GPG
GPG
gpg2 --keyserver https://pgp.mit.edu/ --search-keys <sender_name_or_address>
gpg --import <your-file>.gpg
gpg --receive-keys A9C5DF4D22E99998D9875A5110C01C5A2F6059E7
gpg --verify apache-tomcat-9.0.16-windows-x64.zip.asc
ref: [1]
Show Keys
List public keys:
gpg --list-public-keys gpg --list-keys gpg -k
List secret keys:
gpg --list-secret-keys gpg -K
Export Key
Exoprt public key:
gpg --armor --export [long_key_id] > public.gpg.asc gpg --armor --output public.gpg.asc --export [long_key_id] gpg -a -o public.gpg.asc --export [long_key_id]
Export private key:
gpg --armor --export-secret-key [long_key_id] > private.gpg.asc gpg --armor --output private.gpg.asc --export-secret-key [long_key_id] gpg -a -o private.gpg.asc --export-secret-key [long_key_id]
Note: not sure why but the --output paramter has to come before the --export paramter?? All paramters just need to come before the [long_key_id] at the end. Example:
gpg -a --export -o public.gpg.asc [long_key_id]
Default Key
To choose a default key without having to specify --default-key on the command-line every time...
~/.gnupg/gpg.conf
default-key <key-fpr>
replacing <key-fpr> with the id or fingerprint of the key you want to use by default. [1]
Encrypt Message
Encrypt message to send to other person:
gpg --encrypt --sign --armor -r person@email.com name_of_file
Note: You should include a second “-r” recipient with your own email address if you want to be able to read the encrypted message.
Decrypt Message
gpg file_name.asc
Sign Message
Sign with detached signature:
gpg --detach-sign -o sig.gpg inputdata.txt
Option is meant to be used with ASCII (text) input data:
gpg --clearsign -o output.txt inputdata.txt
# will write it as inputdata.txt.asc gpg --clearsign inputdata.txt
Verify Signed Message
Verify with detached signature:
gpg --verify sig.gpg inputdata.txt
Note: Please remember that the signature file (.sig or .asc) should be the first file given on the command line.
Verify clear signed message:
gpg --verify output.txt
Decrypt message: (Show contents)
gpg --decrypt output.txt
# write original to file, without signature gpg -d -o original.txt output.txt
Import SSH to Remote System
gpg --export-secret-key SOMEKEYID | ssh othermachine gpg --import
GitHub GPG
Generating a new GPG key - GitHub Docs https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key
Generate GpG Key
gpg --full-generate-key
List Keys
gpg --list-secret-keys --keyid-format=long
Export Key
Exoprt public key:
gpg --armor --output public.gpg.asc --export [long_key_id]
Export private key:
gpg --armor --output private.gpg.asc --export-secret-key [long_key_id]
Sign Commit
Manually:
git commit -S -m "YOUR_COMMIT_MESSAGE"
Automatic for current local repository
git config commit.gpgsign true
Automatic for all repositories:
git config --global commit.gpgsign true
ref: [2]
Show Log Signatures
git log --show-signature
Example:
commit dceb035ce7a3de3dc49e62ce61061efd86XXXXXX (HEAD -> ci) gpg: Signature made Fri 09 Jun 2023 05:12:54 PM PDT gpg: using RSA key 6827A8ADAF633B8B03286E15C4D210675xxxxxxx gpg: issuer "name@example.com" gpg: Good signature from "Name <name@example.com>" [ultimate] Author: Name <name@example.com>
gpg --keyserver certserver.pgp.com --recv-key 0xBB7576AC
gpg --keyserver certserver.pgp.com --send-key blake@cyb.org
ref: [3]
Unknown Trust
ultimate vs unknown
You can edit your trust of a key:
gpg --edit-key user@useremail.com edit # (trust level 1-5) list quit
gpg --edit-key user@useremail.com
trust: unknown validity: unknown
gpg> trust
Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)
1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately
m = back to the main menu
Your decision? 5
gpg> save
gpg> quit
ref: [4]