
|
|
<DD>
|
|
Boolean indicating whether a user id (keep-uid) or a key (drop-subkey) has
|
|
been revoked.
|
|
<P>
|
|
<DT id="277"><B>disabled</B>
|
|
|
|
<DD>
|
|
Boolean indicating whether a primary key is disabled. (not used)
|
|
<P>
|
|
<DT id="278"><B>secret</B>
|
|
|
|
<DD>
|
|
Boolean indicating whether a key or subkey is a secret one.
|
|
(drop-subkey)
|
|
<P>
|
|
<DT id="279"><B>usage</B>
|
|
|
|
<DD>
|
|
A string indicating the usage flags for the subkey, from the
|
|
sequence ``ecsa?''. For example, a subkey capable of just signing
|
|
and authentication would be an exact match for ``sa''. (drop-subkey)
|
|
<P>
|
|
<DT id="280"><B>sig_created</B>
|
|
|
|
<DD>
|
|
|
|
<B>sig_created_d</B>
|
|
|
|
The first is the timestamp a signature packet was created. The
|
|
second is the same but given as an ISO date string,
|
|
e.g. "2016-08-17". (drop-sig)
|
|
<P>
|
|
<DT id="281"><B>sig_algo</B>
|
|
|
|
<DD>
|
|
A number with the public key algorithm of a signature packet. (drop-sig)
|
|
<P>
|
|
<DT id="282"><B>sig_digest_algo</B>
|
|
|
|
<DD>
|
|
A number with the digest algorithm of a signature packet. (drop-sig)
|
|
<P>
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="283"><B>--export-options </B><I>parameters</I>
|
|
|
|
<DD>
|
|
This is a space or comma delimited string that gives options for
|
|
exporting keys. Options can be prepended with a `no-' to give the
|
|
opposite meaning. The options are:
|
|
<P>
|
|
<DL COMPACT><DT id="284"><DD>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="285"><B>export-local-sigs</B>
|
|
|
|
<DD>
|
|
Allow exporting key signatures marked as "local". This is not
|
|
generally useful unless a shared keyring scheme is being used.
|
|
Defaults to no.
|
|
<P>
|
|
<DT id="286"><B>export-attributes</B>
|
|
|
|
<DD>
|
|
Include attribute user IDs (photo IDs) while exporting. Not
|
|
including attribute user IDs is useful to export keys that are going
|
|
to be used by an OpenPGP program that does not accept attribute user
|
|
IDs. Defaults to yes.
|
|
<P>
|
|
<DT id="287"><B>export-sensitive-revkeys</B>
|
|
|
|
<DD>
|
|
Include designated revoker information that was marked as
|
|
"sensitive". Defaults to no.
|
|
<P>
|
|
<P>
|
|
<DT id="288"><B>backup</B>
|
|
|
|
<DD>
|
|
|
|
<B>export-backup</B>
|
|
|
|
Export for use as a backup. The exported data includes all data
|
|
which is needed to restore the key or keys later with GnuPG. The
|
|
format is basically the OpenPGP format but enhanced with GnuPG
|
|
specific data. All other contradicting options are overridden.
|
|
<P>
|
|
<DT id="289"><B>export-clean</B>
|
|
|
|
<DD>
|
|
Compact (remove all signatures from) user IDs on the key being
|
|
exported if the user IDs are not usable. Also, do not export any
|
|
signatures that are not usable. This includes signatures that were
|
|
issued by keys that are not present on the keyring. This option is
|
|
the same as running the <B>--edit-key</B> command "clean" before export
|
|
except that the local copy of the key is not modified. Defaults to
|
|
no.
|
|
<P>
|
|
<DT id="290"><B>export-minimal</B>
|
|
|
|
<DD>
|
|
Export the smallest key possible. This removes all signatures except the
|
|
most recent self-signature on each user ID. This option is the same as
|
|
running the <B>--edit-key</B> command "minimize" before export except
|
|
that the local copy of the key is not modified. Defaults to no.
|
|
<P>
|
|
<DT id="291"><B>export-pka</B>
|
|
|
|
<DD>
|
|
Instead of outputting the key material output PKA records suitable
|
|
to put into DNS zone files. An ORIGIN line is printed before each
|
|
record to allow diverting the records to the corresponding zone file.
|
|
<P>
|
|
<DT id="292"><B>export-dane</B>
|
|
|
|
<DD>
|
|
Instead of outputting the key material output OpenPGP DANE records
|
|
suitable to put into DNS zone files. An ORIGIN line is printed before
|
|
each record to allow diverting the records to the corresponding zone
|
|
file.
|
|
<P>
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="293"><B>--with-colons</B>
|
|
|
|
<DD>
|
|
Print key listings delimited by colons. Note that the output will be
|
|
encoded in UTF-8 regardless of any <B>--display-charset</B> setting. This
|
|
format is useful when GnuPG is called from scripts and other programs
|
|
as it is easily machine parsed. The details of this format are
|
|
documented in the file '<I>doc/DETAILS</I>', which is included in the GnuPG
|
|
source distribution.
|
|
<P>
|
|
<DT id="294"><B>--fixed-list-mode</B>
|
|
|
|
<DD>
|
|
Do not merge primary user ID and primary key in <B>--with-colon</B>
|
|
listing mode and print all timestamps as seconds since 1970-01-01.
|
|
Since GnuPG 2.0.10, this mode is always used and thus this option is
|
|
obsolete; it does not harm to use it though.
|
|
<P>
|
|
<DT id="295"><B>--legacy-list-mode</B>
|
|
|
|
<DD>
|
|
Revert to the pre-2.1 public key list mode. This only affects the
|
|
human readable output and not the machine interface
|
|
(i.e. <B>--with-colons</B>). Note that the legacy format does not
|
|
convey suitable information for elliptic curves.
|
|
<P>
|
|
<DT id="296"><B>--with-fingerprint</B>
|
|
|
|
<DD>
|
|
Same as the command <B>--fingerprint</B> but changes only the format
|
|
of the output and may be used together with another command.
|
|
<P>
|
|
<DT id="297"><B>--with-subkey-fingerprint</B>
|
|
|
|
<DD>
|
|
If a fingerprint is printed for the primary key, this option forces
|
|
printing of the fingerprint for all subkeys. This could also be
|
|
achieved by using the <B>--with-fingerprint</B> twice but by using
|
|
this option along with keyid-format "none" a compact fingerprint is
|
|
printed.
|
|
<P>
|
|
<DT id="298"><B>--with-icao-spelling</B>
|
|
|
|
<DD>
|
|
Print the ICAO spelling of the fingerprint in addition to the hex digits.
|
|
<P>
|
|
<DT id="299"><B>--with-keygrip</B>
|
|
|
|
<DD>
|
|
Include the keygrip in the key listings. In <B>--with-colons</B> mode
|
|
this is implicitly enable for secret keys.
|
|
<P>
|
|
<DT id="300"><B>--with-key-origin</B>
|
|
|
|
<DD>
|
|
Include the locally held information on the origin and last update of
|
|
a key in a key listing. In <B>--with-colons</B> mode this is always
|
|
printed. This data is currently experimental and shall not be
|
|
considered part of the stable API.
|
|
<P>
|
|
<DT id="301"><B>--with-wkd-hash</B>
|
|
|
|
<DD>
|
|
Print a Web Key Directory identifier along with each user ID in key
|
|
listings. This is an experimental feature and semantics may change.
|
|
<P>
|
|
<DT id="302"><B>--with-secret</B>
|
|
|
|
<DD>
|
|
Include info about the presence of a secret key in public key listings
|
|
done with <B>--with-colons</B>.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAP"> </A>
|
|
<H3>OpenPGP protocol specific options</H3>
|
|
|
|
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="303"><B>-t, --textmode</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-textmode</B>
|
|
|
|
Treat input files as text and store them in the OpenPGP canonical text
|
|
form with standard "CRLF" line endings. This also sets the necessary
|
|
flags to inform the recipient that the encrypted or signed data is text
|
|
and may need its line endings converted back to whatever the local
|
|
system uses. This option is useful when communicating between two
|
|
platforms that have different line ending conventions (UNIX-like to Mac,
|
|
Mac to Windows, etc). <B>--no-textmode</B> disables this option, and
|
|
is the default.
|
|
<P>
|
|
<DT id="304"><B>--force-v3-sigs</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-force-v3-sigs</B>
|
|
|
|
<DT id="305"><B>--force-v4-certs</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-force-v4-certs</B>
|
|
|
|
These options are obsolete and have no effect since GnuPG 2.1.
|
|
<P>
|
|
<DT id="306"><B>--force-mdc</B>
|
|
|
|
<DD>
|
|
|
|
<B>--disable-mdc</B>
|
|
|
|
These options are obsolete and have no effect since GnuPG 2.2.8. The
|
|
MDC is always used. But note: If the creation of a legacy non-MDC
|
|
message is exceptionally required, the option <B>--rfc2440</B>
|
|
allows for this.
|
|
<P>
|
|
<DT id="307"><B>--disable-signer-uid</B>
|
|
|
|
<DD>
|
|
By default the user ID of the signing key is embedded in the data signature.
|
|
As of now this is only done if the signing key has been specified with
|
|
<B>local-user</B> using a mail address, or with <B>sender</B>. This
|
|
information can be helpful for verifier to locate the key; see option
|
|
<B>--auto-key-retrieve</B>.
|
|
<P>
|
|
<DT id="308"><B>--personal-cipher-preferences </B><I>string</I>
|
|
|
|
<DD>
|
|
Set the list of personal cipher preferences to <I>string</I>. Use
|
|
<B>gpg --version</B> to get a list of available algorithms,
|
|
and use <B>none</B> to set no preference at all. This allows the user
|
|
to safely override the algorithm chosen by the recipient key
|
|
preferences, as GPG will only select an algorithm that is usable by
|
|
all recipients. The most highly ranked cipher in this list is also
|
|
used for the <B>--symmetric</B> encryption command.
|
|
<P>
|
|
<DT id="309"><B>--personal-digest-preferences </B><I>string</I>
|
|
|
|
<DD>
|
|
Set the list of personal digest preferences to <I>string</I>. Use
|
|
<B>gpg --version</B> to get a list of available algorithms,
|
|
and use <B>none</B> to set no preference at all. This allows the user
|
|
to safely override the algorithm chosen by the recipient key
|
|
preferences, as GPG will only select an algorithm that is usable by
|
|
all recipients. The most highly ranked digest algorithm in this list
|
|
is also used when signing without encryption
|
|
(e.g. <B>--clear-sign</B> or <B>--sign</B>).
|
|
<P>
|
|
<DT id="310"><B>--personal-compress-preferences </B><I>string</I>
|
|
|
|
<DD>
|
|
Set the list of personal compression preferences to <I>string</I>.
|
|
Use <B>gpg --version</B> to get a list of available
|
|
algorithms, and use <B>none</B> to set no preference at all. This
|
|
allows the user to safely override the algorithm chosen by the
|
|
recipient key preferences, as GPG will only select an algorithm that
|
|
is usable by all recipients. The most highly ranked compression
|
|
algorithm in this list is also used when there are no recipient keys
|
|
to consider (e.g. <B>--symmetric</B>).
|
|
<P>
|
|
<DT id="311"><B>--s2k-cipher-algo </B><I>name</I>
|
|
|
|
<DD>
|
|
Use <I>name</I> as the cipher algorithm for symmetric encryption with
|
|
a passphrase if <B>--personal-cipher-preferences</B> and
|
|
<B>--cipher-algo</B> are not given. The default is AES-128.
|
|
<P>
|
|
<DT id="312"><B>--s2k-digest-algo </B><I>name</I>
|
|
|
|
<DD>
|
|
Use <I>name</I> as the digest algorithm used to mangle the passphrases
|
|
for symmetric encryption. The default is SHA-1.
|
|
<P>
|
|
<DT id="313"><B>--s2k-mode </B><I>n</I>
|
|
|
|
<DD>
|
|
Selects how passphrases for symmetric encryption are mangled. If
|
|
<I>n</I> is 0 a plain passphrase (which is in general not recommended)
|
|
will be used, a 1 adds a salt (which should not be used) to the
|
|
passphrase and a 3 (the default) iterates the whole process a number
|
|
of times (see <B>--s2k-count</B>).
|
|
<P>
|
|
<DT id="314"><B>--s2k-count </B><I>n</I>
|
|
|
|
<DD>
|
|
Specify how many times the passphrases mangling for symmetric
|
|
encryption is repeated. This value may range between 1024 and
|
|
65011712 inclusive. The default is inquired from gpg-agent. Note
|
|
that not all values in the 1024-65011712 range are legal and if an
|
|
illegal value is selected, GnuPG will round up to the nearest legal
|
|
value. This option is only meaningful if <B>--s2k-mode</B> is set
|
|
to the default of 3.
|
|
<P>
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAQ"> </A>
|
|
<H3>Compliance options</H3>
|
|
|
|
|
|
<P>
|
|
These options control what GnuPG is compliant to. Only one of these
|
|
options may be active at a time. Note that the default setting of
|
|
this is nearly always the correct one. See the INTEROPERABILITY WITH
|
|
OTHER OPENPGP PROGRAMS section below before using one of these
|
|
options.
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="315"><B>--gnupg</B>
|
|
|
|
<DD>
|
|
Use standard GnuPG behavior. This is essentially OpenPGP behavior
|
|
(see <B>--openpgp</B>), but with some additional workarounds for common
|
|
compatibility problems in different versions of PGP. This is the
|
|
default option, so it is not generally needed, but it may be useful to
|
|
override a different compliance option in the gpg.conf file.
|
|
<P>
|
|
<DT id="316"><B>--openpgp</B>
|
|
|
|
<DD>
|
|
Reset all packet, cipher and digest options to strict OpenPGP
|
|
behavior. Use this option to reset all previous options like
|
|
<B>--s2k-*</B>, <B>--cipher-algo</B>, <B>--digest-algo</B> and
|
|
<B>--compress-algo</B> to OpenPGP compliant values. All PGP
|
|
workarounds are disabled.
|
|
<P>
|
|
<DT id="317"><B>--rfc4880</B>
|
|
|
|
<DD>
|
|
Reset all packet, cipher and digest options to strict RFC-4880
|
|
behavior. Note that this is currently the same thing as
|
|
<B>--openpgp</B>.
|
|
<P>
|
|
<DT id="318"><B>--rfc4880bis</B>
|
|
|
|
<DD>
|
|
Enable experimental features from proposed updates to RFC-4880. This
|
|
option can be used in addition to the other compliance options.
|
|
Warning: The behavior may change with any GnuPG release and created
|
|
keys or data may not be usable with future GnuPG versions.
|
|
<P>
|
|
<DT id="319"><B>--rfc2440</B>
|
|
|
|
<DD>
|
|
Reset all packet, cipher and digest options to strict RFC-2440
|
|
behavior. Note that by using this option encryption packets are
|
|
created in a legacy mode without MDC protection. This is dangerous
|
|
and should thus only be used for experiments. See also option
|
|
<B>--ignore-mdc-error</B>.
|
|
<P>
|
|
<DT id="320"><B>--pgp6</B>
|
|
|
|
<DD>
|
|
Set up all options to be as PGP 6 compliant as possible. This
|
|
restricts you to the ciphers IDEA (if the IDEA plugin is installed),
|
|
3DES, and CAST5, the hashes MD5, SHA1 and RIPEMD160, and the
|
|
compression algorithms none and ZIP. This also disables
|
|
<B>--throw-keyids</B>, and making signatures with signing subkeys as PGP 6
|
|
does not understand signatures made by signing subkeys.
|
|
<P>
|
|
This option implies <B>--escape-from-lines</B>.
|
|
<P>
|
|
<DT id="321"><B>--pgp7</B>
|
|
|
|
<DD>
|
|
Set up all options to be as PGP 7 compliant as possible. This is
|
|
identical to <B>--pgp6</B> except that MDCs are not disabled, and the
|
|
list of allowable ciphers is expanded to add AES128, AES192, AES256, and
|
|
TWOFISH.
|
|
<P>
|
|
<DT id="322"><B>--pgp8</B>
|
|
|
|
<DD>
|
|
Set up all options to be as PGP 8 compliant as possible. PGP 8 is a lot
|
|
closer to the OpenPGP standard than previous versions of PGP, so all
|
|
this does is disable <B>--throw-keyids</B> and set
|
|
<B>--escape-from-lines</B>. All algorithms are allowed except for the
|
|
SHA224, SHA384, and SHA512 digests.
|
|
<P>
|
|
<DT id="323"><B>--compliance </B><I>string</I>
|
|
|
|
<DD>
|
|
This option can be used instead of one of the options above. Valid
|
|
values for <I>string</I> are the above option names (without the double
|
|
dash) and possibly others as shown when using "help" for <I>value</I>.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAR"> </A>
|
|
<H3>Doing things one usually doesn't want to do</H3>
|
|
|
|
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="324"><B>-n</B>
|
|
|
|
<DD>
|
|
|
|
<B>--dry-run</B>
|
|
|
|
Don't make any changes (this is not completely implemented).
|
|
<P>
|
|
<DT id="325"><B>--list-only</B>
|
|
|
|
<DD>
|
|
Changes the behaviour of some commands. This is like <B>--dry-run</B> but
|
|
different in some cases. The semantic of this option may be extended in
|
|
the future. Currently it only skips the actual decryption pass and
|
|
therefore enables a fast listing of the encryption keys.
|
|
<P>
|
|
<DT id="326"><B>-i</B>
|
|
|
|
<DD>
|
|
|
|
<B>--interactive</B>
|
|
|
|
Prompt before overwriting any files.
|
|
<P>
|
|
<DT id="327"><B>--debug-level </B><I>level</I>
|
|
|
|
<DD>
|
|
Select the debug level for investigating problems. <I>level</I> may be
|
|
a numeric value or by a keyword:
|
|
<P>
|
|
<DL COMPACT><DT id="328"><DD>
|
|
<DL COMPACT>
|
|
<DT id="329"><B>none</B>
|
|
|
|
<DD>
|
|
No debugging at all. A value of less than 1 may be used instead of
|
|
the keyword.
|
|
<DT id="330"><B>basic</B>
|
|
|
|
<DD>
|
|
Some basic debug messages. A value between 1 and 2 may be used
|
|
instead of the keyword.
|
|
<DT id="331"><B>advanced</B>
|
|
|
|
<DD>
|
|
More verbose debug messages. A value between 3 and 5 may be used
|
|
instead of the keyword.
|
|
<DT id="332"><B>expert</B>
|
|
|
|
<DD>
|
|
Even more detailed messages. A value between 6 and 8 may be used
|
|
instead of the keyword.
|
|
<DT id="333"><B>guru</B>
|
|
|
|
<DD>
|
|
All of the debug messages you can get. A value greater than 8 may be
|
|
used instead of the keyword. The creation of hash tracing files is
|
|
only enabled if the keyword is used.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
How these messages are mapped to the actual debugging flags is not
|
|
specified and may change with newer releases of this program. They are
|
|
however carefully selected to best aid in debugging.
|
|
<P>
|
|
<DT id="334"><B>--debug </B><I>flags</I>
|
|
|
|
<DD>
|
|
Set debugging flags. All flags are or-ed and <I>flags</I> may be given
|
|
in C syntax (e.g. 0x0042) or as a comma separated list of flag names.
|
|
To get a list of all supported flags the single word "help" can be
|
|
used.
|
|
<P>
|
|
<DT id="335"><B>--debug-all</B>
|
|
|
|
<DD>
|
|
Set all useful debugging flags.
|
|
<P>
|
|
<DT id="336"><B>--debug-iolbf</B>
|
|
|
|
<DD>
|
|
Set stdout into line buffered mode. This option is only honored when
|
|
given on the command line.
|
|
<P>
|
|
<DT id="337"><B>--faked-system-time </B><I>epoch</I>
|
|
|
|
<DD>
|
|
This option is only useful for testing; it sets the system time back or
|
|
forth to <I>epoch</I> which is the number of seconds elapsed since the year
|
|
1970. Alternatively <I>epoch</I> may be given as a full ISO time string
|
|
(e.g. "20070924T154812").
|
|
<P>
|
|
If you suffix <I>epoch</I> with an exclamation mark (!), the system time
|
|
will appear to be frozen at the specified time.
|
|
<P>
|
|
<DT id="338"><B>--enable-progress-filter</B>
|
|
|
|
<DD>
|
|
Enable certain PROGRESS status outputs. This option allows frontends
|
|
to display a progress indicator while gpg is processing larger files.
|
|
There is a slight performance overhead using it.
|
|
<P>
|
|
<DT id="339"><B>--status-fd </B><I>n</I>
|
|
|
|
<DD>
|
|
Write special status strings to the file descriptor <I>n</I>.
|
|
See the file DETAILS in the documentation for a listing of them.
|
|
<P>
|
|
<DT id="340"><B>--status-file </B><I>file</I>
|
|
|
|
<DD>
|
|
Same as <B>--status-fd</B>, except the status data is written to file
|
|
<I>file</I>.
|
|
<P>
|
|
<DT id="341"><B>--logger-fd </B><I>n</I>
|
|
|
|
<DD>
|
|
Write log output to file descriptor <I>n</I> and not to STDERR.
|
|
<P>
|
|
<DT id="342"><B>--log-file </B><I>file</I>
|
|
|
|
<DD>
|
|
|
|
<B>--logger-file </B><I>file</I>
|
|
|
|
Same as <B>--logger-fd</B>, except the logger data is written to
|
|
file <I>file</I>. Use '<I>socket://</I>' to log to a socket. Note that
|
|
in this version of gpg the option has only an effect if
|
|
<B>--batch</B> is also used.
|
|
<P>
|
|
<DT id="343"><B>--attribute-fd </B><I>n</I>
|
|
|
|
<DD>
|
|
Write attribute subpackets to the file descriptor <I>n</I>. This is most
|
|
useful for use with <B>--status-fd</B>, since the status messages are
|
|
needed to separate out the various subpackets from the stream delivered
|
|
to the file descriptor.
|
|
<P>
|
|
<DT id="344"><B>--attribute-file </B><I>file</I>
|
|
|
|
<DD>
|
|
Same as <B>--attribute-fd</B>, except the attribute data is written to
|
|
file <I>file</I>.
|
|
<P>
|
|
<DT id="345"><B>--comment </B><I>string</I>
|
|
|
|
<DD>
|
|
|
|
<B>--no-comments</B>
|
|
|
|
Use <I>string</I> as a comment string in cleartext signatures and ASCII
|
|
armored messages or keys (see <B>--armor</B>). The default behavior is
|
|
not to use a comment string. <B>--comment</B> may be repeated multiple
|
|
times to get multiple comment strings. <B>--no-comments</B> removes
|
|
all comments. It is a good idea to keep the length of a single comment
|
|
below 60 characters to avoid problems with mail programs wrapping such
|
|
lines. Note that comment lines, like all other header lines, are not
|
|
protected by the signature.
|
|
<P>
|
|
<DT id="346"><B>--emit-version</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-emit-version</B>
|
|
|
|
Force inclusion of the version string in ASCII armored output. If
|
|
given once only the name of the program and the major number is
|
|
emitted, given twice the minor is also emitted, given thrice
|
|
the micro is added, and given four times an operating system identification
|
|
is also emitted. <B>--no-emit-version</B> (default) disables the version
|
|
line.
|
|
<P>
|
|
<DT id="347"><B>--sig-notation {</B><I>name</I>=<I>value</I>}
|
|
|
|
<DD>
|
|
|
|
<B>--cert-notation {</B><I>name</I>=<I>value</I>}
|
|
|
|
|
|
<B>-N, --set-notation {</B><I>name</I>=<I>value</I>}
|
|
|
|
Put the name value pair into the signature as notation data.
|
|
<I>name</I> must consist only of printable characters or spaces, and
|
|
must contain a '@' character in the form <A HREF="mailto:keyname@domain.example.com">keyname@domain.example.com</A>
|
|
(substituting the appropriate keyname and domain name, of course). This
|
|
is to help prevent pollution of the IETF reserved notation
|
|
namespace. The <B>--expert</B> flag overrides the '@'
|
|
check. <I>value</I> may be any printable string; it will be encoded in
|
|
UTF-8, so you should check that your <B>--display-charset</B> is set
|
|
correctly. If you prefix <I>name</I> with an exclamation mark (!), the
|
|
notation data will be flagged as critical
|
|
(rfc4880:5.2.3.16). <B>--sig-notation</B> sets a notation for data
|
|
signatures. <B>--cert-notation</B> sets a notation for key signatures
|
|
(certifications). <B>--set-notation</B> sets both.
|
|
<P>
|
|
There are special codes that may be used in notation names. "%k" will
|
|
be expanded into the key ID of the key being signed, "%K" into the
|
|
long key ID of the key being signed, "%f" into the fingerprint of the
|
|
key being signed, "%s" into the key ID of the key making the
|
|
signature, "%S" into the long key ID of the key making the signature,
|
|
"%g" into the fingerprint of the key making the signature (which might
|
|
be a subkey), "%p" into the fingerprint of the primary key of the key
|
|
making the signature, "%c" into the signature count from the OpenPGP
|
|
smartcard, and "%%" results in a single "%". %k, %K, and %f are only
|
|
meaningful when making a key signature (certification), and %c is only
|
|
meaningful when using the OpenPGP smartcard.
|
|
<P>
|
|
<DT id="348"><B>--known-notation </B><I>name</I>
|
|
|
|
<DD>
|
|
Adds <I>name</I> to a list of known critical signature notations. The
|
|
effect of this is that gpg will not mark a signature with a critical
|
|
signature notation of that name as bad. Note that gpg already knows
|
|
by default about a few critical signatures notation names.
|
|
<P>
|
|
<DT id="349"><B>--sig-policy-url </B><I>string</I>
|
|
|
|
<DD>
|
|
|
|
<B>--cert-policy-url </B><I>string</I>
|
|
|
|
|
|
<B>--set-policy-url </B><I>string</I>
|
|
|
|
Use <I>string</I> as a Policy URL for signatures (rfc4880:5.2.3.20). If
|
|
you prefix it with an exclamation mark (!), the policy URL packet will
|
|
be flagged as critical. <B>--sig-policy-url</B> sets a policy url for
|
|
data signatures. <B>--cert-policy-url</B> sets a policy url for key
|
|
signatures (certifications). <B>--set-policy-url</B> sets both.
|
|
<P>
|
|
The same %-expandos used for notation data are available here as well.
|
|
<P>
|
|
<DT id="350"><B>--sig-keyserver-url </B><I>string</I>
|
|
|
|
<DD>
|
|
Use <I>string</I> as a preferred keyserver URL for data signatures. If
|
|
you prefix it with an exclamation mark (!), the keyserver URL packet
|
|
will be flagged as critical.
|
|
<P>
|
|
The same %-expandos used for notation data are available here as well.
|
|
<P>
|
|
<DT id="351"><B>--set-filename </B><I>string</I>
|
|
|
|
<DD>
|
|
Use <I>string</I> as the filename which is stored inside messages.
|
|
This overrides the default, which is to use the actual filename of the
|
|
file being encrypted. Using the empty string for <I>string</I>
|
|
effectively removes the filename from the output.
|
|
<P>
|
|
<DT id="352"><B>--for-your-eyes-only</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-for-your-eyes-only</B>
|
|
|
|
Set the `for your eyes only' flag in the message. This causes GnuPG to
|
|
refuse to save the file unless the <B>--output</B> option is given,
|
|
and PGP to use a "secure viewer" with a claimed Tempest-resistant font
|
|
to display the message. This option overrides <B>--set-filename</B>.
|
|
<B>--no-for-your-eyes-only</B> disables this option.
|
|
<P>
|
|
<DT id="353"><B>--use-embedded-filename</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-use-embedded-filename</B>
|
|
|
|
Try to create a file with a name as embedded in the data. This can be
|
|
a dangerous option as it enables overwriting files. Defaults to no.
|
|
Note that the option <B>--output</B> overrides this option.
|
|
<P>
|
|
<DT id="354"><B>--cipher-algo </B><I>name</I>
|
|
|
|
<DD>
|
|
Use <I>name</I> as cipher algorithm. Running the program with the
|
|
command <B>--version</B> yields a list of supported algorithms. If
|
|
this is not used the cipher algorithm is selected from the preferences
|
|
stored with the key. In general, you do not want to use this option as
|
|
it allows you to violate the OpenPGP standard.
|
|
<B>--personal-cipher-preferences</B> is the safe way to accomplish the
|
|
same thing.
|
|
<P>
|
|
<DT id="355"><B>--digest-algo </B><I>name</I>
|
|
|
|
<DD>
|
|
Use <I>name</I> as the message digest algorithm. Running the program
|
|
with the command <B>--version</B> yields a list of supported algorithms. In
|
|
general, you do not want to use this option as it allows you to
|
|
violate the OpenPGP standard. <B>--personal-digest-preferences</B> is the
|
|
safe way to accomplish the same thing.
|
|
<P>
|
|
<DT id="356"><B>--compress-algo </B><I>name</I>
|
|
|
|
<DD>
|
|
Use compression algorithm <I>name</I>. "zlib" is RFC-1950 ZLIB
|
|
compression. "zip" is RFC-1951 ZIP compression which is used by PGP.
|
|
"bzip2" is a more modern compression scheme that can compress some
|
|
things better than zip or zlib, but at the cost of more memory used
|
|
during compression and decompression. "uncompressed" or "none"
|
|
disables compression. If this option is not used, the default
|
|
behavior is to examine the recipient key preferences to see which
|
|
algorithms the recipient supports. If all else fails, ZIP is used for
|
|
maximum compatibility.
|
|
<P>
|
|
ZLIB may give better compression results than ZIP, as the compression
|
|
window size is not limited to 8k. BZIP2 may give even better
|
|
compression results than that, but will use a significantly larger
|
|
amount of memory while compressing and decompressing. This may be
|
|
significant in low memory situations. Note, however, that PGP (all
|
|
versions) only supports ZIP compression. Using any algorithm other
|
|
than ZIP or "none" will make the message unreadable with PGP. In
|
|
general, you do not want to use this option as it allows you to
|
|
violate the OpenPGP standard. <B>--personal-compress-preferences</B> is the
|
|
safe way to accomplish the same thing.
|
|
<P>
|
|
<DT id="357"><B>--cert-digest-algo </B><I>name</I>
|
|
|
|
<DD>
|
|
Use <I>name</I> as the message digest algorithm used when signing a
|
|
key. Running the program with the command <B>--version</B> yields a
|
|
list of supported algorithms. Be aware that if you choose an algorithm
|
|
that GnuPG supports but other OpenPGP implementations do not, then some
|
|
users will not be able to use the key signatures you make, or quite
|
|
possibly your entire key.
|
|
<P>
|
|
<DT id="358"><B>--disable-cipher-algo </B><I>name</I>
|
|
|
|
<DD>
|
|
Never allow the use of <I>name</I> as cipher algorithm.
|
|
The given name will not be checked so that a later loaded algorithm
|
|
will still get disabled.
|
|
<P>
|
|
<DT id="359"><B>--disable-pubkey-algo </B><I>name</I>
|
|
|
|
<DD>
|
|
Never allow the use of <I>name</I> as public key algorithm.
|
|
The given name will not be checked so that a later loaded algorithm
|
|
will still get disabled.
|
|
<P>
|
|
<DT id="360"><B>--throw-keyids</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-throw-keyids</B>
|
|
|
|
Do not put the recipient key IDs into encrypted messages. This helps to
|
|
hide the receivers of the message and is a limited countermeasure
|
|
against traffic analysis. ([Using a little social engineering
|
|
anyone who is able to decrypt the message can check whether one of the
|
|
other recipients is the one he suspects.]) On the receiving side, it may
|
|
slow down the decryption process because all available secret keys must
|
|
be tried. <B>--no-throw-keyids</B> disables this option. This option
|
|
is essentially the same as using <B>--hidden-recipient</B> for all
|
|
recipients.
|
|
<P>
|
|
<DT id="361"><B>--not-dash-escaped</B>
|
|
|
|
<DD>
|
|
This option changes the behavior of cleartext signatures
|
|
so that they can be used for patch files. You should not
|
|
send such an armored file via email because all spaces
|
|
and line endings are hashed too. You can not use this
|
|
option for data which has 5 dashes at the beginning of a
|
|
line, patch files don't have this. A special armor header
|
|
line tells GnuPG about this cleartext signature option.
|
|
<P>
|
|
<DT id="362"><B>--escape-from-lines</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-escape-from-lines</B>
|
|
|
|
Because some mailers change lines starting with "From " to ">From " it
|
|
is good to handle such lines in a special way when creating cleartext
|
|
signatures to prevent the mail system from breaking the signature. Note
|
|
that all other PGP versions do it this way too. Enabled by
|
|
default. <B>--no-escape-from-lines</B> disables this option.
|
|
<P>
|
|
<DT id="363"><B>--passphrase-repeat </B><I>n</I>
|
|
|
|
<DD>
|
|
Specify how many times <B>gpg</B> will request a new
|
|
passphrase be repeated. This is useful for helping memorize a
|
|
passphrase. Defaults to 1 repetition.
|
|
<P>
|
|
<DT id="364"><B>--passphrase-fd </B><I>n</I>
|
|
|
|
<DD>
|
|
Read the passphrase from file descriptor <I>n</I>. Only the first line
|
|
will be read from file descriptor <I>n</I>. If you use 0 for <I>n</I>,
|
|
the passphrase will be read from STDIN. This can only be used if only
|
|
one passphrase is supplied.
|
|
<P>
|
|
Note that since Version 2.0 this passphrase is only used if the
|
|
option <B>--batch</B> has also been given. Since Version 2.1
|
|
the <B>--pinentry-mode</B> also needs to be set to <B>loopback</B>.
|
|
<P>
|
|
<DT id="365"><B>--passphrase-file </B><I>file</I>
|
|
|
|
<DD>
|
|
Read the passphrase from file <I>file</I>. Only the first line will
|
|
be read from file <I>file</I>. This can only be used if only one
|
|
passphrase is supplied. Obviously, a passphrase stored in a file is
|
|
of questionable security if other users can read this file. Don't use
|
|
this option if you can avoid it.
|
|
<P>
|
|
Note that since Version 2.0 this passphrase is only used if the
|
|
option <B>--batch</B> has also been given. Since Version 2.1
|
|
the <B>--pinentry-mode</B> also needs to be set to <B>loopback</B>.
|
|
<P>
|
|
<DT id="366"><B>--passphrase </B><I>string</I>
|
|
|
|
<DD>
|
|
Use <I>string</I> as the passphrase. This can only be used if only one
|
|
passphrase is supplied. Obviously, this is of very questionable
|
|
security on a multi-user system. Don't use this option if you can
|
|
avoid it.
|
|
<P>
|
|
Note that since Version 2.0 this passphrase is only used if the
|
|
option <B>--batch</B> has also been given. Since Version 2.1
|
|
the <B>--pinentry-mode</B> also needs to be set to <B>loopback</B>.
|
|
<P>
|
|
<DT id="367"><B>--pinentry-mode </B><I>mode</I>
|
|
|
|
<DD>
|
|
Set the pinentry mode to <I>mode</I>. Allowed values for <I>mode</I>
|
|
are:
|
|
<DL COMPACT><DT id="368"><DD>
|
|
<DL COMPACT>
|
|
<DT id="369"><B>default</B>
|
|
|
|
<DD>
|
|
Use the default of the agent, which is <B>ask</B>.
|
|
<DT id="370"><B>ask</B>
|
|
|
|
<DD>
|
|
Force the use of the Pinentry.
|
|
<DT id="371"><B>cancel</B>
|
|
|
|
<DD>
|
|
Emulate use of Pinentry's cancel button.
|
|
<DT id="372"><B>error</B>
|
|
|
|
<DD>
|
|
Return a Pinentry error (``No Pinentry'').
|
|
<DT id="373"><B>loopback</B>
|
|
|
|
<DD>
|
|
Redirect Pinentry queries to the caller. Note that in contrast to
|
|
Pinentry the user is not prompted again if he enters a bad password.
|
|
</DL>
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="374"><B>--no-symkey-cache</B>
|
|
|
|
<DD>
|
|
Disable the passphrase cache used for symmetrical en- and decryption.
|
|
This cache is based on the message specific salt value
|
|
(cf. <B>--s2k-mode</B>).
|
|
<P>
|
|
<DT id="375"><B>--request-origin </B><I>origin</I>
|
|
|
|
<DD>
|
|
Tell gpg to assume that the operation ultimately originated at
|
|
<I>origin</I>. Depending on the origin certain restrictions are applied
|
|
and the Pinentry may include an extra note on the origin. Supported
|
|
values for <I>origin</I> are: <B>local</B> which is the default,
|
|
<B>remote</B> to indicate a remote origin or <B>browser</B> for an
|
|
operation requested by a web browser.
|
|
<P>
|
|
<DT id="376"><B>--command-fd </B><I>n</I>
|
|
|
|
<DD>
|
|
This is a replacement for the deprecated shared-memory IPC mode.
|
|
If this option is enabled, user input on questions is not expected
|
|
from the TTY but from the given file descriptor. It should be used
|
|
together with <B>--status-fd</B>. See the file doc/DETAILS in the source
|
|
distribution for details on how to use it.
|
|
<P>
|
|
<DT id="377"><B>--command-file </B><I>file</I>
|
|
|
|
<DD>
|
|
Same as <B>--command-fd</B>, except the commands are read out of file
|
|
<I>file</I>
|
|
<P>
|
|
<DT id="378"><B>--allow-non-selfsigned-uid</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-allow-non-selfsigned-uid</B>
|
|
|
|
Allow the import and use of keys with user IDs which are not
|
|
self-signed. This is not recommended, as a non self-signed user ID is
|
|
trivial to forge. <B>--no-allow-non-selfsigned-uid</B> disables.
|
|
<P>
|
|
<DT id="379"><B>--allow-freeform-uid</B>
|
|
|
|
<DD>
|
|
Disable all checks on the form of the user ID while generating a new
|
|
one. This option should only be used in very special environments as
|
|
it does not ensure the de-facto standard format of user IDs.
|
|
<P>
|
|
<DT id="380"><B>--ignore-time-conflict</B>
|
|
|
|
<DD>
|
|
GnuPG normally checks that the timestamps associated with keys and
|
|
signatures have plausible values. However, sometimes a signature
|
|
seems to be older than the key due to clock problems. This option
|
|
makes these checks just a warning. See also <B>--ignore-valid-from</B> for
|
|
timestamp issues on subkeys.
|
|
<P>
|
|
<DT id="381"><B>--ignore-valid-from</B>
|
|
|
|
<DD>
|
|
GnuPG normally does not select and use subkeys created in the future.
|
|
This option allows the use of such keys and thus exhibits the
|
|
pre-1.0.7 behaviour. You should not use this option unless there
|
|
is some clock problem. See also <B>--ignore-time-conflict</B> for timestamp
|
|
issues with signatures.
|
|
<P>
|
|
<DT id="382"><B>--ignore-crc-error</B>
|
|
|
|
<DD>
|
|
The ASCII armor used by OpenPGP is protected by a CRC checksum against
|
|
transmission errors. Occasionally the CRC gets mangled somewhere on
|
|
the transmission channel but the actual content (which is protected by
|
|
the OpenPGP protocol anyway) is still okay. This option allows GnuPG
|
|
to ignore CRC errors.
|
|
<P>
|
|
<DT id="383"><B>--ignore-mdc-error</B>
|
|
|
|
<DD>
|
|
This option changes a MDC integrity protection failure into a warning.
|
|
It is required to decrypt old messages which did not use an MDC. It
|
|
may also be useful if a message is partially garbled, but it is
|
|
necessary to get as much data as possible out of that garbled message.
|
|
Be aware that a missing or failed MDC can be an indication of an
|
|
attack. Use with great caution; see also option <B>--rfc2440</B>.
|
|
<P>
|
|
<DT id="384"><B>--allow-weak-digest-algos</B>
|
|
|
|
<DD>
|
|
Signatures made with known-weak digest algorithms are normally
|
|
rejected with an ``invalid digest algorithm'' message. This option
|
|
allows the verification of signatures made with such weak algorithms.
|
|
MD5 is the only digest algorithm considered weak by default. See also
|
|
<B>--weak-digest</B> to reject other digest algorithms.
|
|
<P>
|
|
<DT id="385"><B>--weak-digest </B><I>name</I>
|
|
|
|
<DD>
|
|
Treat the specified digest algorithm as weak. Signatures made over
|
|
weak digests algorithms are normally rejected. This option can be
|
|
supplied multiple times if multiple algorithms should be considered
|
|
weak. See also <B>--allow-weak-digest-algos</B> to disable
|
|
rejection of weak digests. MD5 is always considered weak, and does
|
|
not need to be listed explicitly.
|
|
<P>
|
|
<DT id="386"><B>--allow-weak-key-signatures</B>
|
|
|
|
<DD>
|
|
To avoid a minor risk of collision attacks on third-party key
|
|
signatures made using SHA-1, those key signatures are considered
|
|
invalid. This options allows to override this restriction.
|
|
<P>
|
|
<DT id="387"><B>--no-default-keyring</B>
|
|
|
|
<DD>
|
|
Do not add the default keyrings to the list of keyrings. Note that
|
|
GnuPG will not operate without any keyrings, so if you use this option
|
|
and do not provide alternate keyrings via <B>--keyring</B> or
|
|
<B>--secret-keyring</B>, then GnuPG will still use the default public or
|
|
secret keyrings.
|
|
<P>
|
|
<DT id="388"><B>--no-keyring</B>
|
|
|
|
<DD>
|
|
Do not use any keyring at all. This overrides the default and all
|
|
options which specify keyrings.
|
|
<P>
|
|
<DT id="389"><B>--skip-verify</B>
|
|
|
|
<DD>
|
|
Skip the signature verification step. This may be
|
|
used to make the decryption faster if the signature
|
|
verification is not needed.
|
|
<P>
|
|
<DT id="390"><B>--with-key-data</B>
|
|
|
|
<DD>
|
|
Print key listings delimited by colons (like <B>--with-colons</B>) and
|
|
print the public key data.
|
|
<P>
|
|
<DT id="391"><B>--list-signatures</B>
|
|
|
|
<DD>
|
|
|
|
<B>--list-sigs</B>
|
|
|
|
Same as <B>--list-keys</B>, but the signatures are listed too. This
|
|
command has the same effect as using <B>--list-keys</B> with
|
|
<B>--with-sig-list</B>. Note that in contrast to
|
|
<B>--check-signatures</B> the key signatures are not verified. This
|
|
command can be used to create a list of signing keys missing in the
|
|
local keyring; for example:
|
|
<P>
|
|
<DL COMPACT><DT id="392"><DD>
|
|
<PRE>
|
|
gpg --list-sigs --with-colons USERID | \
|
|
awk -F: '$1=="sig" && $2=="?" {if($13){print $13}else{print $5}}'
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="393"><B>--fast-list-mode</B>
|
|
|
|
<DD>
|
|
Changes the output of the list commands to work faster; this is achieved
|
|
by leaving some parts empty. Some applications don't need the user ID
|
|
and the trust information given in the listings. By using this options
|
|
they can get a faster listing. The exact behaviour of this option may
|
|
change in future versions. If you are missing some information, don't
|
|
use this option.
|
|
<P>
|
|
<DT id="394"><B>--no-literal</B>
|
|
|
|
<DD>
|
|
This is not for normal use. Use the source to see for what it might be useful.
|
|
<P>
|
|
<DT id="395"><B>--set-filesize</B>
|
|
|
|
<DD>
|
|
This is not for normal use. Use the source to see for what it might be useful.
|
|
<P>
|
|
<DT id="396"><B>--show-session-key</B>
|
|
|
|
<DD>
|
|
Display the session key used for one message. See
|
|
<B>--override-session-key</B> for the counterpart of this option.
|
|
<P>
|
|
We think that Key Escrow is a Bad Thing; however the user should have
|
|
the freedom to decide whether to go to prison or to reveal the content
|
|
of one specific message without compromising all messages ever
|
|
encrypted for one secret key.
|
|
<P>
|
|
You can also use this option if you receive an encrypted message which
|
|
is abusive or offensive, to prove to the administrators of the
|
|
messaging system that the ciphertext transmitted corresponds to an
|
|
inappropriate plaintext so they can take action against the offending
|
|
user.
|
|
<P>
|
|
<DT id="397"><B>--override-session-key </B><I>string</I>
|
|
|
|
<DD>
|
|
|
|
<B>--override-session-key-fd </B><I>fd</I>
|
|
|
|
Don't use the public key but the session key <I>string</I> respective
|
|
the session key taken from the first line read from file descriptor
|
|
<I>fd</I>. The format of this string is the same as the one printed by
|
|
<B>--show-session-key</B>. This option is normally not used but
|
|
comes handy in case someone forces you to reveal the content of an
|
|
encrypted message; using this option you can do this without handing
|
|
out the secret key. Note that using <B>--override-session-key</B>
|
|
may reveal the session key to all local users via the global process
|
|
table. Often it is useful to combine this option with
|
|
<B>--no-keyring</B>.
|
|
<P>
|
|
<DT id="398"><B>--ask-sig-expire</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-ask-sig-expire</B>
|
|
|
|
When making a data signature, prompt for an expiration time. If this
|
|
option is not specified, the expiration time set via
|
|
<B>--default-sig-expire</B> is used. <B>--no-ask-sig-expire</B>
|
|
disables this option.
|
|
<P>
|
|
<DT id="399"><B>--default-sig-expire</B>
|
|
|
|
<DD>
|
|
The default expiration time to use for signature expiration. Valid
|
|
values are "0" for no expiration, a number followed by the letter d
|
|
(for days), w (for weeks), m (for months), or y (for years) (for
|
|
example "2m" for two months, or "5y" for five years), or an absolute
|
|
date in the form YYYY-MM-DD. Defaults to "0".
|
|
<P>
|
|
<DT id="400"><B>--ask-cert-expire</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-ask-cert-expire</B>
|
|
|
|
When making a key signature, prompt for an expiration time. If this
|
|
option is not specified, the expiration time set via
|
|
<B>--default-cert-expire</B> is used. <B>--no-ask-cert-expire</B>
|
|
disables this option.
|
|
<P>
|
|
<DT id="401"><B>--default-cert-expire</B>
|
|
|
|
<DD>
|
|
The default expiration time to use for key signature expiration.
|
|
Valid values are "0" for no expiration, a number followed by the
|
|
letter d (for days), w (for weeks), m (for months), or y (for years)
|
|
(for example "2m" for two months, or "5y" for five years), or an
|
|
absolute date in the form YYYY-MM-DD. Defaults to "0".
|
|
<P>
|
|
<DT id="402"><B>--default-new-key-algo </B><I>string</I>
|
|
|
|
<DD>
|
|
This option can be used to change the default algorithms for key
|
|
generation. The <I>string</I> is similar to the arguments required for
|
|
the command <B>--quick-add-key</B> but slightly different. For
|
|
example the current default of <B>"rsa2048/cert,sign+rsa2048/encr"</B>
|
|
(or <B>"rsa3072"</B>) can be changed to the value of what we currently
|
|
call future default, which is <B>"ed25519/cert,sign+cv25519/encr"</B>.
|
|
You need to consult the source code to learn the details. Note that
|
|
the advanced key generation commands can always be used to specify a
|
|
key algorithm directly.
|
|
<P>
|
|
<DT id="403"><B>--allow-secret-key-import</B>
|
|
|
|
<DD>
|
|
This is an obsolete option and is not used anywhere.
|
|
<P>
|
|
<DT id="404"><B>--allow-multiple-messages</B>
|
|
|
|
<DD>
|
|
<DT id="405"><B>--no-allow-multiple-messages</B>
|
|
|
|
<DD>
|
|
Allow processing of multiple OpenPGP messages contained in a single file
|
|
or stream. Some programs that call GPG are not prepared to deal with
|
|
multiple messages being processed together, so this option defaults to
|
|
no. Note that versions of GPG prior to 1.4.7 always allowed multiple
|
|
messages.
|
|
<P>
|
|
Warning: Do not use this option unless you need it as a temporary
|
|
workaround!
|
|
<P>
|
|
<P>
|
|
<DT id="406"><B>--enable-special-filenames</B>
|
|
|
|
<DD>
|
|
This option enables a mode in which filenames of the form
|
|
'<I>-&n</I>', where n is a non-negative decimal number,
|
|
refer to the file descriptor n and not to a file with that name.
|
|
<P>
|
|
<DT id="407"><B>--no-expensive-trust-checks</B>
|
|
|
|
<DD>
|
|
Experimental use only.
|
|
<P>
|
|
<DT id="408"><B>--preserve-permissions</B>
|
|
|
|
<DD>
|
|
Don't change the permissions of a secret keyring back to user
|
|
read/write only. Use this option only if you really know what you are doing.
|
|
<P>
|
|
<DT id="409"><B>--default-preference-list </B><I>string</I>
|
|
|
|
<DD>
|
|
Set the list of default preferences to <I>string</I>. This preference
|
|
list is used for new keys and becomes the default for "setpref" in the
|
|
edit menu.
|
|
<P>
|
|
<DT id="410"><B>--default-keyserver-url </B><I>name</I>
|
|
|
|
<DD>
|
|
Set the default keyserver URL to <I>name</I>. This keyserver will be
|
|
used as the keyserver URL when writing a new self-signature on a key,
|
|
which includes key generation and changing preferences.
|
|
<P>
|
|
<DT id="411"><B>--list-config</B>
|
|
|
|
<DD>
|
|
Display various internal configuration parameters of GnuPG. This option
|
|
is intended for external programs that call GnuPG to perform tasks, and
|
|
is thus not generally useful. See the file '<I>doc/DETAILS</I>' in the
|
|
source distribution for the details of which configuration items may be
|
|
listed. <B>--list-config</B> is only usable with
|
|
<B>--with-colons</B> set.
|
|
<P>
|
|
<DT id="412"><B>--list-gcrypt-config</B>
|
|
|
|
<DD>
|
|
Display various internal configuration parameters of Libgcrypt.
|
|
<P>
|
|
<DT id="413"><B>--gpgconf-list</B>
|
|
|
|
<DD>
|
|
This command is similar to <B>--list-config</B> but in general only
|
|
internally used by the <B>gpgconf</B> tool.
|
|
<P>
|
|
<DT id="414"><B>--gpgconf-test</B>
|
|
|
|
<DD>
|
|
This is more or less dummy action. However it parses the configuration
|
|
file and returns with failure if the configuration file would prevent
|
|
<B>gpg</B> from startup. Thus it may be used to run a syntax check
|
|
on the configuration file.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAS"> </A>
|
|
<H3>Deprecated options</H3>
|
|
|
|
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="415"><B>--show-photos</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-show-photos</B>
|
|
|
|
Causes <B>--list-keys</B>, <B>--list-signatures</B>,
|
|
<B>--list-public-keys</B>, <B>--list-secret-keys</B>, and verifying
|
|
a signature to also display the photo ID attached to the key, if
|
|
any. See also <B>--photo-viewer</B>. These options are deprecated. Use
|
|
<B>--list-options [no-]show-photos</B> and/or <B>--verify-options
|
|
[no-]show-photos</B> instead.
|
|
<P>
|
|
<DT id="416"><B>--show-keyring</B>
|
|
|
|
<DD>
|
|
Display the keyring name at the head of key listings to show which
|
|
keyring a given key resides on. This option is deprecated: use
|
|
<B>--list-options [no-]show-keyring</B> instead.
|
|
<P>
|
|
<DT id="417"><B>--always-trust</B>
|
|
|
|
<DD>
|
|
Identical to <B>--trust-model always</B>. This option is deprecated.
|
|
<P>
|
|
<DT id="418"><B>--show-notation</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-show-notation</B>
|
|
|
|
Show signature notations in the <B>--list-signatures</B> or <B>--check-signatures</B> listings
|
|
as well as when verifying a signature with a notation in it. These
|
|
options are deprecated. Use <B>--list-options [no-]show-notation</B>
|
|
and/or <B>--verify-options [no-]show-notation</B> instead.
|
|
<P>
|
|
<DT id="419"><B>--show-policy-url</B>
|
|
|
|
<DD>
|
|
|
|
<B>--no-show-policy-url</B>
|
|
|
|
Show policy URLs in the <B>--list-signatures</B> or <B>--check-signatures</B>
|
|
listings as well as when verifying a signature with a policy URL in
|
|
it. These options are deprecated. Use <B>--list-options
|
|
[no-]show-policy-url</B> and/or <B>--verify-options
|
|
[no-]show-policy-url</B> instead.
|
|
<P>
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAT"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="420"><B>gpg -se -r Bob</B> <B>file</B>
|
|
|
|
<DD>
|
|
sign and encrypt for user Bob
|
|
<P>
|
|
<DT id="421"><B>gpg --clear-sign file</B>
|
|
|
|
<DD>
|
|
make a cleartext signature
|
|
<P>
|
|
<DT id="422"><B>gpg -sb file</B>
|
|
|
|
<DD>
|
|
make a detached signature
|
|
<P>
|
|
<DT id="423"><B>gpg -u 0x12345678 -sb file</B>
|
|
|
|
<DD>
|
|
make a detached signature with the key 0x12345678
|
|
<P>
|
|
<DT id="424"><B>gpg --list-keys user_ID</B>
|
|
|
|
<DD>
|
|
show keys
|
|
<P>
|
|
<DT id="425"><B>gpg --fingerprint user_ID</B>
|
|
|
|
<DD>
|
|
show fingerprint
|
|
<P>
|
|
<DT id="426"><B>gpg --verify pgpfile</B>
|
|
|
|
<DD>
|
|
|
|
<B>gpg --verify sigfile</B> [<B>datafile</B>]
|
|
|
|
Verify the signature of the file but do not output the data unless
|
|
requested. The second form is used for detached signatures, where
|
|
<B>sigfile</B> is the detached signature (either ASCII armored or
|
|
binary) and <B>datafile</B> are the signed data; if this is not given, the name of the
|
|
file holding the signed data is constructed by cutting off the
|
|
extension (".asc" or ".sig") of <B>sigfile</B> or by asking the user
|
|
for the filename. If the option <B>--output</B> is also used the
|
|
signed data is written to the file specified by that option; use
|
|
<B>-</B> to write the signed data to stdout.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAU"> </A>
|
|
<H2>HOW TO SPECIFY A USER ID</H2>
|
|
|
|
<P>
|
|
There are different ways to specify a user ID to GnuPG. Some of them
|
|
are only valid for <B>gpg</B> others are only good for
|
|
<B>gpgsm</B>. Here is the entire list of ways to specify a key:
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="427"><B>By key Id.</B>
|
|
|
|
<DD>
|
|
This format is deduced from the length of the string and its content or
|
|
<B>0x</B> prefix. The key Id of an X.509 certificate are the low 64 bits
|
|
of its SHA-1 fingerprint. The use of key Ids is just a shortcut, for
|
|
all automated processing the fingerprint should be used.
|
|
<P>
|
|
When using <B>gpg</B> an exclamation mark (!) may be appended to
|
|
force using the specified primary or secondary key and not to try and
|
|
calculate which primary or secondary key to use.
|
|
<P>
|
|
The last four lines of the example give the key ID in their long form as
|
|
internally used by the OpenPGP protocol. You can see the long key ID
|
|
using the option <B>--with-colons</B>.
|
|
<P>
|
|
<DL COMPACT><DT id="428"><DD>
|
|
<PRE>
|
|
234567C4
|
|
0F34E556E
|
|
01347A56A
|
|
0xAB123456
|
|
|
|
234AABBCC34567C4
|
|
0F323456784E56EAB
|
|
01AB3FED1347A5612
|
|
0x234AABBCC34567C4
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<DT id="429"><B>By fingerprint.</B>
|
|
|
|
<DD>
|
|
This format is deduced from the length of the string and its content or
|
|
the <B>0x</B> prefix. Note, that only the 20 byte version fingerprint
|
|
is available with <B>gpgsm</B> (i.e. the SHA-1 hash of the
|
|
certificate).
|
|
<P>
|
|
When using <B>gpg</B> an exclamation mark (!) may be appended to
|
|
force using the specified primary or secondary key and not to try and
|
|
calculate which primary or secondary key to use.
|
|
<P>
|
|
The best way to specify a key Id is by using the fingerprint. This
|
|
avoids any ambiguities in case that there are duplicated key IDs.
|
|
<P>
|
|
<DL COMPACT><DT id="430"><DD>
|
|
<PRE>
|
|
1234343434343434C434343434343434
|
|
123434343434343C3434343434343734349A3434
|
|
0E12343434343434343434EAB3484343434343434
|
|
0xE12343434343434343434EAB3484343434343434
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<B>gpgsm</B> also accepts colons between each pair of hexadecimal
|
|
digits because this is the de-facto standard on how to present X.509
|
|
fingerprints. <B>gpg</B> also allows the use of the space
|
|
separated SHA-1 fingerprint as printed by the key listing commands.
|
|
<P>
|
|
<DT id="431"><B>By exact match on OpenPGP user ID.</B>
|
|
|
|
<DD>
|
|
This is denoted by a leading equal sign. It does not make sense for
|
|
X.509 certificates.
|
|
<P>
|
|
<DL COMPACT><DT id="432"><DD>
|
|
<PRE>
|
|
=Heinrich Heine <<A HREF="mailto:heinrichh@uni-duesseldorf.de">heinrichh@uni-duesseldorf.de</A>>
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="433"><B>By exact match on an email address.</B>
|
|
|
|
<DD>
|
|
This is indicated by enclosing the email address in the usual way
|
|
with left and right angles.
|
|
<P>
|
|
<DL COMPACT><DT id="434"><DD>
|
|
<PRE>
|
|
<<A HREF="mailto:heinrichh@uni-duesseldorf.de">heinrichh@uni-duesseldorf.de</A>>
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="435"><B>By partial match on an email address.</B>
|
|
|
|
<DD>
|
|
This is indicated by prefixing the search string with an <B>@</B>.
|
|
This uses a substring search but considers only the mail address
|
|
(i.e. inside the angle brackets).
|
|
<P>
|
|
<DL COMPACT><DT id="436"><DD>
|
|
<PRE>
|
|
@heinrichh
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="437"><B>By exact match on the subject's DN.</B>
|
|
|
|
<DD>
|
|
This is indicated by a leading slash, directly followed by the RFC-2253
|
|
encoded DN of the subject. Note that you can't use the string printed
|
|
by <B>gpgsm --list-keys</B> because that one has been reordered and modified
|
|
for better readability; use <B>--with-colons</B> to print the raw
|
|
(but standard escaped) RFC-2253 string.
|
|
<P>
|
|
<DL COMPACT><DT id="438"><DD>
|
|
<PRE>
|
|
/CN=Heinrich Heine,O=Poets,L=Paris,C=FR
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="439"><B>By exact match on the issuer's DN.</B>
|
|
|
|
<DD>
|
|
This is indicated by a leading hash mark, directly followed by a slash
|
|
and then directly followed by the RFC-2253 encoded DN of the issuer.
|
|
This should return the Root cert of the issuer. See note above.
|
|
<P>
|
|
<DL COMPACT><DT id="440"><DD>
|
|
<PRE>
|
|
#/CN=Root Cert,O=Poets,L=Paris,C=FR
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="441"><B>By exact match on serial number and issuer's DN.</B>
|
|
|
|
<DD>
|
|
This is indicated by a hash mark, followed by the hexadecimal
|
|
representation of the serial number, then followed by a slash and the
|
|
RFC-2253 encoded DN of the issuer. See note above.
|
|
<P>
|
|
<DL COMPACT><DT id="442"><DD>
|
|
<PRE>
|
|
#4F03/CN=Root Cert,O=Poets,L=Paris,C=FR
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="443"><B>By keygrip.</B>
|
|
|
|
<DD>
|
|
This is indicated by an ampersand followed by the 40 hex digits of a
|
|
keygrip. <B>gpgsm</B> prints the keygrip when using the command
|
|
<B>--dump-cert</B>.
|
|
<P>
|
|
<DL COMPACT><DT id="444"><DD>
|
|
<PRE>
|
|
&D75F22C3F86E355877348498CDC92BD21010A480
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<DT id="445"><B>By substring match.</B>
|
|
|
|
<DD>
|
|
This is the default mode but applications may want to explicitly
|
|
indicate this by putting the asterisk in front. Match is not case
|
|
sensitive.
|
|
<P>
|
|
<DL COMPACT><DT id="446"><DD>
|
|
<PRE>
|
|
Heine
|
|
*Heine
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<DT id="447"><B>. and + prefixes</B>
|
|
|
|
<DD>
|
|
These prefixes are reserved for looking up mails anchored at the end
|
|
and for a word search mode. They are not yet implemented and using
|
|
them is undefined.
|
|
<P>
|
|
<P>
|
|
Please note that we have reused the hash mark identifier which was used
|
|
in old GnuPG versions to indicate the so called local-id. It is not
|
|
anymore used and there should be no conflict when used with X.509 stuff.
|
|
<P>
|
|
Using the RFC-2253 format of DNs has the drawback that it is not
|
|
possible to map them back to the original encoding, however we don't
|
|
have to do this because our key database stores this encoding as meta
|
|
data.
|
|
<P>
|
|
</DL>
|
|
<A NAME="lbAV"> </A>
|
|
<H2>FILTER EXPRESSIONS</H2>
|
|
|
|
<P>
|
|
The options <B>--import-filter</B> and <B>--export-filter</B> use
|
|
expressions with this syntax (square brackets indicate an optional
|
|
part and curly braces a repetition, white space between the elements
|
|
are allowed):
|
|
<P>
|
|
<DL COMPACT><DT id="448"><DD>
|
|
<DL COMPACT><DT id="449"><DD>
|
|
<PRE>
|
|
[lc] {[{flag}] PROPNAME op VALUE [lc]}
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
The name of a property (<I>PROPNAME</I>) may only consist of letters,
|
|
digits and underscores. The description for the filter type
|
|
describes which properties are defined. If an undefined property is
|
|
used it evaluates to the empty string. Unless otherwise noted, the
|
|
<I>VALUE</I> must always be given and may not be the empty string. No
|
|
quoting is defined for the value, thus the value may not contain the
|
|
strings <B>&&</B> or <B>||</B>, which are used as logical connection
|
|
operators. The flag <B>--</B> can be used to remove this restriction.
|
|
<P>
|
|
Numerical values are computed as long int; standard C notation
|
|
applies. <I>lc</I> is the logical connection operator; either
|
|
<B>&&</B> for a conjunction or <B>||</B> for a disjunction. A
|
|
conjunction is assumed at the begin of an expression. Conjunctions
|
|
have higher precedence than disjunctions. If <I>VALUE</I> starts with
|
|
one of the characters used in any <I>op</I> a space after the
|
|
<I>op</I> is required.
|
|
<P>
|
|
<P>
|
|
The supported operators (<I>op</I>) are:
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="450"><B>=~</B>
|
|
|
|
<DD>
|
|
Substring must match.
|
|
<P>
|
|
<DT id="451"><B>!~</B>
|
|
|
|
<DD>
|
|
Substring must not match.
|
|
<P>
|
|
<DT id="452"><B>=</B>
|
|
|
|
<DD>
|
|
The full string must match.
|
|
<P>
|
|
<DT id="453"><B><></B>
|
|
|
|
<DD>
|
|
The full string must not match.
|
|
<P>
|
|
<DT id="454"><B>==</B>
|
|
|
|
<DD>
|
|
The numerical value must match.
|
|
<P>
|
|
<DT id="455"><B>!=</B>
|
|
|
|
<DD>
|
|
The numerical value must not match.
|
|
<P>
|
|
<DT id="456"><B><=</B>
|
|
|
|
<DD>
|
|
The numerical value of the field must be LE than the value.
|
|
<P>
|
|
<DT id="457"><B><</B>
|
|
|
|
<DD>
|
|
The numerical value of the field must be LT than the value.
|
|
<P>
|
|
<DT id="458"><B>></B>
|
|
|
|
<DD>
|
|
The numerical value of the field must be GT than the value.
|
|
<P>
|
|
<DT id="459"><B>>=</B>
|
|
|
|
<DD>
|
|
The numerical value of the field must be GE than the value.
|
|
<P>
|
|
<DT id="460"><B>-le</B>
|
|
|
|
<DD>
|
|
The string value of the field must be less or equal than the value.
|
|
<P>
|
|
<DT id="461"><B>-lt</B>
|
|
|
|
<DD>
|
|
The string value of the field must be less than the value.
|
|
<P>
|
|
<DT id="462"><B>-gt</B>
|
|
|
|
<DD>
|
|
The string value of the field must be greater than the value.
|
|
<P>
|
|
<DT id="463"><B>-ge</B>
|
|
|
|
<DD>
|
|
The string value of the field must be greater or equal than the value.
|
|
<P>
|
|
<DT id="464"><B>-n</B>
|
|
|
|
<DD>
|
|
True if value is not empty (no value allowed).
|
|
<P>
|
|
<DT id="465"><B>-z</B>
|
|
|
|
<DD>
|
|
True if value is empty (no value allowed).
|
|
<P>
|
|
<DT id="466"><B>-t</B>
|
|
|
|
<DD>
|
|
Alias for "PROPNAME != 0" (no value allowed).
|
|
<P>
|
|
<DT id="467"><B>-f</B>
|
|
|
|
<DD>
|
|
Alias for "PROPNAME == 0" (no value allowed).
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<P>
|
|
Values for <I>flag</I> must be space separated. The supported flags
|
|
are:
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="468"><B>--</B>
|
|
|
|
<DD>
|
|
<I>VALUE</I> spans to the end of the expression.
|
|
<DT id="469"><B>-c</B>
|
|
|
|
<DD>
|
|
The string match in this part is done case-sensitive.
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
The filter options concatenate several specifications for a filter of
|
|
the same type. For example the four options in this example:
|
|
<P>
|
|
<DL COMPACT><DT id="470"><DD>
|
|
<DL COMPACT><DT id="471"><DD>
|
|
<PRE>
|
|
--import-filter keep-uid="uid =~ Alfa"
|
|
--import-filter keep-uid="&& uid !~ Test"
|
|
--import-filter keep-uid="|| uid =~ Alpha"
|
|
--import-filter keep-uid="uid !~ Test"
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
which is equivalent to
|
|
<P>
|
|
<DL COMPACT><DT id="472"><DD>
|
|
<DL COMPACT><DT id="473"><DD>
|
|
<PRE>
|
|
--import-filter \
|
|
keep-uid="uid =~ Alfa" && uid !~ Test" || uid =~ Alpha" && "uid !~ Test"
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
imports only the user ids of a key containing the strings "Alfa"
|
|
or "Alpha" but not the string "test".
|
|
<P>
|
|
<A NAME="lbAW"> </A>
|
|
<H2>TRUST VALUES</H2>
|
|
|
|
<P>
|
|
Trust values are used to indicate ownertrust and validity of keys and
|
|
user IDs. They are displayed with letters or strings:
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="474"><B>-</B>
|
|
|
|
<DD>
|
|
|
|
<B>unknown</B>
|
|
|
|
No ownertrust assigned / not yet calculated.
|
|
<P>
|
|
<DT id="475"><B>e</B>
|
|
|
|
<DD>
|
|
|
|
<B>expired</B>
|
|
|
|
<P>
|
|
Trust calculation has failed; probably due to an expired key.
|
|
<P>
|
|
<DT id="476"><B>q</B>
|
|
|
|
<DD>
|
|
|
|
<B>undefined, undef</B>
|
|
|
|
Not enough information for calculation.
|
|
<P>
|
|
<DT id="477"><B>n</B>
|
|
|
|
<DD>
|
|
|
|
<B>never</B>
|
|
|
|
Never trust this key.
|
|
<P>
|
|
<DT id="478"><B>m</B>
|
|
|
|
<DD>
|
|
|
|
<B>marginal</B>
|
|
|
|
Marginally trusted.
|
|
<P>
|
|
<DT id="479"><B>f</B>
|
|
|
|
<DD>
|
|
|
|
<B>full</B>
|
|
|
|
Fully trusted.
|
|
<P>
|
|
<DT id="480"><B>u</B>
|
|
|
|
<DD>
|
|
|
|
<B>ultimate</B>
|
|
|
|
Ultimately trusted.
|
|
<P>
|
|
<DT id="481"><B>r</B>
|
|
|
|
<DD>
|
|
|
|
<B>revoked</B>
|
|
|
|
For validity only: the key or the user ID has been revoked.
|
|
<P>
|
|
<DT id="482"><B>?</B>
|
|
|
|
<DD>
|
|
|
|
<B>err</B>
|
|
|
|
The program encountered an unknown trust value.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
<A NAME="lbAX"> </A>
|
|
<H2>FILES</H2>
|
|
|
|
<P>
|
|
There are a few configuration files to control certain aspects of
|
|
<B>gpg</B>'s operation. Unless noted, they are expected in the
|
|
current home directory (see: [option --homedir]).
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="483"><B>gpg.conf</B>
|
|
|
|
<DD>
|
|
This is the standard configuration file read by <B>gpg</B> on
|
|
startup. It may contain any valid long option; the leading two dashes
|
|
may not be entered and the option may not be abbreviated. This default
|
|
name may be changed on the command line (see: [gpg-option --options]).
|
|
You should backup this file.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
Note that on larger installations, it is useful to put predefined files
|
|
into the directory '<I>/etc/skel/.gnupg</I>' so that
|
|
newly created users start up with a working configuration.
|
|
For existing users a small
|
|
helper script is provided to create these files (see: [addgnupghome]).
|
|
<P>
|
|
For internal purposes <B>gpg</B> creates and maintains a few other
|
|
files; They all live in the current home directory (see: [option
|
|
--homedir]). Only the <B>gpg</B> program may modify these files.
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="484"><B>~/.gnupg</B>
|
|
|
|
<DD>
|
|
This is the default home directory which is used if neither the
|
|
environment variable <B>GNUPGHOME</B> nor the option
|
|
<B>--homedir</B> is given.
|
|
<P>
|
|
<DT id="485"><B>~/.gnupg/pubring.gpg</B>
|
|
|
|
<DD>
|
|
The public keyring. You should backup this file.
|
|
<P>
|
|
<DT id="486"><B>~/.gnupg/pubring.gpg.lock</B>
|
|
|
|
<DD>
|
|
The lock file for the public keyring.
|
|
<P>
|
|
<DT id="487"><B>~/.gnupg/pubring.kbx</B>
|
|
|
|
<DD>
|
|
The public keyring using a different format. This file is shared
|
|
with <B>gpgsm</B>. You should backup this file.
|
|
<P>
|
|
<DT id="488"><B>~/.gnupg/pubring.kbx.lock</B>
|
|
|
|
<DD>
|
|
The lock file for '<I>pubring.kbx</I>'.
|
|
<P>
|
|
<DT id="489"><B>~/.gnupg/secring.gpg</B>
|
|
|
|
<DD>
|
|
A secret keyring as used by GnuPG versions before 2.1. It is not
|
|
used by GnuPG 2.1 and later.
|
|
<P>
|
|
<DT id="490"><B>~/.gnupg/secring.gpg.lock</B>
|
|
|
|
<DD>
|
|
The lock file for the secret keyring.
|
|
<P>
|
|
<DT id="491"><B>~/.gnupg/.gpg-v21-migrated</B>
|
|
|
|
<DD>
|
|
File indicating that a migration to GnuPG 2.1 has been done.
|
|
<P>
|
|
<DT id="492"><B>~/.gnupg/trustdb.gpg</B>
|
|
|
|
<DD>
|
|
The trust database. There is no need to backup this file; it is better
|
|
to backup the ownertrust values (see: [option --export-ownertrust]).
|
|
<P>
|
|
<DT id="493"><B>~/.gnupg/trustdb.gpg.lock</B>
|
|
|
|
<DD>
|
|
The lock file for the trust database.
|
|
<P>
|
|
<DT id="494"><B>~/.gnupg/random_seed</B>
|
|
|
|
<DD>
|
|
A file used to preserve the state of the internal random pool.
|
|
<P>
|
|
<DT id="495"><B>~/.gnupg/openpgp-revocs.d/</B>
|
|
|
|
<DD>
|
|
This is the directory where gpg stores pre-generated revocation
|
|
certificates. The file name corresponds to the OpenPGP fingerprint of
|
|
the respective key. It is suggested to backup those certificates and
|
|
if the primary private key is not stored on the disk to move them to
|
|
an external storage device. Anyone who can access theses files is
|
|
able to revoke the corresponding key. You may want to print them out.
|
|
You should backup all files in this directory and take care to keep
|
|
this backup closed away.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
Operation is further controlled by a few environment variables:
|
|
<P>
|
|
<P>
|
|
<DL COMPACT>
|
|
<DT id="496"><B>HOME</B>
|
|
|
|
<DD>
|
|
Used to locate the default home directory.
|
|
<P>
|
|
<DT id="497"><B>GNUPGHOME</B>
|
|
|
|
<DD>
|
|
If set directory used instead of "~/.gnupg".
|
|
<P>
|
|
<DT id="498"><B>GPG_AGENT_INFO</B>
|
|
|
|
<DD>
|
|
This variable is obsolete; it was used by GnuPG versions before 2.1.
|
|
<P>
|
|
<DT id="499"><B>PINENTRY_USER_DATA</B>
|
|
|
|
<DD>
|
|
This value is passed via gpg-agent to pinentry. It is useful to convey
|
|
extra information to a custom pinentry.
|
|
<P>
|
|
<DT id="500"><B>COLUMNS</B>
|
|
|
|
<DD>
|
|
|
|
<B>LINES</B>
|
|
|
|
Used to size some displays to the full size of the screen.
|
|
<P>
|
|
<DT id="501"><B>LANGUAGE</B>
|
|
|
|
<DD>
|
|
Apart from its use by GNU, it is used in the W32 version to override the
|
|
language selection done through the Registry. If used and set to a
|
|
valid and available language name (<I>langid</I>), the file with the
|
|
translation is loaded from
|
|
<B></B><I>gpgdir</I>/gnupg.nls/<I>langid</I>.mo. Here <I>gpgdir</I> is the
|
|
directory out of which the gpg binary has been loaded. If it can't be
|
|
loaded the Registry is tried and as last resort the native Windows
|
|
locale system is used.
|
|
<P>
|
|
</DL>
|
|
<P>
|
|
|
|
<P>
|
|
When calling the gpg-agent component <B>gpg</B> sends a set of
|
|
environment variables to gpg-agent. The names of these variables can
|
|
be listed using the command:
|
|
<P>
|
|
<DL COMPACT><DT id="502"><DD>
|
|
<PRE>
|
|
gpg-connect-agent 'getinfo std_env_names' /bye | awk '$1=="D" {print $2}'
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAY"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
<P>
|
|
On older systems this program should be installed as setuid(root). This
|
|
is necessary to lock memory pages. Locking memory pages prevents the
|
|
operating system from writing memory pages (which may contain
|
|
passphrases or other sensitive material) to disk. If you get no
|
|
warning message about insecure memory your operating system supports
|
|
locking without being root. The program drops root privileges as soon
|
|
as locked memory is allocated.
|
|
<P>
|
|
Note also that some systems (especially laptops) have the ability to
|
|
``suspend to disk'' (also known as ``safe sleep'' or ``hibernate'').
|
|
This writes all memory to disk before going into a low power or even
|
|
powered off mode. Unless measures are taken in the operating system
|
|
to protect the saved memory, passphrases or other sensitive material
|
|
may be recoverable from it later.
|
|
<P>
|
|
Before you report a bug you should first search the mailing list
|
|
archives for similar problems and second check whether such a bug has
|
|
already been reported to our bug tracker at <B><A HREF="https://bugs.gnupg.org">https://bugs.gnupg.org</A></B>.
|
|
<P>
|
|
<P>
|
|
<A NAME="lbAZ"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?1+gpgv">gpgv</A></B>(1),
|
|
<B><A HREF="/cgi-bin/man/man2html?1+gpgsm">gpgsm</A></B>(1),
|
|
<B><A HREF="/cgi-bin/man/man2html?1+gpg-agent">gpg-agent</A></B>(1)
|
|
<P>
|
|
The full documentation for this tool is maintained as a Texinfo manual.
|
|
If GnuPG and the info program are properly installed at your site, the
|
|
command
|
|
<P>
|
|
<DL COMPACT><DT id="503"><DD>
|
|
<PRE>
|
|
info gnupg
|
|
</PRE>
|
|
|
|
</DL>
|
|
|
|
<P>
|
|
should give you access to the complete manual including a menu structure
|
|
and an index.
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="504"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="505"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="506"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="507"><A HREF="#lbAE">RETURN VALUE</A><DD>
|
|
<DT id="508"><A HREF="#lbAF">WARNINGS</A><DD>
|
|
<DT id="509"><A HREF="#lbAG">INTEROPERABILITY</A><DD>
|
|
<DT id="510"><A HREF="#lbAH">COMMANDS</A><DD>
|
|
<DL>
|
|
<DT id="511"><A HREF="#lbAI">Commands not specific to the function</A><DD>
|
|
<DT id="512"><A HREF="#lbAJ">Commands to select the type of operation</A><DD>
|
|
<DT id="513"><A HREF="#lbAK">How to manage your keys</A><DD>
|
|
</DL>
|
|
<DT id="514"><A HREF="#lbAL">OPTIONS</A><DD>
|
|
<DL>
|
|
<DT id="515"><A HREF="#lbAM">How to change the configuration</A><DD>
|
|
<DT id="516"><A HREF="#lbAN">Key related options</A><DD>
|
|
<DT id="517"><A HREF="#lbAO">Input and Output</A><DD>
|
|
<DT id="518"><A HREF="#lbAP">OpenPGP protocol specific options</A><DD>
|
|
<DT id="519"><A HREF="#lbAQ">Compliance options</A><DD>
|
|
<DT id="520"><A HREF="#lbAR">Doing things one usually doesn't want to do</A><DD>
|
|
<DT id="521"><A HREF="#lbAS">Deprecated options</A><DD>
|
|
</DL>
|
|
<DT id="522"><A HREF="#lbAT">EXAMPLES</A><DD>
|
|
<DT id="523"><A HREF="#lbAU">HOW TO SPECIFY A USER ID</A><DD>
|
|
<DT id="524"><A HREF="#lbAV">FILTER EXPRESSIONS</A><DD>
|
|
<DT id="525"><A HREF="#lbAW">TRUST VALUES</A><DD>
|
|
<DT id="526"><A HREF="#lbAX">FILES</A><DD>
|
|
<DT id="527"><A HREF="#lbAY">BUGS</A><DD>
|
|
<DT id="528"><A HREF="#lbAZ">SEE ALSO</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:15 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|