diff options
Diffstat (limited to '')
| -rw-r--r-- | doc/gnupg.info-2 | 6144 |
1 files changed, 6144 insertions, 0 deletions
diff --git a/doc/gnupg.info-2 b/doc/gnupg.info-2 new file mode 100644 index 0000000..7895f56 --- /dev/null +++ b/doc/gnupg.info-2 @@ -0,0 +1,6144 @@ +This is gnupg.info, produced by makeinfo version 6.5 from gnupg.texi. + +This is the 'The GNU Privacy Guard Manual' (version 2.2.40-beta3, +October 2022). + + (C) 2002, 2004, 2005, 2006, 2007, 2010 Free Software Foundation, Inc. +(C) 2013, 2014, 2015 Werner Koch. +(C) 2015, 2016, 2017 g10 Code GmbH. + + Permission is granted to copy, distribute and/or modify this + document under the terms of the GNU General Public License as + published by the Free Software Foundation; either version 3 of the + License, or (at your option) any later version. The text of the + license can be found in the section entitled "Copying". +INFO-DIR-SECTION GNU Utilities +START-INFO-DIR-ENTRY +* gpg2: (gnupg). OpenPGP encryption and signing tool. +* gpgsm: (gnupg). S/MIME encryption and signing tool. +* gpg-agent: (gnupg). The secret key daemon. +* dirmngr: (gnupg). X.509 CRL and OCSP server. +* dirmngr-client: (gnupg). X.509 CRL and OCSP client. +END-INFO-DIR-ENTRY + + +File: gnupg.info, Node: GPGSM Protocol, Prev: Unattended Usage, Up: Invoking GPGSM + +5.6 The Protocol the Server Mode Uses +===================================== + +Description of the protocol used to access 'GPGSM'. 'GPGSM' does +implement the Assuan protocol and in addition provides a regular command +line interface which exhibits a full client to this protocol (but uses +internal linking). To start 'gpgsm' as a server the command line the +option '--server' must be used. Additional options are provided to +select the communication method (i.e. the name of the socket). + + We assume that the connection has already been established; see the +Assuan manual for details. + +* Menu: + +* GPGSM ENCRYPT:: Encrypting a message. +* GPGSM DECRYPT:: Decrypting a message. +* GPGSM SIGN:: Signing a message. +* GPGSM VERIFY:: Verifying a message. +* GPGSM GENKEY:: Generating a key. +* GPGSM LISTKEYS:: List available keys. +* GPGSM EXPORT:: Export certificates. +* GPGSM IMPORT:: Import certificates. +* GPGSM DELETE:: Delete certificates. +* GPGSM GETAUDITLOG:: Retrieve an audit log. +* GPGSM GETINFO:: Information about the process +* GPGSM OPTION:: Session options. + + +File: gnupg.info, Node: GPGSM ENCRYPT, Next: GPGSM DECRYPT, Up: GPGSM Protocol + +5.6.1 Encrypting a Message +-------------------------- + +Before encryption can be done the recipient must be set using the +command: + + RECIPIENT USERID + + Set the recipient for the encryption. USERID should be the internal +representation of the key; the server may accept any other way of +specification. If this is a valid and trusted recipient the server does +respond with OK, otherwise the return is an ERR with the reason why the +recipient cannot be used, the encryption will then not be done for this +recipient. If the policy is not to encrypt at all if not all recipients +are valid, the client has to take care of this. All 'RECIPIENT' +commands are cumulative until a 'RESET' or an successful 'ENCRYPT' +command. + + INPUT FD[=N] [--armor|--base64|--binary] + + Set the file descriptor for the message to be encrypted to N. +Obviously the pipe must be open at that point, the server establishes +its own end. If the server returns an error the client should consider +this session failed. If N is not given, this commands uses the last +file descriptor passed to the application. *Note the assuan_sendfd +function: (assuan)fun-assuan_sendfd, on how to do descriptor passing. + + The '--armor' option may be used to advise the server that the input +data is in PEM format, '--base64' advises that a raw base-64 encoding is +used, '--binary' advises of raw binary input (BER). If none of these +options is used, the server tries to figure out the used encoding, but +this may not always be correct. + + OUTPUT FD[=N] [--armor|--base64] + + Set the file descriptor to be used for the output (i.e. the +encrypted message). Obviously the pipe must be open at that point, the +server establishes its own end. If the server returns an error the +client should consider this session failed. + + The option '--armor' encodes the output in PEM format, the '--base64' +option applies just a base-64 encoding. No option creates binary output +(BER). + + The actual encryption is done using the command + + ENCRYPT + + It takes the plaintext from the 'INPUT' command, writes to the +ciphertext to the file descriptor set with the 'OUTPUT' command, take +the recipients from all the recipients set so far. If this command +fails the clients should try to delete all output currently done or +otherwise mark it as invalid. 'GPGSM' does ensure that there will not +be any security problem with leftover data on the output in this case. + + This command should in general not fail, as all necessary checks have +been done while setting the recipients. The input and output pipes are +closed. + + +File: gnupg.info, Node: GPGSM DECRYPT, Next: GPGSM SIGN, Prev: GPGSM ENCRYPT, Up: GPGSM Protocol + +5.6.2 Decrypting a message +-------------------------- + +Input and output FDs are set the same way as in encryption, but 'INPUT' +refers to the ciphertext and 'OUTPUT' to the plaintext. There is no +need to set recipients. 'GPGSM' automatically strips any S/MIME headers +from the input, so it is valid to pass an entire MIME part to the INPUT +pipe. + + The decryption is done by using the command + + DECRYPT + + It performs the decrypt operation after doing some check on the +internal state (e.g. that all needed data has been set). Because it +utilizes the GPG-Agent for the session key decryption, there is no need +to ask the client for a protecting passphrase - GpgAgent takes care of +this by requesting this from the user. + + +File: gnupg.info, Node: GPGSM SIGN, Next: GPGSM VERIFY, Prev: GPGSM DECRYPT, Up: GPGSM Protocol + +5.6.3 Signing a Message +----------------------- + +Signing is usually done with these commands: + + INPUT FD[=N] [--armor|--base64|--binary] + + This tells 'GPGSM' to read the data to sign from file descriptor N. + + OUTPUT FD[=M] [--armor|--base64] + + Write the output to file descriptor M. If a detached signature is +requested, only the signature is written. + + SIGN [--detached] + + Sign the data set with the 'INPUT' command and write it to the sink +set by 'OUTPUT'. With '--detached', a detached signature is created +(surprise). + + The key used for signing is the default one or the one specified in +the configuration file. To get finer control over the keys, it is +possible to use the command + + SIGNER USERID + + to set the signer's key. USERID should be the internal +representation of the key; the server may accept any other way of +specification. If this is a valid and trusted recipient the server does +respond with OK, otherwise the return is an ERR with the reason why the +key cannot be used, the signature will then not be created using this +key. If the policy is not to sign at all if not all keys are valid, the +client has to take care of this. All 'SIGNER' commands are cumulative +until a 'RESET' is done. Note that a 'SIGN' does not reset this list of +signers which is in contrast to the 'RECIPIENT' command. + + +File: gnupg.info, Node: GPGSM VERIFY, Next: GPGSM GENKEY, Prev: GPGSM SIGN, Up: GPGSM Protocol + +5.6.4 Verifying a Message +------------------------- + +To verify a message the command: + + VERIFY + + is used. It does a verify operation on the message send to the input +FD. The result is written out using status lines. If an output FD was +given, the signed text will be written to that. If the signature is a +detached one, the server will inquire about the signed material and the +client must provide it. + + +File: gnupg.info, Node: GPGSM GENKEY, Next: GPGSM LISTKEYS, Prev: GPGSM VERIFY, Up: GPGSM Protocol + +5.6.5 Generating a Key +---------------------- + +This is used to generate a new keypair, store the secret part in the PSE +and the public key in the key database. We will probably add optional +commands to allow the client to select whether a hardware token is used +to store the key. Configuration options to 'GPGSM' can be used to +restrict the use of this command. + + GENKEY + + 'GPGSM' checks whether this command is allowed and then does an +INQUIRY to get the key parameters, the client should then send the key +parameters in the native format: + + S: INQUIRE KEY_PARAM native + C: D foo:fgfgfg + C: D bar + C: END + + Please note that the server may send Status info lines while reading +the data lines from the client. After this the key generation takes +place and the server eventually does send an ERR or OK response. Status +lines may be issued as a progress indicator. + + +File: gnupg.info, Node: GPGSM LISTKEYS, Next: GPGSM EXPORT, Prev: GPGSM GENKEY, Up: GPGSM Protocol + +5.6.6 List available keys +------------------------- + +To list the keys in the internal database or using an external key +provider, the command: + + LISTKEYS PATTERN + + is used. To allow multiple patterns (which are ORed during the +search) quoting is required: Spaces are to be translated into "+" or +into "%20"; in turn this requires that the usual escape quoting rules +are done. + + LISTSECRETKEYS PATTERN + + Lists only the keys where a secret key is available. + + The list commands are affected by the option + + OPTION list-mode=MODE + + where mode may be: +'0' + Use default (which is usually the same as 1). +'1' + List only the internal keys. +'2' + List only the external keys. +'3' + List internal and external keys. + + Note that options are valid for the entire session. + + +File: gnupg.info, Node: GPGSM EXPORT, Next: GPGSM IMPORT, Prev: GPGSM LISTKEYS, Up: GPGSM Protocol + +5.6.7 Export certificates +------------------------- + +To export certificate from the internal key database the command: + + EXPORT [--data [--armor] [--base64]] [--] PATTERN + + is used. To allow multiple patterns (which are ORed) quoting is +required: Spaces are to be translated into "+" or into "%20"; in turn +this requires that the usual escape quoting rules are done. + + If the '--data' option has not been given, the format of the output +depends on what was set with the 'OUTPUT' command. When using PEM +encoding a few informational lines are prepended. + + If the '--data' has been given, a target set via 'OUTPUT' is ignored +and the data is returned inline using standard 'D'-lines. This avoids +the need for an extra file descriptor. In this case the options +'--armor' and '--base64' may be used in the same way as with the +'OUTPUT' command. + + +File: gnupg.info, Node: GPGSM IMPORT, Next: GPGSM DELETE, Prev: GPGSM EXPORT, Up: GPGSM Protocol + +5.6.8 Import certificates +------------------------- + +To import certificates into the internal key database, the command + + IMPORT [--re-import] + + is used. The data is expected on the file descriptor set with the +'INPUT' command. Certain checks are performed on the certificate. Note +that the code will also handle PKCS#12 files and import private keys; a +helper program is used for that. + + With the option '--re-import' the input data is expected to a be a +linefeed separated list of fingerprints. The command will re-import the +corresponding certificates; that is they are made permanent by removing +their ephemeral flag. + + +File: gnupg.info, Node: GPGSM DELETE, Next: GPGSM GETAUDITLOG, Prev: GPGSM IMPORT, Up: GPGSM Protocol + +5.6.9 Delete certificates +------------------------- + +To delete a certificate the command + + DELKEYS PATTERN + + is used. To allow multiple patterns (which are ORed) quoting is +required: Spaces are to be translated into "+" or into "%20"; in turn +this requires that the usual escape quoting rules are done. + + The certificates must be specified unambiguously otherwise an error +is returned. + + +File: gnupg.info, Node: GPGSM GETAUDITLOG, Next: GPGSM GETINFO, Prev: GPGSM DELETE, Up: GPGSM Protocol + +5.6.10 Retrieve an audit log +---------------------------- + +This command is used to retrieve an audit log. + + GETAUDITLOG [--data] [--html] + + If '--data' is used, the audit log is send using D-lines instead of +being sent to the file descriptor given by an 'OUTPUT' command. If +'--html' is used, the output is formatted as an XHTML block. This is +designed to be incorporated into a HTML document. + + +File: gnupg.info, Node: GPGSM GETINFO, Next: GPGSM OPTION, Prev: GPGSM GETAUDITLOG, Up: GPGSM Protocol + +5.6.11 Return information about the process +------------------------------------------- + +This is a multipurpose function to return a variety of information. + + GETINFO WHAT + + The value of WHAT specifies the kind of information returned: +'version' + Return the version of the program. +'pid' + Return the process id of the process. +'agent-check' + Return OK if the agent is running. +'cmd_has_option CMD OPT' + Return OK if the command CMD implements the option OPT. The + leading two dashes usually used with OPT shall not be given. +'offline' + Return OK if the connection is in offline mode. This may be either + due to a 'OPTION offline=1' or due to 'gpgsm' being started with + option '--disable-dirmngr'. + + +File: gnupg.info, Node: GPGSM OPTION, Prev: GPGSM GETINFO, Up: GPGSM Protocol + +5.6.12 Session options +---------------------- + +The standard Assuan option handler supports these options. + + OPTION NAME[=VALUE] + + These NAMEs are recognized: + +'putenv' + Change the session's environment to be passed via gpg-agent to + Pinentry. VALUE is a string of the form '<KEY>[=[<STRING>]]'. If + only '<KEY>' is given the environment variable '<KEY>' is removed + from the session environment, if '<KEY>=' is given that environment + variable is set to the empty string, and if '<STRING>' is given it + is set to that string. + +'display' + Set the session environment variable 'DISPLAY' is set to VALUE. +'ttyname' + Set the session environment variable 'GPG_TTY' is set to VALUE. +'ttytype' + Set the session environment variable 'TERM' is set to VALUE. +'lc-ctype' + Set the session environment variable 'LC_CTYPE' is set to VALUE. +'lc-messages' + Set the session environment variable 'LC_MESSAGES' is set to VALUE. +'xauthority' + Set the session environment variable 'XAUTHORITY' is set to VALUE. +'pinentry-user-data' + Set the session environment variable 'PINENTRY_USER_DATA' is set to + VALUE. + +'include-certs' + This option overrides the command line option '--include-certs'. A + VALUE of -2 includes all certificates except for the root + certificate, -1 includes all certificates, 0 does not include any + certificates, 1 includes only the signers certificate and all other + positive values include up to VALUE certificates starting with the + signer cert. + +'list-mode' + *Note gpgsm-cmd listkeys::. + +'list-to-output' + If VALUE is true the output of the list commands (*note gpgsm-cmd + listkeys::) is written to the file descriptor set with the last + 'OUTPUT' command. If VALUE is false the output is written via data + lines; this is the default. + +'with-validation' + If VALUE is true for each listed certificate the validation status + is printed. This may result in the download of a CRL or the user + being asked about the trustworthiness of a root certificate. The + default is given by a command line option (*note gpgsm-option + --with-validation::). + +'with-secret' + If VALUE is true certificates with a corresponding private key are + marked by the list commands. + +'validation-model' + This option overrides the command line option 'validation-model' + for the session. (*Note gpgsm-option --validation-model::.) + +'with-key-data' + This option globally enables the command line option + '--with-key-data'. (*Note gpgsm-option --with-key-data::.) + +'enable-audit-log' + If VALUE is true data to write an audit log is gathered. (*Note + gpgsm-cmd getauditlog::.) + +'allow-pinentry-notify' + If this option is used notifications about the launch of a Pinentry + are passed back to the client. + +'with-ephemeral-keys' + If VALUE is true ephemeral certificates are included in the output + of the list commands. + +'no-encrypt-to' + If this option is used all keys set by the command line option + '--encrypt-to' are ignored. + +'offline' + If VALUE is true or VALUE is not given all network access is + disabled for this session. This is the same as the command line + option '--disable-dirmngr'. + + +File: gnupg.info, Node: Invoking SCDAEMON, Next: Specify a User ID, Prev: Invoking GPGSM, Up: Top + +6 Invoking the SCDAEMON +*********************** + +The 'scdaemon' is a daemon to manage smartcards. It is usually invoked +by 'gpg-agent' and in general not used directly. + + *Note Option Index::, for an index to 'scdaemon''s commands and +options. + +* Menu: + +* Scdaemon Commands:: List of all commands. +* Scdaemon Options:: List of all options. +* Card applications:: Description of card applications. +* Scdaemon Configuration:: Configuration files. +* Scdaemon Examples:: Some usage examples. +* Scdaemon Protocol:: The protocol the daemon uses. + + +File: gnupg.info, Node: Scdaemon Commands, Next: Scdaemon Options, Up: Invoking SCDAEMON + +6.1 Commands +============ + +Commands are not distinguished from options except for the fact that +only one command is allowed. + +'--version' + Print the program version and licensing information. Note that you + cannot abbreviate this command. + +'--help, -h' + Print a usage message summarizing the most useful command-line + options. Note that you cannot abbreviate this command. + +'--dump-options' + Print a list of all available options and commands. Note that you + cannot abbreviate this command. + +'--server' + Run in server mode and wait for commands on the 'stdin'. The + default mode is to create a socket and listen for commands there. + +'--multi-server' + Run in server mode and wait for commands on the 'stdin' as well as + on an additional Unix Domain socket. The server command 'GETINFO' + may be used to get the name of that extra socket. + +'--daemon' + Run the program in the background. This option is required to + prevent it from being accidentally running in the background. + + +File: gnupg.info, Node: Scdaemon Options, Next: Card applications, Prev: Scdaemon Commands, Up: Invoking SCDAEMON + +6.2 Option Summary +================== + +'--options FILE' + Reads configuration from FILE instead of from the default per-user + configuration file. The default configuration file is named + 'scdaemon.conf' and expected in the '.gnupg' directory directly + below the home directory of the user. + +'--homedir DIR' + Set the name of the home directory to DIR. If this option is not + used, the home directory defaults to '~/.gnupg'. It is only + recognized when given on the command line. It also overrides any + home directory stated through the environment variable 'GNUPGHOME' + or (on Windows systems) by means of the Registry entry + HKCU\SOFTWARE\GNU\GNUPG:HOMEDIR. + + On Windows systems it is possible to install GnuPG as a portable + application. In this case only this command line option is + considered, all other ways to set a home directory are ignored. + + To install GnuPG as a portable application under Windows, create an + empty file named 'gpgconf.ctl' in the same directory as the tool + 'gpgconf.exe'. The root of the installation is then that + directory; or, if 'gpgconf.exe' has been installed directly below a + directory named 'bin', its parent directory. You also need to make + sure that the following directories exist and are writable: + 'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg' + for internal cache files. + +'-v' +'--verbose' + Outputs additional information while running. You can increase the + verbosity by giving several verbose commands to 'gpgsm', such as + '-vv'. + +'--debug-level LEVEL' + Select the debug level for investigating problems. LEVEL may be a + numeric value or a keyword: + + 'none' + No debugging at all. A value of less than 1 may be used + instead of the keyword. + 'basic' + Some basic debug messages. A value between 1 and 2 may be + used instead of the keyword. + 'advanced' + More verbose debug messages. A value between 3 and 5 may be + used instead of the keyword. + 'expert' + Even more detailed messages. A value between 6 and 8 may be + used instead of the keyword. + 'guru' + All of the debug messages you can get. A value greater than 8 + may be used instead of the keyword. The creation of hash + tracing files is only enabled if the keyword is used. + + How these messages are mapped to the actual debugging flags is not + specified and may change with newer releases of this program. They + are however carefully selected to best aid in debugging. + + Note: All debugging options are subject to change and thus + should not be used by any application program. As the name + says, they are only used as helpers to debug problems. + +'--debug FLAGS' + This option is only useful for debugging and the behavior may + change at any time without notice. FLAGS are bit encoded and may + be given in usual C-Syntax. The currently defined bits are: + + '0 (1)' + command I/O + '1 (2)' + values of big number integers + '2 (4)' + low level crypto operations + '5 (32)' + memory allocation + '6 (64)' + caching + '7 (128)' + show memory statistics + '9 (512)' + write hashed data to files named 'dbgmd-000*' + '10 (1024)' + trace Assuan protocol. See also option + '--debug-assuan-log-cats'. + '11 (2048)' + trace APDU I/O to the card. This may reveal sensitive data. + '12 (4096)' + trace some card reader related function calls. + +'--debug-all' + Same as '--debug=0xffffffff' + +'--debug-wait N' + When running in server mode, wait N seconds before entering the + actual processing loop and print the pid. This gives time to + attach a debugger. + +'--debug-ccid-driver' + Enable debug output from the included CCID driver for smartcards. + Using this option twice will also enable some tracing of the T=1 + protocol. Note that this option may reveal sensitive data. + +'--debug-disable-ticker' + This option disables all ticker functions like checking for card + insertions. + +'--debug-allow-core-dump' + For security reasons we won't create a core dump when the process + aborts. For debugging purposes it is sometimes better to allow + core dump. This option enables it and also changes the working + directory to '/tmp' when running in '--server' mode. + +'--debug-log-tid' + This option appends a thread ID to the PID in the log output. + +'--debug-assuan-log-cats CATS' + Changes the active Libassuan logging categories to CATS. The value + for CATS is an unsigned integer given in usual C-Syntax. A value + of 0 switches to a default category. If this option is not used + the categories are taken from the environment variable + 'ASSUAN_DEBUG'. Note that this option has only an effect if the + Assuan debug flag has also been with the option '--debug'. For a + list of categories see the Libassuan manual. + +'--no-detach' + Don't detach the process from the console. This is mainly useful + for debugging. + +'--listen-backlog N' + Set the size of the queue for pending connections. The default is + 64. This option has an effect only if '--multi-server' is also + used. + +'--log-file FILE' + Append all logging output to FILE. This is very helpful in seeing + what the agent actually does. Use 'socket://' to log to socket. + +'--pcsc-shared' + Use shared mode to access the card via PC/SC. This is a somewhat + dangerous option because Scdaemon assumes exclusivbe access to teh + card and for example caches certain information from the card. Use + this option only if you know what you are doing. + +'--pcsc-driver LIBRARY' + Use LIBRARY to access the smartcard reader. The current default on + Unix is 'libpcsclite.so' and on Windows 'winscard.dll'. Instead of + using this option you might also want to install a symbolic link to + the default file name (e.g. from 'libpcsclite.so.1'). A Unicode + file name may not be used on Windows. + +'--ctapi-driver LIBRARY' + Use LIBRARY to access the smartcard reader. The current default is + 'libtowitoko.so'. Note that the use of this interface is + deprecated; it may be removed in future releases. + +'--disable-ccid' + Disable the integrated support for CCID compliant readers. This + allows falling back to one of the other drivers even if the + internal CCID driver can handle the reader. Note, that CCID + support is only available if libusb was available at build time. + +'--reader-port NUMBER_OR_STRING' + This option may be used to specify the port of the card terminal. + A value of 0 refers to the first serial device; add 32768 to access + USB devices. The default is 32768 (first USB device). PC/SC or + CCID readers might need a string here; run the program in verbose + mode to get a list of available readers. The default is then the + first reader found. + + To get a list of available CCID readers you may use this command: + echo scd getinfo reader_list \ + | gpg-connect-agent --decode | awk '/^D/ {print $2}' + +'--card-timeout N' + If N is not 0 and no client is actively using the card, the card + will be powered down after N seconds. Powering down the card + avoids a potential risk of damaging a card when used with certain + cheap readers. This also allows applications that are not aware of + Scdaemon to access the card. The disadvantage of using a card + timeout is that accessing the card takes longer and that the user + needs to enter the PIN again after the next power up. + + Note that with the current version of Scdaemon the card is powered + down immediately at the next timer tick for any value of N other + than 0. + +'--enable-pinpad-varlen' + Please specify this option when the card reader supports variable + length input for pinpad (default is no). For known readers (listed + in ccid-driver.c and apdu.c), this option is not needed. Note that + if your card reader doesn't supports variable length input but you + want to use it, you need to specify your pinpad request on your + card. + +'--disable-pinpad' + Even if a card reader features a pinpad, do not try to use it. + +'--deny-admin' + This option disables the use of admin class commands for card + applications where this is supported. Currently we support it for + the OpenPGP card. This option is useful to inhibit accidental + access to admin class command which could ultimately lock the card + through wrong PIN numbers. Note that GnuPG versions older than + 2.0.11 featured an '--allow-admin' option which was required to use + such admin commands. This option has no more effect today because + the default is now to allow admin commands. + +'--disable-application NAME' + This option disables the use of the card application named NAME. + This is mainly useful for debugging or if a application with lower + priority should be used by default. + + All the long options may also be given in the configuration file +after stripping off the two leading dashes. + + +File: gnupg.info, Node: Card applications, Next: Scdaemon Configuration, Prev: Scdaemon Options, Up: Invoking SCDAEMON + +6.3 Description of card applications +==================================== + +'scdaemon' supports the card applications as described below. + +* Menu: + +* OpenPGP Card:: The OpenPGP card application +* NKS Card:: The Telesec NetKey card application +* DINSIG Card:: The DINSIG card application +* PKCS#15 Card:: The PKCS#15 card application +* Geldkarte Card:: The Geldkarte application +* SmartCard-HSM:: The SmartCard-HSM application +* Undefined Card:: The Undefined stub application + + +File: gnupg.info, Node: OpenPGP Card, Next: NKS Card, Up: Card applications + +6.3.1 The OpenPGP card application "openpgp" +-------------------------------------------- + +This application is currently only used by 'gpg' but may in future also +be useful with 'gpgsm'. Version 1 and version 2 of the card is +supported. + +The specifications for these cards are available at +<http://g10code.com/docs/openpgp-card-1.0.pdf> and +<http://g10code.com/docs/openpgp-card-2.0.pdf>. + + +File: gnupg.info, Node: NKS Card, Next: DINSIG Card, Prev: OpenPGP Card, Up: Card applications + +6.3.2 The Telesec NetKey card "nks" +----------------------------------- + +This is the main application of the Telesec cards as available in +Germany. It is a superset of the German DINSIG card. The card is used +by 'gpgsm'. + + +File: gnupg.info, Node: DINSIG Card, Next: PKCS#15 Card, Prev: NKS Card, Up: Card applications + +6.3.3 The DINSIG card application "dinsig" +------------------------------------------ + +This is an application as described in the German draft standard _DIN V +66291-1_. It is intended to be used by cards supporting the German +signature law and its bylaws (SigG and SigV). + + +File: gnupg.info, Node: PKCS#15 Card, Next: Geldkarte Card, Prev: DINSIG Card, Up: Card applications + +6.3.4 The PKCS#15 card application "p15" +---------------------------------------- + +This is common framework for smart card applications. It is used by +'gpgsm'. + + +File: gnupg.info, Node: Geldkarte Card, Next: SmartCard-HSM, Prev: PKCS#15 Card, Up: Card applications + +6.3.5 The Geldkarte card application "geldkarte" +------------------------------------------------ + +This is a simple application to display information of a German +Geldkarte. The Geldkarte is a small amount debit card application which +comes with almost all German banking cards. + + +File: gnupg.info, Node: SmartCard-HSM, Next: Undefined Card, Prev: Geldkarte Card, Up: Card applications + +6.3.6 The SmartCard-HSM card application "sc-hsm" +------------------------------------------------- + +This application adds read-only support for keys and certificates stored +on a SmartCard-HSM (http://www.smartcard-hsm.com). + + To generate keys and store certificates you may use OpenSC +(https://github.com/OpenSC/OpenSC/wiki/SmartCardHSM) or the tools from +OpenSCDP (http://www.openscdp.org). + + The SmartCard-HSM cards requires a card reader that supports Extended +Length APDUs. + + +File: gnupg.info, Node: Undefined Card, Prev: SmartCard-HSM, Up: Card applications + +6.3.7 The Undefined card application "undefined" +------------------------------------------------ + +This is a stub application to allow the use of the APDU command even if +no supported application is found on the card. This application is not +used automatically but must be explicitly requested using the SERIALNO +command. + + +File: gnupg.info, Node: Scdaemon Configuration, Next: Scdaemon Examples, Prev: Card applications, Up: Invoking SCDAEMON + +6.4 Configuration files +======================= + +There are a few configuration files to control certain aspects of +'scdaemons''s operation. Unless noted, they are expected in the current +home directory (*note option --homedir::). + +'scdaemon.conf' + This is the standard configuration file read by 'scdaemon' on + startup. It may contain any valid long option; the leading two + dashes may not be entered and the option may not be abbreviated. + This default name may be changed on the command line (*note option + --options::). + +'scd-event' + If this file is present and executable, it will be called on every + card reader's status change. An example of this script is provided + with the distribution + +'reader_N.status' + This file is created by 'scdaemon' to let other applications now + about reader status changes. Its use is now deprecated in favor of + 'scd-event'. + + +File: gnupg.info, Node: Scdaemon Examples, Next: Scdaemon Protocol, Prev: Scdaemon Configuration, Up: Invoking SCDAEMON + +6.5 Examples +============ + + $ scdaemon --server -v + + +File: gnupg.info, Node: Scdaemon Protocol, Prev: Scdaemon Examples, Up: Invoking SCDAEMON + +6.6 Scdaemon's Assuan Protocol +============================== + +The SC-Daemon should be started by the system to provide access to +external tokens. Using Smartcards on a multi-user system does not make +much sense except for system services, but in this case no regular user +accounts are hosted on the machine. + + A client connects to the SC-Daemon by connecting to the socket named +'/usr/local/var/run/gnupg/scdaemon/socket', configuration information is +read from /ETC/GNUPG/SCDAEMON.CONF + + Each connection acts as one session, SC-Daemon takes care of +synchronizing access to a token between sessions. + +* Menu: + +* Scdaemon SERIALNO:: Return the serial number. +* Scdaemon LEARN:: Read all useful information from the card. +* Scdaemon READCERT:: Return a certificate. +* Scdaemon READKEY:: Return a public key. +* Scdaemon PKSIGN:: Signing data with a Smartcard. +* Scdaemon PKDECRYPT:: Decrypting data with a Smartcard. +* Scdaemon GETATTR:: Read an attribute's value. +* Scdaemon SETATTR:: Update an attribute's value. +* Scdaemon WRITEKEY:: Write a key to a card. +* Scdaemon GENKEY:: Generate a new key on-card. +* Scdaemon RANDOM:: Return random bytes generated on-card. +* Scdaemon PASSWD:: Change PINs. +* Scdaemon CHECKPIN:: Perform a VERIFY operation. +* Scdaemon RESTART:: Restart connection +* Scdaemon APDU:: Send a verbatim APDU to the card + + +File: gnupg.info, Node: Scdaemon SERIALNO, Next: Scdaemon LEARN, Up: Scdaemon Protocol + +6.6.1 Return the serial number +------------------------------ + +This command should be used to check for the presence of a card. It is +special in that it can be used to reset the card. Most other commands +will return an error when a card change has been detected and the use of +this function is therefore required. + + Background: We want to keep the client clear of handling card changes +between operations; i.e. the client can assume that all operations are +done on the same card unless he call this function. + + SERIALNO + + Return the serial number of the card using a status response like: + + S SERIALNO D27600000000000000000000 + + The serial number is the hex encoded value identified by the '0x5A' +tag in the GDO file (FIX=0x2F02). + + +File: gnupg.info, Node: Scdaemon LEARN, Next: Scdaemon READCERT, Prev: Scdaemon SERIALNO, Up: Scdaemon Protocol + +6.6.2 Read all useful information from the card +----------------------------------------------- + + LEARN [--force] + + Learn all useful information of the currently inserted card. When +used without the '--force' option, the command might do an INQUIRE like +this: + + INQUIRE KNOWNCARDP <hexstring_with_serialNumber> + + The client should just send an 'END' if the processing should go on +or a 'CANCEL' to force the function to terminate with a cancel error +message. The response of this command is a list of status lines +formatted as this: + + S KEYPAIRINFO HEXSTRING_WITH_KEYGRIP HEXSTRING_WITH_ID + + If there is no certificate yet stored on the card a single "X" is +returned in HEXSTRING_WITH_KEYGRIP. + + +File: gnupg.info, Node: Scdaemon READCERT, Next: Scdaemon READKEY, Prev: Scdaemon LEARN, Up: Scdaemon Protocol + +6.6.3 Return a certificate +-------------------------- + + READCERT HEXIFIED_CERTID|KEYID + + This function is used to read a certificate identified by +HEXIFIED_CERTID from the card. With OpenPGP cards the keyid 'OpenPGP.3' +may be used to read the certificate of version 2 cards. + + +File: gnupg.info, Node: Scdaemon READKEY, Next: Scdaemon PKSIGN, Prev: Scdaemon READCERT, Up: Scdaemon Protocol + +6.6.4 Return a public key +------------------------- + + READKEY HEXIFIED_CERTID + + Return the public key for the given cert or key ID as an standard +S-Expression. + + +File: gnupg.info, Node: Scdaemon PKSIGN, Next: Scdaemon PKDECRYPT, Prev: Scdaemon READKEY, Up: Scdaemon Protocol + +6.6.5 Signing data with a Smartcard +----------------------------------- + +To sign some data the caller should use the command + + SETDATA HEXSTRING + + to tell 'scdaemon' about the data to be signed. The data must be +given in hex notation. The actual signing is done using the command + + PKSIGN KEYID + + where KEYID is the hexified ID of the key to be used. The key id may +have been retrieved using the command 'LEARN'. If another hash +algorithm than SHA-1 is used, that algorithm may be given like: + + PKSIGN --hash=ALGONAME KEYID + + With ALGONAME are one of 'sha1', 'rmd160' or 'md5'. + + +File: gnupg.info, Node: Scdaemon PKDECRYPT, Next: Scdaemon GETATTR, Prev: Scdaemon PKSIGN, Up: Scdaemon Protocol + +6.6.6 Decrypting data with a Smartcard +-------------------------------------- + +To decrypt some data the caller should use the command + + SETDATA HEXSTRING + + to tell 'scdaemon' about the data to be decrypted. The data must be +given in hex notation. The actual decryption is then done using the +command + + PKDECRYPT KEYID + + where KEYID is the hexified ID of the key to be used. + + If the card is aware of the apdding format a status line with padding +information is send before the plaintext data. The key for this status +line is 'PADDING' with the only defined value being 0 and meaning +padding has been removed. + + +File: gnupg.info, Node: Scdaemon GETATTR, Next: Scdaemon SETATTR, Prev: Scdaemon PKDECRYPT, Up: Scdaemon Protocol + +6.6.7 Read an attribute's value +------------------------------- + +TO BE WRITTEN. + + +File: gnupg.info, Node: Scdaemon SETATTR, Next: Scdaemon WRITEKEY, Prev: Scdaemon GETATTR, Up: Scdaemon Protocol + +6.6.8 Update an attribute's value +--------------------------------- + +TO BE WRITTEN. + + +File: gnupg.info, Node: Scdaemon WRITEKEY, Next: Scdaemon GENKEY, Prev: Scdaemon SETATTR, Up: Scdaemon Protocol + +6.6.9 Write a key to a card +--------------------------- + + WRITEKEY [--force] KEYID + + This command is used to store a secret key on a smartcard. The +allowed keyids depend on the currently selected smartcard application. +The actual keydata is requested using the inquiry 'KEYDATA' and need to +be provided without any protection. With '--force' set an existing key +under this KEYID will get overwritten. The key data is expected to be +the usual canonical encoded S-expression. + + A PIN will be requested in most cases. This however depends on the +actual card application. + + +File: gnupg.info, Node: Scdaemon GENKEY, Next: Scdaemon RANDOM, Prev: Scdaemon WRITEKEY, Up: Scdaemon Protocol + +6.6.10 Generate a new key on-card +--------------------------------- + +TO BE WRITTEN. + + +File: gnupg.info, Node: Scdaemon RANDOM, Next: Scdaemon PASSWD, Prev: Scdaemon GENKEY, Up: Scdaemon Protocol + +6.6.11 Return random bytes generated on-card +-------------------------------------------- + +TO BE WRITTEN. + + +File: gnupg.info, Node: Scdaemon PASSWD, Next: Scdaemon CHECKPIN, Prev: Scdaemon RANDOM, Up: Scdaemon Protocol + +6.6.12 Change PINs +------------------ + + PASSWD [--reset] [--nullpin] CHVNO + + Change the PIN or reset the retry counter of the card holder +verification vector number CHVNO. The option '--nullpin' is used to +initialize the PIN of TCOS cards (6 byte NullPIN only). + + +File: gnupg.info, Node: Scdaemon CHECKPIN, Next: Scdaemon RESTART, Prev: Scdaemon PASSWD, Up: Scdaemon Protocol + +6.6.13 Perform a VERIFY operation +--------------------------------- + + CHECKPIN IDSTR + + Perform a VERIFY operation without doing anything else. This may be +used to initialize a the PIN cache earlier to long lasting operations. +Its use is highly application dependent: + +*OpenPGP* + + Perform a simple verify operation for CHV1 and CHV2, so that + further operations won't ask for CHV2 and it is possible to do a + cheap check on the PIN: If there is something wrong with the PIN + entry system, only the regular CHV will get blocked and not the + dangerous CHV3. IDSTR is the usual card's serial number in hex + notation; an optional fingerprint part will get ignored. + + There is however a special mode if IDSTR is suffixed with the + literal string '[CHV3]': In this case the Admin PIN is checked if + and only if the retry counter is still at 3. + + +File: gnupg.info, Node: Scdaemon RESTART, Next: Scdaemon APDU, Prev: Scdaemon CHECKPIN, Up: Scdaemon Protocol + +6.6.14 Perform a RESTART operation +---------------------------------- + + RESTART + + Restart the current connection; this is a kind of warm reset. It +deletes the context used by this connection but does not actually reset +the card. + + This is used by gpg-agent to reuse a primary pipe connection and may +be used by clients to backup from a conflict in the serial command; i.e. +to select another application. + + +File: gnupg.info, Node: Scdaemon APDU, Prev: Scdaemon RESTART, Up: Scdaemon Protocol + +6.6.15 Send a verbatim APDU to the card +--------------------------------------- + + APDU [--atr] [--more] [--exlen[=N]] [HEXSTRING] + + Send an APDU to the current reader. This command bypasses the high +level functions and sends the data directly to the card. HEXSTRING is +expected to be a proper APDU. If HEXSTRING is not given no commands are +send to the card; However the command will implicitly check whether the +card is ready for use. + + Using the option '--atr' returns the ATR of the card as a status +message before any data like this: + S CARD-ATR 3BFA1300FF813180450031C173C00100009000B1 + + Using the option '--more' handles the card status word MORE_DATA +(61xx) and concatenate all responses to one block. + + Using the option '--exlen' the returned APDU may use extended length +up to N bytes. If N is not given a default value is used (currently +4096). + + +File: gnupg.info, Node: Specify a User ID, Next: Trust Values, Prev: Invoking SCDAEMON, Up: Top + +7 How to Specify a User Id +************************** + +There are different ways to specify a user ID to GnuPG. Some of them are +only valid for 'gpg' others are only good for 'gpgsm'. Here is the +entire list of ways to specify a key: + + * By key Id. This format is deduced from the length of the string + and its content or '0x' prefix. The key Id of an X.509 certificate + are the low 64 bits of its SHA-1 fingerprint. The use of key Ids + is just a shortcut, for all automated processing the fingerprint + should be used. + + When using 'gpg' an exclamation mark (!) may be appended to force + using the specified primary or secondary key and not to try and + calculate which primary or secondary key to use. + + The last four lines of the example give the key ID in their long + form as internally used by the OpenPGP protocol. You can see the + long key ID using the option '--with-colons'. + + 234567C4 + 0F34E556E + 01347A56A + 0xAB123456 + + 234AABBCC34567C4 + 0F323456784E56EAB + 01AB3FED1347A5612 + 0x234AABBCC34567C4 + + * By fingerprint. This format is deduced from the length of the + string and its content or the '0x' prefix. Note, that only the 20 + byte version fingerprint is available with 'gpgsm' (i.e. the SHA-1 + hash of the certificate). + + When using 'gpg' an exclamation mark (!) may be appended to force + using the specified primary or secondary key and not to try and + calculate which primary or secondary key to use. + + The best way to specify a key Id is by using the fingerprint. This + avoids any ambiguities in case that there are duplicated key IDs. + + 1234343434343434C434343434343434 + 123434343434343C3434343434343734349A3434 + 0E12343434343434343434EAB3484343434343434 + 0xE12343434343434343434EAB3484343434343434 + + 'gpgsm' also accepts colons between each pair of hexadecimal digits + because this is the de-facto standard on how to present X.509 + fingerprints. 'gpg' also allows the use of the space separated + SHA-1 fingerprint as printed by the key listing commands. + + * By exact match on OpenPGP user ID. This is denoted by a leading + equal sign. It does not make sense for X.509 certificates. + + =Heinrich Heine <heinrichh@uni-duesseldorf.de> + + * By exact match on an email address. This is indicated by enclosing + the email address in the usual way with left and right angles. + + <heinrichh@uni-duesseldorf.de> + + * By partial match on an email address. This is indicated by + prefixing the search string with an '@'. This uses a substring + search but considers only the mail address (i.e. inside the angle + brackets). + + @heinrichh + + * By exact match on the subject's DN. This is indicated by a leading + slash, directly followed by the RFC-2253 encoded DN of the subject. + Note that you can't use the string printed by 'gpgsm --list-keys' + because that one has been reordered and modified for better + readability; use '--with-colons' to print the raw (but standard + escaped) RFC-2253 string. + + /CN=Heinrich Heine,O=Poets,L=Paris,C=FR + + * By exact match on the issuer's DN. This is indicated by a leading + hash mark, directly followed by a slash and then directly followed + by the RFC-2253 encoded DN of the issuer. This should return the + Root cert of the issuer. See note above. + + #/CN=Root Cert,O=Poets,L=Paris,C=FR + + * By exact match on serial number and issuer's DN. This is indicated + by a hash mark, followed by the hexadecimal representation of the + serial number, then followed by a slash and the RFC-2253 encoded DN + of the issuer. See note above. + + #4F03/CN=Root Cert,O=Poets,L=Paris,C=FR + + * By keygrip. This is indicated by an ampersand followed by the 40 + hex digits of a keygrip. 'gpgsm' prints the keygrip when using the + command '--dump-cert'. + + &D75F22C3F86E355877348498CDC92BD21010A480 + + * By substring match. This is the default mode but applications may + want to explicitly indicate this by putting the asterisk in front. + Match is not case sensitive. + + Heine + *Heine + + * . and + prefixes These prefixes are reserved for looking up mails + anchored at the end and for a word search mode. They are not yet + implemented and using them is undefined. + + Please note that we have reused the hash mark identifier which was +used in old GnuPG versions to indicate the so called local-id. It is +not anymore used and there should be no conflict when used with X.509 +stuff. + + Using the RFC-2253 format of DNs has the drawback that it is not +possible to map them back to the original encoding, however we don't +have to do this because our key database stores this encoding as meta +data. + + +File: gnupg.info, Node: Trust Values, Next: Helper Tools, Prev: Specify a User ID, Up: Top + +8 Trust Values +************** + +Trust values are used to indicate ownertrust and validity of keys and +user IDs. They are displayed with letters or strings: + +- +unknown + No ownertrust assigned / not yet calculated. + +e +expired + + Trust calculation has failed; probably due to an expired key. + +q +undefined, undef + Not enough information for calculation. + +n +never + Never trust this key. + +m +marginal + Marginally trusted. + +f +full + Fully trusted. + +u +ultimate + Ultimately trusted. + +r +revoked + For validity only: the key or the user ID has been revoked. + +? +err + The program encountered an unknown trust value. + + +File: gnupg.info, Node: Helper Tools, Next: Web Key Service, Prev: Trust Values, Up: Top + +9 Helper Tools +************** + +GnuPG comes with a couple of smaller tools: + +* Menu: + +* watchgnupg:: Read logs from a socket. +* gpgv:: Verify OpenPGP signatures. +* addgnupghome:: Create .gnupg home directories. +* gpgconf:: Modify .gnupg home directories. +* applygnupgdefaults:: Run gpgconf for all users. +* gpg-preset-passphrase:: Put a passphrase into the cache. +* gpg-connect-agent:: Communicate with a running agent. +* dirmngr-client:: How to use the Dirmngr client tool. +* gpgparsemail:: Parse a mail message into an annotated format +* gpgtar:: Encrypt or sign files into an archive. +* gpg-check-pattern:: Check a passphrase on stdin against the patternfile. + + +File: gnupg.info, Node: watchgnupg, Next: gpgv, Up: Helper Tools + +9.1 Read logs from a socket +=========================== + +Most of the main utilities are able to write their log files to a Unix +Domain socket if configured that way. 'watchgnupg' is a simple listener +for such a socket. It ameliorates the output with a time stamp and +makes sure that long lines are not interspersed with log output from +other utilities. This tool is not available for Windows. + +'watchgnupg' is commonly invoked as + + watchgnupg --force $(gpgconf --list-dirs socketdir)/S.log + +This starts it on the current terminal for listening on the standard +logging socket (which is either '~/.gnupg/S.log' or +'/var/run/user/UID/gnupg/S.log'). + +'watchgnupg' understands these options: + +'--force' + Delete an already existing socket file. + +'--tcp N' + Instead of reading from a local socket, listen for connects on TCP + port N. + +'--time-only' + Do not print the date part of the timestamp. + +'--verbose' + Enable extra informational output. + +'--version' + Print version of the program and exit. + +'--help' + Display a brief help page and exit. + + +Examples +******** + + $ watchgnupg --force --time-only $(gpgconf --list-dirs socketdir)/S.log + + This waits for connections on the local socket (e.g. +'/home/foo/.gnupg/S.log') and shows all log entries. To make this work +the option 'log-file' needs to be used with all modules which logs are +to be shown. The suggested entry for the configuration files is: + + log-file socket:// + + If the default socket as given above and returned by "echo $(gpgconf +-list-dirs socketdir)/S.log" is not desired an arbitrary socket name can +be specified, for example 'socket:///home/foo/bar/mysocket'. For +debugging purposes it is also possible to do remote logging. Take care +if you use this feature because the information is send in the clear +over the network. Use this syntax in the conf files: + + log-file tcp://192.168.1.1:4711 + + You may use any port and not just 4711 as shown above; only IP +addresses are supported (v4 and v6) and no host names. You need to +start 'watchgnupg' with the 'tcp' option. Note that under Windows the +registry entry HKCU\SOFTWARE\GNU\GNUPG:DEFAULTLOGFILE can be used to +change the default log output from 'stderr' to whatever is given by that +entry. However the only useful entry is a TCP name for remote +debugging. + + +File: gnupg.info, Node: gpgv, Next: addgnupghome, Prev: watchgnupg, Up: Helper Tools + +9.2 Verify OpenPGP signatures +============================= + +'gpgv' is an OpenPGP signature verification tool. + + This program is actually a stripped-down version of 'gpg' which is +only able to check signatures. It is somewhat smaller than the +fully-blown 'gpg' and uses a different (and simpler) way to check that +the public keys used to make the signature are valid. There are no +configuration files and only a few options are implemented. + + 'gpgv' assumes that all keys in the keyring are trustworthy. That +does also mean that it does not check for expired or revoked keys. + + If no '--keyring' option is given, 'gpgv' looks for a "default" +keyring named 'trustedkeys.kbx' (preferred) or 'trustedkeys.gpg' in the +home directory of GnuPG, either the default home directory or the one +set by the '--homedir' option or the 'GNUPGHOME' environment variable. +If any '--keyring' option is used, 'gpgv' will not look for the default +keyring. The '--keyring' option may be used multiple times and all +specified keyrings will be used together. + + + 'gpgv' recognizes these options: + +'--verbose' +'-v' + Gives more information during processing. If used twice, the input + data is listed in detail. + +'--quiet' +'-q' + Try to be as quiet as possible. + +'--keyring FILE' + Add FILE to the list of keyrings. If FILE begins with a tilde and + a slash, these are replaced by the HOME directory. If the filename + does not contain a slash, it is assumed to be in the home-directory + ("~/.gnupg" if -homedir is not used). + +'--output FILE' +'-o FILE' + Write output to FILE; to write to stdout use '-'. This option can + be used to get the signed text from a cleartext or binary + signature; it also works for detached signatures, but in that case + this option is in general not useful. Note that an existing file + will be overwritten. + +'--status-fd N' + Write special status strings to the file descriptor N. See the + file DETAILS in the documentation for a listing of them. + +'--logger-fd n' + Write log output to file descriptor 'n' and not to stderr. + +'--log-file file' + Same as '--logger-fd', except the logger data is written to file + 'file'. Use 'socket://' to log to socket. + +'--ignore-time-conflict' + GnuPG normally checks that the timestamps associated with keys and + signatures have plausible values. However, sometimes a signature + seems to be older than the key due to clock problems. This option + turns these checks into warnings. + +'--homedir DIR' + Set the name of the home directory to DIR. If this option is not + used, the home directory defaults to '~/.gnupg'. It is only + recognized when given on the command line. It also overrides any + home directory stated through the environment variable 'GNUPGHOME' + or (on Windows systems) by means of the Registry entry + HKCU\SOFTWARE\GNU\GNUPG:HOMEDIR. + + On Windows systems it is possible to install GnuPG as a portable + application. In this case only this command line option is + considered, all other ways to set a home directory are ignored. + + To install GnuPG as a portable application under Windows, create an + empty file named 'gpgconf.ctl' in the same directory as the tool + 'gpgconf.exe'. The root of the installation is then that + directory; or, if 'gpgconf.exe' has been installed directly below a + directory named 'bin', its parent directory. You also need to make + sure that the following directories exist and are writable: + 'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg' + for internal cache files. + +'--weak-digest name' + Treat the specified digest algorithm as weak. Signatures made over + weak digests algorithms are normally rejected. This option can be + supplied multiple times if multiple algorithms should be considered + weak. MD5 is always considered weak, and does not need to be + listed explicitly. + +'--enable-special-filenames' + This option enables a mode in which filenames of the form '-&n', + where n is a non-negative decimal number, refer to the file + descriptor n and not to a file with that name. + + The program returns 0 if everything is fine, 1 if at least one +signature was bad, and other error codes for fatal errors. + +9.2.1 Examples +-------------- + +gpgv 'pgpfile' +gpgv 'sigfile' ['datafile'] + Verify the signature of the file. The second form is used for + detached signatures, where 'sigfile' is the detached signature + (either ASCII-armored or binary) and 'datafile' contains the signed + data; if 'datafile' is "-" the signed data is expected on 'stdin'; + if 'datafile' is not given the name of the file holding the signed + data is constructed by cutting off the extension (".asc", ".sig" or + ".sign") from 'sigfile'. + +9.2.2 Environment +----------------- + +HOME + Used to locate the default home directory. + +GNUPGHOME + If set directory used instead of "~/.gnupg". + +9.2.3 FILES +----------- + +~/.gnupg/trustedkeys.gpg + The default keyring with the allowed keys. + + 'gpg'(1) + + +File: gnupg.info, Node: addgnupghome, Next: gpgconf, Prev: gpgv, Up: Helper Tools + +9.3 Create .gnupg home directories +================================== + +If GnuPG is installed on a system with existing user accounts, it is +sometimes required to populate the GnuPG home directory with existing +files. Especially a 'trustlist.txt' and a keybox with some initial +certificates are often desired. This script helps to do this by copying +all files from '/etc/skel/.gnupg' to the home directories of the +accounts given on the command line. It takes care not to overwrite +existing GnuPG home directories. + +'addgnupghome' is invoked by root as: + + addgnupghome account1 account2 ... accountn + + +File: gnupg.info, Node: gpgconf, Next: applygnupgdefaults, Prev: addgnupghome, Up: Helper Tools + +9.4 Modify .gnupg home directories +================================== + +The 'gpgconf' is a utility to automatically and reasonable safely query +and modify configuration files in the '.gnupg' home directory. It is +designed not to be invoked manually by the user, but automatically by +graphical user interfaces (GUI).(1) + + 'gpgconf' provides access to the configuration of one or more +components of the GnuPG system. These components correspond more or +less to the programs that exist in the GnuPG framework, like GPG, GPGSM, +DirMngr, etc. But this is not a strict one-to-one relationship. Not +all configuration options are available through 'gpgconf'. 'gpgconf' +provides a generic and abstract method to access the most important +configuration options that can feasibly be controlled via such a +mechanism. + + 'gpgconf' can be used to gather and change the options available in +each component, and can also provide their default values. 'gpgconf' +will give detailed type information that can be used to restrict the +user's input without making an attempt to commit the changes. + + 'gpgconf' provides the backend of a configuration editor. The +configuration editor would usually be a graphical user interface program +that displays the current options, their default values, and allows the +user to make changes to the options. These changes can then be made +active with 'gpgconf' again. Such a program that uses 'gpgconf' in this +way will be called GUI throughout this section. + +* Menu: + +* Invoking gpgconf:: List of all commands and options. +* Format conventions:: Formatting conventions relevant for all commands. +* Listing components:: List all gpgconf components. +* Checking programs:: Check all programs known to gpgconf. +* Listing options:: List all options of a component. +* Changing options:: Changing options of a component. +* Listing global options:: List all global options. +* Querying versions:: Get and compare software versions. +* Files used by gpgconf:: What files are used by gpgconf. + + ---------- Footnotes ---------- + + (1) Please note that currently no locking is done, so concurrent +access should be avoided. There are some precautions to avoid +corruption with concurrent usage, but results may be inconsistent and +some changes may get lost. The stateless design makes it difficult to +provide more guarantees. + + +File: gnupg.info, Node: Invoking gpgconf, Next: Format conventions, Up: gpgconf + +9.4.1 Invoking gpgconf +---------------------- + +One of the following commands must be given: + +'--list-components' + List all components. This is the default command used if none is + specified. + +'--check-programs' + List all available backend programs and test whether they are + runnable. + +'--list-options COMPONENT' + List all options of the component COMPONENT. + +'--change-options COMPONENT' + Change the options of the component COMPONENT. + +'--check-options COMPONENT' + Check the options for the component COMPONENT. + +'--apply-profile FILE' + Apply the configuration settings listed in FILE to the + configuration files. If FILE has no suffix and no slashes the + command first tries to read a file with the suffix '.prf' from the + data directory ('gpgconf --list-dirs datadir') before it reads the + file verbatim. A profile is divided into sections using the + bracketed component name. Each section then lists the option which + shall go into the respective configuration file. + +'--apply-defaults' + Update all configuration files with values taken from the global + configuration file (usually '/etc/gnupg/gpgconf.conf'). Note: This + is a legacy mechanism. Please use global configuraion files + instead. + +'--list-dirs [NAMES]' +'-L' + Lists the directories used by 'gpgconf'. One directory is listed + per line, and each line consists of a colon-separated list where + the first field names the directory type (for example 'sysconfdir') + and the second field contains the percent-escaped directory. + Although they are not directories, the socket file names used by + 'gpg-agent' and 'dirmngr' are printed as well. Note that the + socket file names and the 'homedir' lines are the default names and + they may be overridden by command line switches. If NAMES are + given only the directories or file names specified by the list + names are printed without any escaping. + +'--list-config [FILENAME]' + List the global configuration file in a colon separated format. If + FILENAME is given, check that file instead. + +'--check-config [FILENAME]' + Run a syntax check on the global configuration file. If FILENAME + is given, check that file instead. + +'--query-swdb PACKAGE_NAME [VERSION_STRING]' + Returns the current version for PACKAGE_NAME and if VERSION_STRING + is given also an indicator on whether an update is available. The + actual file with the software version is automatically downloaded + and checked by 'dirmngr'. 'dirmngr' uses a thresholds to avoid + download the file too often and it does this by default only if it + can be done via Tor. To force an update of that file this command + can be used: + + gpg-connect-agent --dirmngr 'loadswdb --force' /bye + +'--reload [COMPONENT]' +'-R' + Reload all or the given component. This is basically the same as + sending a SIGHUP to the component. Components which don't support + reloading are ignored. Without COMPONENT or by using "all" for + COMPONENT all components which are daemons are reloaded. + +'--launch [COMPONENT]' + If the COMPONENT is not already running, start it. 'component' + must be a daemon. This is in general not required because the + system starts these daemons as needed. However, external software + making direct use of 'gpg-agent' or 'dirmngr' may use this command + to ensure that they are started. Using "all" for COMPONENT + launches all components which are daemons. + +'--kill [COMPONENT]' +'-K' + Kill the given component that runs as a daemon, including + 'gpg-agent', 'dirmngr', and 'scdaemon'. A 'component' which does + not run as a daemon will be ignored. Using "all" for COMPONENT + kills all components running as daemons. Note that as of now + reload and kill have the same effect for 'scdaemon'. + +'--create-socketdir' + Create a directory for sockets below /run/user or /var/run/user. + This is command is only required if a non default home directory is + used and the /run based sockets shall be used. For the default + home directory GnUPG creates a directory on the fly. + +'--remove-socketdir' + Remove a directory created with command '--create-socketdir'. + + The following options may be used: + +'-o FILE' +'--output FILE' + Write output to FILE. Default is to write to stdout. + +'-v' +'--verbose' + Outputs additional information while running. Specifically, this + extends numerical field values by human-readable descriptions. + +'-q' +'--quiet' + Try to be as quiet as possible. + +'--homedir DIR' + Set the name of the home directory to DIR. If this option is not + used, the home directory defaults to '~/.gnupg'. It is only + recognized when given on the command line. It also overrides any + home directory stated through the environment variable 'GNUPGHOME' + or (on Windows systems) by means of the Registry entry + HKCU\SOFTWARE\GNU\GNUPG:HOMEDIR. + + On Windows systems it is possible to install GnuPG as a portable + application. In this case only this command line option is + considered, all other ways to set a home directory are ignored. + + To install GnuPG as a portable application under Windows, create an + empty file named 'gpgconf.ctl' in the same directory as the tool + 'gpgconf.exe'. The root of the installation is then that + directory; or, if 'gpgconf.exe' has been installed directly below a + directory named 'bin', its parent directory. You also need to make + sure that the following directories exist and are writable: + 'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg' + for internal cache files. + +'-n' +'--dry-run' + Do not actually change anything. This is currently only + implemented for '--change-options' and can be used for testing + purposes. + +'-r' +'--runtime' + Only used together with '--change-options'. If one of the modified + options can be changed in a running daemon process, signal the + running daemon to ask it to reparse its configuration file after + changing. + + This means that the changes will take effect at run-time, as far as + this is possible. Otherwise, they will take effect at the next + start of the respective backend programs. + +'--status-fd N' + Write special status strings to the file descriptor N. This + program returns the status messages SUCCESS or FAILURE which are + helpful when the caller uses a double fork approach and can't + easily get the return code of the process. + + +File: gnupg.info, Node: Format conventions, Next: Listing components, Prev: Invoking gpgconf, Up: gpgconf + +9.4.2 Format conventions +------------------------ + +Some lines in the output of 'gpgconf' contain a list of colon-separated +fields. The following conventions apply: + + * The GUI program is required to strip off trailing newline and/or + carriage return characters from the output. + + * 'gpgconf' will never leave out fields. If a certain version + provides a certain field, this field will always be present in all + 'gpgconf' versions from that time on. + + * Future versions of 'gpgconf' might append fields to the list. New + fields will always be separated from the previously last field by a + colon separator. The GUI should be prepared to parse the last + field it knows about up until a colon or end of line. + + * Not all fields are defined under all conditions. You are required + to ignore the content of undefined fields. + + There are several standard types for the content of a field: + +verbatim + Some fields contain strings that are not escaped in any way. Such + fields are described to be used _verbatim_. These fields will + never contain a colon character (for obvious reasons). No + de-escaping or other formatting is required to use the field + content. This is for easy parsing of the output, when it is known + that the content can never contain any special characters. + +percent-escaped + Some fields contain strings that are described to be + _percent-escaped_. Such strings need to be de-escaped before their + content can be presented to the user. A percent-escaped string is + de-escaped by replacing all occurrences of '%XY' by the byte that + has the hexadecimal value 'XY'. 'X' and 'Y' are from the set + '0-9a-f'. + +localized + Some fields contain strings that are described to be _localized_. + Such strings are translated to the active language and formatted in + the active character set. + +unsigned number + Some fields contain an _unsigned number_. This number will always + fit into a 32-bit unsigned integer variable. The number may be + followed by a space, followed by a human readable description of + that value (if the verbose option is used). You should ignore + everything in the field that follows the number. + +signed number + Some fields contain a _signed number_. This number will always fit + into a 32-bit signed integer variable. The number may be followed + by a space, followed by a human readable description of that value + (if the verbose option is used). You should ignore everything in + the field that follows the number. + +boolean value + Some fields contain a _boolean value_. This is a number with + either the value 0 or 1. The number may be followed by a space, + followed by a human readable description of that value (if the + verbose option is used). You should ignore everything in the field + that follows the number; checking just the first character is + sufficient in this case. + +option + Some fields contain an _option_ argument. The format of an option + argument depends on the type of the option and on some flags: + + no argument + The simplest case is that the option does not take an argument + at all (TYPE '0'). Then the option argument is an unsigned + number that specifies how often the option occurs. If the + 'list' flag is not set, then the only valid number is '1'. + Options that do not take an argument never have the 'default' + or 'optional arg' flag set. + + number + If the option takes a number argument (ALT-TYPE is '2' or + '3'), and it can only occur once ('list' flag is not set), + then the option argument is either empty (only allowed if the + argument is optional), or it is a number. A number is a + string that begins with an optional minus character, followed + by one or more digits. The number must fit into an integer + variable (unsigned or signed, depending on ALT-TYPE). + + number list + If the option takes a number argument and it can occur more + than once, then the option argument is either empty, or it is + a comma-separated list of numbers as described above. + + string + If the option takes a string argument (ALT-TYPE is 1), and it + can only occur once ('list' flag is not set) then the option + argument is either empty (only allowed if the argument is + optional), or it starts with a double quote character ('"') + followed by a percent-escaped string that is the argument + value. Note that there is only a leading double quote + character, no trailing one. The double quote character is + only needed to be able to differentiate between no value and + the empty string as value. + + string list + If the option takes a string argument and it can occur more + than once, then the option argument is either empty, or it is + a comma-separated list of string arguments as described above. + + The active language and character set are currently determined from +the locale environment of the 'gpgconf' program. + + +File: gnupg.info, Node: Listing components, Next: Checking programs, Prev: Format conventions, Up: gpgconf + +9.4.3 Listing components +------------------------ + +The command '--list-components' will list all components that can be +configured with 'gpgconf'. Usually, one component will correspond to +one GnuPG-related program and contain the options of that program's +configuration file that can be modified using 'gpgconf'. However, this +is not necessarily the case. A component might also be a group of +selected options from several programs, or contain entirely virtual +options that have a special effect rather than changing exactly one +option in one configuration file. + + A component is a set of configuration options that semantically +belong together. Furthermore, several changes to a component can be +made in an atomic way with a single operation. The GUI could for +example provide a menu with one entry for each component, or a window +with one tabulator sheet per component. + + The command '--list-components' lists all available components, one +per line. The format of each line is: + + 'NAME:DESCRIPTION:PGMNAME:' + +NAME + This field contains a name tag of the component. The name tag is + used to specify the component in all communication with 'gpgconf'. + The name tag is to be used _verbatim_. It is thus not in any + escaped format. + +DESCRIPTION + The _string_ in this field contains a human-readable description of + the component. It can be displayed to the user of the GUI for + informational purposes. It is _percent-escaped_ and _localized_. + +PGMNAME + The _string_ in this field contains the absolute name of the + program's file. It can be used to unambiguously invoke that + program. It is _percent-escaped_. + + Example: + $ gpgconf --list-components + gpg:GPG for OpenPGP:/usr/local/bin/gpg2: + gpg-agent:GPG Agent:/usr/local/bin/gpg-agent: + scdaemon:Smartcard Daemon:/usr/local/bin/scdaemon: + gpgsm:GPG for S/MIME:/usr/local/bin/gpgsm: + dirmngr:Directory Manager:/usr/local/bin/dirmngr: + + +File: gnupg.info, Node: Checking programs, Next: Listing options, Prev: Listing components, Up: gpgconf + +9.4.4 Checking programs +----------------------- + +The command '--check-programs' is similar to '--list-components' but +works on backend programs and not on components. It runs each program +to test whether it is installed and runnable. This also includes a +syntax check of all config file options of the program. + + The command '--check-programs' lists all available programs, one per +line. The format of each line is: + + 'NAME:DESCRIPTION:PGMNAME:AVAIL:OKAY:CFGFILE:LINE:ERROR:' + +NAME + This field contains a name tag of the program which is identical to + the name of the component. The name tag is to be used _verbatim_. + It is thus not in any escaped format. This field may be empty to + indicate a continuation of error descriptions for the last name. + The description and pgmname fields are then also empty. + +DESCRIPTION + The _string_ in this field contains a human-readable description of + the component. It can be displayed to the user of the GUI for + informational purposes. It is _percent-escaped_ and _localized_. + +PGMNAME + The _string_ in this field contains the absolute name of the + program's file. It can be used to unambiguously invoke that + program. It is _percent-escaped_. + +AVAIL + The _boolean value_ in this field indicates whether the program is + installed and runnable. + +OKAY + The _boolean value_ in this field indicates whether the program's + config file is syntactically okay. + +CFGFILE + If an error occurred in the configuration file (as indicated by a + false value in the field 'okay'), this field has the name of the + failing configuration file. It is _percent-escaped_. + +LINE + If an error occurred in the configuration file, this field has the + line number of the failing statement in the configuration file. It + is an _unsigned number_. + +ERROR + If an error occurred in the configuration file, this field has the + error text of the failing statement in the configuration file. It + is _percent-escaped_ and _localized_. + +In the following example the 'dirmngr' is not runnable and the +configuration file of 'scdaemon' is not okay. + + $ gpgconf --check-programs + gpg:GPG for OpenPGP:/usr/local/bin/gpg2:1:1: + gpg-agent:GPG Agent:/usr/local/bin/gpg-agent:1:1: + scdaemon:Smartcard Daemon:/usr/local/bin/scdaemon:1:0: + gpgsm:GPG for S/MIME:/usr/local/bin/gpgsm:1:1: + dirmngr:Directory Manager:/usr/local/bin/dirmngr:0:0: + +The command '--check-options COMPONENT' will verify the configuration +file in the same manner as '--check-programs', but only for the +component COMPONENT. + + +File: gnupg.info, Node: Listing options, Next: Changing options, Prev: Checking programs, Up: gpgconf + +9.4.5 Listing options +--------------------- + +Every component contains one or more options. Options may be gathered +into option groups to allow the GUI to give visual hints to the user +about which options are related. + + The command '--list-options COMPONENT' lists all options (and the +groups they belong to) in the component COMPONENT, one per line. +COMPONENT must be the string in the field NAME in the output of the +'--list-components' command. + + Take care if system-wide options are used: gpgconf may not be able to +properly show the options and the listed options may have no actual +effect in case the system-wide options enforced their own settings. + + There is one line for each option and each group. First come all +options that are not in any group. Then comes a line describing a +group. Then come all options that belong into each group. Then comes +the next group and so on. There does not need to be any group (and in +this case the output will stop after the last non-grouped option). + + The format of each line is: + + 'NAME:FLAGS:LEVEL:DESCRIPTION:TYPE:ALT-TYPE:ARGNAME:DEFAULT:ARGDEF:VALUE' + +NAME + This field contains a name tag for the group or option. The name + tag is used to specify the group or option in all communication + with 'gpgconf'. The name tag is to be used _verbatim_. It is thus + not in any escaped format. + +FLAGS + The flags field contains an _unsigned number_. Its value is the + OR-wise combination of the following flag values: + + 'group (1)' + If this flag is set, this is a line describing a group and not + an option. + + The following flag values are only defined for options (that is, if + the 'group' flag is not used). + + 'optional arg (2)' + If this flag is set, the argument is optional. This is never + set for TYPE '0' (none) options. + + 'list (4)' + If this flag is set, the option can be given multiple times. + + 'runtime (8)' + If this flag is set, the option can be changed at runtime. + + 'default (16)' + If this flag is set, a default value is available. + + 'default desc (32)' + If this flag is set, a (runtime) default is available. This + and the 'default' flag are mutually exclusive. + + 'no arg desc (64)' + If this flag is set, and the 'optional arg' flag is set, then + the option has a special meaning if no argument is given. + + 'no change (128)' + If this flag is set, 'gpgconf' ignores requests to change the + value. GUI frontends should grey out this option. Note, that + manual changes of the configuration files are still possible. + +LEVEL + This field is defined for options and for groups. It contains an + _unsigned number_ that specifies the expert level under which this + group or option should be displayed. The following expert levels + are defined for options (they have analogous meaning for groups): + + 'basic (0)' + This option should always be offered to the user. + + 'advanced (1)' + This option may be offered to advanced users. + + 'expert (2)' + This option should only be offered to expert users. + + 'invisible (3)' + This option should normally never be displayed, not even to + expert users. + + 'internal (4)' + This option is for internal use only. Ignore it. + + The level of a group will always be the lowest level of all options + it contains. + +DESCRIPTION + This field is defined for options and groups. The _string_ in this + field contains a human-readable description of the option or group. + It can be displayed to the user of the GUI for informational + purposes. It is _percent-escaped_ and _localized_. + +TYPE + This field is only defined for options. It contains an _unsigned + number_ that specifies the type of the option's argument, if any. + The following types are defined: + + Basic types: + + 'none (0)' + No argument allowed. + + 'string (1)' + An _unformatted string_. + + 'int32 (2)' + A _signed number_. + + 'uint32 (3)' + An _unsigned number_. + + Complex types: + + 'pathname (32)' + A _string_ that describes the pathname of a file. The file + does not necessarily need to exist. + + 'ldap server (33)' + A _string_ that describes an LDAP server in the format: + + 'HOSTNAME:PORT:USERNAME:PASSWORD:BASE_DN' + + 'key fingerprint (34)' + A _string_ with a 40 digit fingerprint specifying a + certificate. + + 'pub key (35)' + A _string_ that describes a certificate by user ID, key ID or + fingerprint. + + 'sec key (36)' + A _string_ that describes a certificate with a key by user ID, + key ID or fingerprint. + + 'alias list (37)' + A _string_ that describes an alias list, like the one used + with gpg's group option. The list consists of a key, an equal + sign and space separated values. + + More types will be added in the future. Please see the ALT-TYPE + field for information on how to cope with unknown types. + +ALT-TYPE + This field is identical to TYPE, except that only the types '0' to + '31' are allowed. The GUI is expected to present the user the + option in the format specified by TYPE. But if the argument type + TYPE is not supported by the GUI, it can still display the option + in the more generic basic type ALT-TYPE. The GUI must support all + the defined basic types to be able to display all options. More + basic types may be added in future versions. If the GUI encounters + a basic type it doesn't support, it should report an error and + abort the operation. + +ARGNAME + This field is only defined for options with an argument type TYPE + that is not '0'. In this case it may contain a _percent-escaped_ + and _localized string_ that gives a short name for the argument. + The field may also be empty, though, in which case a short name is + not known. + +DEFAULT + This field is defined only for options for which the 'default' or + 'default desc' flag is set. If the 'default' flag is set, its + format is that of an _option argument_ (*note Format conventions::, + for details). If the default value is empty, then no default is + known. Otherwise, the value specifies the default value for this + option. If the 'default desc' flag is set, the field is either + empty or contains a description of the effect if the option is not + given. + +ARGDEF + This field is defined only for options for which the 'optional arg' + flag is set. If the 'no arg desc' flag is not set, its format is + that of an _option argument_ (*note Format conventions::, for + details). If the default value is empty, then no default is known. + Otherwise, the value specifies the default argument for this + option. If the 'no arg desc' flag is set, the field is either + empty or contains a description of the effect of this option if no + argument is given. + +VALUE + This field is defined only for options. Its format is that of an + _option argument_. If it is empty, then the option is not + explicitly set in the current configuration, and the default + applies (if any). Otherwise, it contains the current value of the + option. Note that this field is also meaningful if the option + itself does not take a real argument (in this case, it contains the + number of times the option appears). + + +File: gnupg.info, Node: Changing options, Next: Listing global options, Prev: Listing options, Up: gpgconf + +9.4.6 Changing options +---------------------- + +The command '--change-options COMPONENT' will attempt to change the +options of the component COMPONENT to the specified values. COMPONENT +must be the string in the field NAME in the output of the +'--list-components' command. You have to provide the options that shall +be changed in the following format on standard input: + + 'NAME:FLAGS:NEW-VALUE' + +NAME + This is the name of the option to change. NAME must be the string + in the field NAME in the output of the '--list-options' command. + +FLAGS + The flags field contains an _unsigned number_. Its value is the + OR-wise combination of the following flag values: + + 'default (16)' + If this flag is set, the option is deleted and the default + value is used instead (if applicable). + +NEW-VALUE + The new value for the option. This field is only defined if the + 'default' flag is not set. The format is that of an _option + argument_. If it is empty (or the field is omitted), the default + argument is used (only allowed if the argument is optional for this + option). Otherwise, the option will be set to the specified value. + +The output of the command is the same as that of '--check-options' for +the modified configuration file. + + Examples: + + To set the force option, which is of basic type 'none (0)': + + $ echo 'force:0:1' | gpgconf --change-options dirmngr + + To delete the force option: + + $ echo 'force:16:' | gpgconf --change-options dirmngr + + The '--runtime' option can influence when the changes take effect. + + +File: gnupg.info, Node: Listing global options, Next: Querying versions, Prev: Changing options, Up: gpgconf + +9.4.7 Listing global options +---------------------------- + +Some legacy applications look at the global configuration file for the +gpgconf tool itself; this is the file 'gpgconf.conf'. Modern +applications should not use it but use per component global +configuration files which are more flexible than the 'gpgconf.conf'. +Using both files is not suggested. + + The colon separated listing format is record oriented and uses the +first field to identify the record type: + +'k' + This describes a key record to start the definition of a new + ruleset for a user/group. The format of a key record is: + + 'k:USER:GROUP:' + + USER + This is the user field of the key. It is percent escaped. + See the definition of the gpgconf.conf format for details. + + GROUP + This is the group field of the key. It is percent escaped. + +'r' + This describes a rule record. All rule records up to the next key + record make up a rule set for that key. The format of a rule + record is: + + 'r:::COMPONENT:OPTION:FLAG:VALUE:' + + COMPONENT + This is the component part of a rule. It is a plain string. + + OPTION + This is the option part of a rule. It is a plain string. + + FLAG + This is the flags part of a rule. There may be only one flag + per rule but by using the same component and option, several + flags may be assigned to an option. It is a plain string. + + VALUE + This is the optional value for the option. It is a percent + escaped string with a single quotation mark to indicate a + string. The quotation mark is only required to distinguish + between no value specified and an empty string. + +Unknown record types should be ignored. Note that there is +intentionally no feature to change the global option file through +'gpgconf'. + + +File: gnupg.info, Node: Querying versions, Next: Files used by gpgconf, Prev: Listing global options, Up: gpgconf + +9.4.8 Get and compare software versions. +---------------------------------------- + +The GnuPG Project operates a server to query the current versions of +software packages related to GnuPG. 'gpgconf' can be used to access this +online database. To allow for offline operations, this feature works by +having 'dirmngr' download a file from 'https://versions.gnupg.org', +checking the signature of that file and storing the file in the GnuPG +home directory. If 'gpgconf' is used and 'dirmngr' is running, it may +ask 'dirmngr' to refresh that file before itself uses the file. + + The command '--query-swdb' returns information for the given package +in a colon delimited format: + +NAME + This is the name of the package as requested. Note that "gnupg" is + a special name which is replaced by the actual package implementing + this version of GnuPG. For this name it is also not required to + specify a version because 'gpgconf' takes its own version in this + case. + +IVERSION + The currently installed version or an empty string. The value is + taken from the command line argument but may be provided by gpg if + not given. + +STATUS + The status of the software package according to this table: + '-' + No information available. This is either because no current + version has been specified or due to an error. + '?' + The given name is not known in the online database. + 'u' + An update of the software is available. + 'c' + The installed version of the software is current. + 'n' + The installed version is already newer than the released + version. + +URGENCY + If the value (the empty string should be considered as zero) is + greater than zero an important update is available. + +ERROR + This returns an 'gpg-error' error code to distinguish between + various failure modes. + +FILEDATE + This gives the date of the file with the version numbers in + standard ISO format ('yyyymmddThhmmss'). The date has been + extracted by 'dirmngr' from the signature of the file. + +VERIFIED + This gives the date in ISO format the file was downloaded. This + value can be used to evaluate the freshness of the information. + +VERSION + This returns the version string for the requested software from the + file. + +RELDATE + This returns the release date in ISO format. + +SIZE + This returns the size of the package as decimal number of bytes. + +HASH + This returns a hexified SHA-2 hash of the package. + +More fields may be added in future to the output. + + +File: gnupg.info, Node: Files used by gpgconf, Prev: Querying versions, Up: gpgconf + +9.4.9 Files used by gpgconf +--------------------------- + +'/etc/gnupg/gpgconf.conf' + If this file exists, it is processed as a global configuration + file. This is a legacy mechanism which should not be used tigether + with the modern global per component configuration files. A + commented example can be found in the 'examples' directory of the + distribution. + +'GNUPGHOME/swdb.lst' + A file with current software versions. 'dirmngr' creates this file + on demand from an online resource. + + +File: gnupg.info, Node: applygnupgdefaults, Next: gpg-preset-passphrase, Prev: gpgconf, Up: Helper Tools + +9.5 Run gpgconf for all users +============================= + +This is a legacy script. Modern application should use the per +component global configuration files under '/etc/gnupg/'. + + This script is a wrapper around 'gpgconf' to run it with the command +'--apply-defaults' for all real users with an existing GnuPG home +directory. Admins might want to use this script to update he GnuPG +configuration files for all users after '/etc/gnupg/gpgconf.conf' has +been changed. This allows enforcing certain policies for all users. +Note, that this is not a bulletproof way to force a user to use certain +options. A user may always directly edit the configuration files and +bypass gpgconf. + +'applygnupgdefaults' is invoked by root as: + + applygnupgdefaults + + +File: gnupg.info, Node: gpg-preset-passphrase, Next: gpg-connect-agent, Prev: applygnupgdefaults, Up: Helper Tools + +9.6 Put a passphrase into the cache +=================================== + +The 'gpg-preset-passphrase' is a utility to seed the internal cache of a +running 'gpg-agent' with passphrases. It is mainly useful for +unattended machines, where the usual 'pinentry' tool may not be used and +the passphrases for the to be used keys are given at machine startup. + + This program works with GnuPG 2 and later. GnuPG 1.x is not +supported. + + Passphrases set with this utility don't expire unless the '--forget' +option is used to explicitly clear them from the cache -- or 'gpg-agent' +is either restarted or reloaded (by sending a SIGHUP to it). Note that +the maximum cache time as set with '--max-cache-ttl' is still honored. +It is necessary to allow this passphrase presetting by starting +'gpg-agent' with the '--allow-preset-passphrase'. + +* Menu: + +* Invoking gpg-preset-passphrase:: List of all commands and options. + + +File: gnupg.info, Node: Invoking gpg-preset-passphrase, Up: gpg-preset-passphrase + +9.6.1 List of all commands and options +-------------------------------------- + +'gpg-preset-passphrase' is invoked this way: + + gpg-preset-passphrase [options] [command] CACHEID + + CACHEID is either a 40 character keygrip of hexadecimal characters +identifying the key for which the passphrase should be set or cleared. +The keygrip is listed along with the key when running the command: +'gpgsm --with-keygrip --list-secret-keys'. Alternatively an arbitrary +string may be used to identify a passphrase; it is suggested that such a +string is prefixed with the name of the application (e.g 'foo:12346'). +Scripts should always use the option '--with-colons', which provides the +keygrip in a "grp" line (cf. 'doc/DETAILS')/ + +One of the following command options must be given: + +'--preset' + Preset a passphrase. This is what you usually will use. + 'gpg-preset-passphrase' will then read the passphrase from 'stdin'. + +'--forget' + Flush the passphrase for the given cache ID from the cache. + +The following additional options may be used: + +'-v' +'--verbose' + Output additional information while running. + +'-P STRING' +'--passphrase STRING' + Instead of reading the passphrase from 'stdin', use the supplied + STRING as passphrase. Note that this makes the passphrase visible + for other users. + + +File: gnupg.info, Node: gpg-connect-agent, Next: dirmngr-client, Prev: gpg-preset-passphrase, Up: Helper Tools + +9.7 Communicate with a running agent +==================================== + +The 'gpg-connect-agent' is a utility to communicate with a running +'gpg-agent'. It is useful to check out the commands 'gpg-agent' +provides using the Assuan interface. It might also be useful for +scripting simple applications. Input is expected at stdin and output +gets printed to stdout. + + It is very similar to running 'gpg-agent' in server mode; but here we +connect to a running instance. + +* Menu: + +* Invoking gpg-connect-agent:: List of all options. +* Controlling gpg-connect-agent:: Control commands. + + +File: gnupg.info, Node: Invoking gpg-connect-agent, Next: Controlling gpg-connect-agent, Up: gpg-connect-agent + +9.7.1 List of all options +------------------------- + +'gpg-connect-agent' is invoked this way: + + gpg-connect-agent [options] [commands] + +The following options may be used: + +'-v' +'--verbose' + Output additional information while running. + +'-q' +'--quiet' + Try to be as quiet as possible. + +'--homedir DIR' + Set the name of the home directory to DIR. If this option is not + used, the home directory defaults to '~/.gnupg'. It is only + recognized when given on the command line. It also overrides any + home directory stated through the environment variable 'GNUPGHOME' + or (on Windows systems) by means of the Registry entry + HKCU\SOFTWARE\GNU\GNUPG:HOMEDIR. + + On Windows systems it is possible to install GnuPG as a portable + application. In this case only this command line option is + considered, all other ways to set a home directory are ignored. + + To install GnuPG as a portable application under Windows, create an + empty file named 'gpgconf.ctl' in the same directory as the tool + 'gpgconf.exe'. The root of the installation is then that + directory; or, if 'gpgconf.exe' has been installed directly below a + directory named 'bin', its parent directory. You also need to make + sure that the following directories exist and are writable: + 'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg' + for internal cache files. + +'--agent-program FILE' + Specify the agent program to be started if none is running. The + default value is determined by running 'gpgconf' with the option + '--list-dirs'. Note that the pipe symbol ('|') is used for a + regression test suite hack and may thus not be used in the file + name. + +'--dirmngr-program FILE' + Specify the directory manager (keyserver client) program to be + started if none is running. This has only an effect if used + together with the option '--dirmngr'. + +'--dirmngr' + Connect to a running directory manager (keyserver client) instead + of to the gpg-agent. If a dirmngr is not running, start it. + +'-S' +'--raw-socket NAME' + Connect to socket NAME assuming this is an Assuan style server. Do + not run any special initializations or environment checks. This + may be used to directly connect to any Assuan style socket server. + +'-E' +'--exec' + Take the rest of the command line as a program and it's arguments + and execute it as an Assuan server. Here is how you would run + 'gpgsm': + gpg-connect-agent --exec gpgsm --server + Note that you may not use options on the command line in this case. + +'--no-ext-connect' + When using '-S' or '--exec', 'gpg-connect-agent' connects to the + Assuan server in extended mode to allow descriptor passing. This + option makes it use the old mode. + +'--no-autostart' + Do not start the gpg-agent or the dirmngr if it has not yet been + started. + +'-r FILE' +'--run FILE' + Run the commands from FILE at startup and then continue with the + regular input method. Note, that commands given on the command + line are executed after this file. + +'-s' +'--subst' + Run the command '/subst' at startup. + +'--hex' + Print data lines in a hex format and the ASCII representation of + non-control characters. + +'--decode' + Decode data lines. That is to remove percent escapes but make sure + that a new line always starts with a D and a space. + + +File: gnupg.info, Node: Controlling gpg-connect-agent, Prev: Invoking gpg-connect-agent, Up: gpg-connect-agent + +9.7.2 Control commands +---------------------- + +While reading Assuan commands, gpg-agent also allows a few special +commands to control its operation. These control commands all start +with a slash ('/'). + +'/echo ARGS' + Just print ARGS. + +'/let NAME VALUE' + Set the variable NAME to VALUE. Variables are only substituted on + the input if the '/subst' has been used. Variables are referenced + by prefixing the name with a dollar sign and optionally include the + name in curly braces. The rules for a valid name are identically + to those of the standard bourne shell. This is not yet enforced + but may be in the future. When used with curly braces no leading + or trailing white space is allowed. + + If a variable is not found, it is searched in the environment and + if found copied to the table of variables. + + Variable functions are available: The name of the function must be + followed by at least one space and the at least one argument. The + following functions are available: + + 'get' + Return a value described by the argument. Available arguments + are: + + 'cwd' + The current working directory. + 'homedir' + The gnupg homedir. + 'sysconfdir' + GnuPG's system configuration directory. + 'bindir' + GnuPG's binary directory. + 'libdir' + GnuPG's library directory. + 'libexecdir' + GnuPG's library directory for executable files. + 'datadir' + GnuPG's data directory. + 'serverpid' + The PID of the current server. Command '/serverpid' must + have been given to return a useful value. + + 'unescape ARGS' + Remove C-style escapes from ARGS. Note that '\0' and '\x00' + terminate the returned string implicitly. The string to be + converted are the entire arguments right behind the delimiting + space of the function name. + + 'unpercent ARGS' + 'unpercent+ ARGS' + Remove percent style escaping from ARGS. Note that '%00' + terminates the string implicitly. The string to be converted + are the entire arguments right behind the delimiting space of + the function name. 'unpercent+' also maps plus signs to a + spaces. + + 'percent ARGS' + 'percent+ ARGS' + Escape the ARGS using percent style escaping. Tabs, + formfeeds, linefeeds, carriage returns and colons are escaped. + 'percent+' also maps spaces to plus signs. + + 'errcode ARG' + 'errsource ARG' + 'errstring ARG' + Assume ARG is an integer and evaluate it using 'strtol'. + Return the gpg-error error code, error source or a formatted + string with the error code and error source. + + '+' + '-' + '*' + '/' + '%' + Evaluate all arguments as long integers using 'strtol' and + apply this operator. A division by zero yields an empty + string. + + '!' + '|' + '&' + Evaluate all arguments as long integers using 'strtol' and + apply the logical operators NOT, OR or AND. The NOT operator + works on the last argument only. + +'/definq NAME VAR' + Use content of the variable VAR for inquiries with NAME. NAME may + be an asterisk ('*') to match any inquiry. + +'/definqfile NAME FILE' + Use content of FILE for inquiries with NAME. NAME may be an + asterisk ('*') to match any inquiry. + +'/definqprog NAME PROG' + Run PROG for inquiries matching NAME and pass the entire line to it + as command line arguments. + +'/datafile NAME' + Write all data lines from the server to the file NAME. The file is + opened for writing and created if it does not exists. An existing + file is first truncated to 0. The data written to the file fully + decoded. Using a single dash for NAME writes to stdout. The file + is kept open until a new file is set using this command or this + command is used without an argument. + +'/showdef' + Print all definitions + +'/cleardef' + Delete all definitions + +'/sendfd FILE MODE' + Open FILE in MODE (which needs to be a valid 'fopen' mode string) + and send the file descriptor to the server. This is usually + followed by a command like 'INPUT FD' to set the input source for + other commands. + +'/recvfd' + Not yet implemented. + +'/open VAR FILE [MODE]' + Open FILE and assign the file descriptor to VAR. Warning: This + command is experimental and might change in future versions. + +'/close FD' + Close the file descriptor FD. Warning: This command is + experimental and might change in future versions. + +'/showopen' + Show a list of open files. + +'/serverpid' + Send the Assuan command 'GETINFO pid' to the server and store the + returned PID for internal purposes. + +'/sleep' + Sleep for a second. + +'/hex' +'/nohex' + Same as the command line option '--hex'. + +'/decode' +'/nodecode' + Same as the command line option '--decode'. + +'/subst' +'/nosubst' + Enable and disable variable substitution. It defaults to disabled + unless the command line option '--subst' has been used. If /subst + as been enabled once, leading whitespace is removed from input + lines which makes scripts easier to read. + +'/while CONDITION' +'/end' + These commands provide a way for executing loops. All lines + between the 'while' and the corresponding 'end' are executed as + long as the evaluation of CONDITION yields a non-zero value or is + the string 'true' or 'yes'. The evaluation is done by passing + CONDITION to the 'strtol' function. Example: + + /subst + /let i 3 + /while $i + /echo loop counter is $i + /let i ${- $i 1} + /end + +'/if CONDITION' +'/end' + These commands provide a way for conditional execution. All lines + between the 'if' and the corresponding 'end' are executed only if + the evaluation of CONDITION yields a non-zero value or is the + string 'true' or 'yes'. The evaluation is done by passing + CONDITION to the 'strtol' function. + +'/run FILE' + Run commands from FILE. + +'/bye' + Terminate the connection and the program. + +'/help' + Print a list of available control commands. + + +File: gnupg.info, Node: dirmngr-client, Next: gpgparsemail, Prev: gpg-connect-agent, Up: Helper Tools + +9.8 The Dirmngr Client Tool +=========================== + +The 'dirmngr-client' is a simple tool to contact a running dirmngr and +test whether a certificate has been revoked -- either by being listed in +the corresponding CRL or by running the OCSP protocol. If no dirmngr is +running, a new instances will be started but this is in general not a +good idea due to the huge performance overhead. + +The usual way to run this tool is either: + + dirmngr-client ACERT + +or + + dirmngr-client <ACERT + + Where ACERT is one DER encoded (binary) X.509 certificates to be +tested. The return value of this command is + +'0' + The certificate under question is valid; i.e. there is a valid CRL + available and it is not listed there or the OCSP request returned + that that certificate is valid. + +'1' + The certificate has been revoked + +'2 (and other values)' + There was a problem checking the revocation state of the + certificate. A message to stderr has given more detailed + information. Most likely this is due to a missing or expired CRL + or due to a network problem. + +'dirmngr-client' may be called with the following options: + +'--version' + Print the program version and licensing information. Note that you + cannot abbreviate this command. + +'--help, -h' + Print a usage message summarizing the most useful command-line + options. Note that you cannot abbreviate this command. + +'--quiet, -q' + Make the output extra brief by suppressing any informational + messages. + +'-v' +'--verbose' + Outputs additional information while running. You can increase the + verbosity by giving several verbose commands to DIRMNGR, such as + '-vv'. + +'--pem' + Assume that the given certificate is in PEM (armored) format. + +'--ocsp' + Do the check using the OCSP protocol and ignore any CRLs. + +'--force-default-responder' + When checking using the OCSP protocol, force the use of the default + OCSP responder. That is not to use the Reponder as given by the + certificate. + +'--ping' + Check whether the dirmngr daemon is up and running. + +'--cache-cert' + Put the given certificate into the cache of a running dirmngr. + This is mainly useful for debugging. + +'--validate' + Validate the given certificate using dirmngr's internal validation + code. This is mainly useful for debugging. + +'--load-crl' + This command expects a list of filenames with DER encoded CRL + files. With the option '--url' URLs are expected in place of + filenames and they are loaded directly from the given location. + All CRLs will be validated and then loaded into dirmngr's cache. + +'--lookup' + Take the remaining arguments and run a lookup command on each of + them. The results are Base-64 encoded outputs (without header + lines). This may be used to retrieve certificates from a server. + However the output format is not very well suited if more than one + certificate is returned. + +'--url' +'-u' + Modify the 'lookup' and 'load-crl' commands to take an URL. + +'--local' +'-l' + Let the 'lookup' command only search the local cache. + +'--squid-mode' + Run DIRMNGR-CLIENT in a mode suitable as a helper program for + Squid's 'external_acl_type' option. + + +File: gnupg.info, Node: gpgparsemail, Next: gpgtar, Prev: dirmngr-client, Up: Helper Tools + +9.9 Parse a mail message into an annotated format +================================================= + +The 'gpgparsemail' is a utility currently only useful for debugging. +Run it with '--help' for usage information. + + +File: gnupg.info, Node: gpgtar, Next: gpg-check-pattern, Prev: gpgparsemail, Up: Helper Tools + +9.10 Encrypt or sign files into an archive +========================================== + +'gpgtar' encrypts or signs files into an archive. It is an gpg-ized tar +using the same format as used by PGP's PGP Zip. + +'gpgtar' is invoked this way: + + gpgtar [options] FILENAME1 [FILENAME2, ...] DIRECTORY [DIRECTORY2, ...] + +'gpgtar' understands these options: + +'--create' + Put given files and directories into a vanilla "ustar" archive. + +'--extract' + Extract all files from a vanilla "ustar" archive. + +'--encrypt' +'-e' + Encrypt given files and directories into an archive. This option + may be combined with option '--symmetric' for an archive that may + be decrypted via a secret key or a passphrase. + +'--decrypt' +'-d' + Extract all files from an encrypted archive. + +'--sign' +'-s' + Make a signed archive from the given files and directories. This + can be combined with option '--encrypt' to create a signed and then + encrypted archive. + +'--list-archive' +'-t' + List the contents of the specified archive. + +'--symmetric' +'-c' + Encrypt with a symmetric cipher using a passphrase. The default + symmetric cipher used is AES-128, but may be chosen with the + '--cipher-algo' option to 'gpg'. + +'--recipient USER' +'-r USER' + Encrypt for user id USER. For details see 'gpg'. + +'--local-user USER' +'-u USER' + Use USER as the key to sign with. For details see 'gpg'. + +'--output FILE' +'-o FILE' + Write the archive to the specified file FILE. + +'--verbose' +'-v' + Enable extra informational output. + +'--quiet' +'-q' + Try to be as quiet as possible. + +'--skip-crypto' + Skip all crypto operations and create or extract vanilla "ustar" + archives. + +'--dry-run' + Do not actually output the extracted files. + +'--directory DIR' +'-C DIR' + Extract the files into the directory DIR. The default is to take + the directory name from the input filename. If no input filename + is known a directory named 'GPGARCH' is used. For tarball + creation, switch to directory DIR before performing any operations. + +'--files-from FILE' +'-T FILE' + Take the file names to work from the file FILE; one file per line. + +'--null' + Modify option '--files-from' to use a binary nul instead of a + linefeed to separate file names. + +'--utf8-strings' + Assume that the file names read by '--files-from' are UTF-8 + encoded. This option has an effect only on Windows where the + active code page is otherwise assumed. + +'--openpgp' + This option has no effect because OpenPGP encryption and signing is + the default. + +'--cms' + This option is reserved and shall not be used. It will eventually + be used to encrypt or sign using the CMS protocol; but that is not + yet implemented. + +'--batch' + Use batch mode. Never ask but use the default action. This option + is passed directly to 'gpg'. + +'--yes' + Assume "yes" on most questions. Often used together with '--batch' + to overwrite existing files. This option is passed directly to + 'gpg'. + +'--no' + Assume "no" on most questions. This option is passed directly to + 'gpg'. + +'--require-compliance' + This option is passed directly to 'gpg'. + +'--status-fd N' + Write special status strings to the file descriptor N. See the + file DETAILS in the documentation for a listing of them. + +'--with-log' + When extracting an encrypted tarball also write a log file with the + gpg output to a file named after the extraction directory with the + suffix ".log". + +'--set-filename FILE' + Use the last component of FILE as the output directory. The + default is to take the directory name from the input filename. If + no input filename is known a directory named 'GPGARCH' is used. + This option is deprecated in favor of option '--directory'. + +'--gpg GPGCMD' + Use the specified command GPGCMD instead of 'gpg'. + +'--gpg-args ARGS' + Pass the specified extra options to 'gpg'. + +'--tar-args ARGS' + Assume ARGS are standard options of the command 'tar' and parse + them. The only supported tar options are "-directory", + "-files-from", and "-null" This is an obsolete options because + those supported tar options can also be given directly. + +'--version' + Print version of the program and exit. + +'--help' + Display a brief help page and exit. + +The program returns 0 if everything was fine, 1 otherwise. + +Some examples: + +Encrypt the contents of directory 'mydocs' for user Bob to file 'test1': + + gpgtar --encrypt --output test1 -r Bob mydocs + +List the contents of archive 'test1': + + gpgtar --list-archive test1 + + +File: gnupg.info, Node: gpg-check-pattern, Prev: gpgtar, Up: Helper Tools + +9.11 Check a passphrase on stdin against the patternfile +======================================================== + +'gpg-check-pattern' checks a passphrase given on stdin against a +specified pattern file. + + The pattern file is line based with comment lines beginning on the +_first_ position with a '#'. Empty lines and lines with only white +spaces are ignored. The actual pattern lines may either be verbatim +string pattern and match as they are (trailing spaces are ignored) or +extended regular expressions indicated by a '/' or '!/' in the first +column and terminated by another '/' or end of line. If a regular +expression starts with '!/' the match result is reversed. By default +all comparisons are case insensitive. + + Tag lines may be used to further control the operation of this tool. +The currently defined tags are: + +'[icase]' + Switch to case insensitive comparison for all further patterns. + This is the default. + +'[case]' + Switch to case sensitive comparison for all further patterns. + +'[reject]' + Switch to reject mode. This is the default mode. + +'[accept]' + Switch to accept mode. + + In the future more tags may be introduced and thus it is advisable +not to start a plain pattern string with an open bracket. The tags must +be given verbatim on the line with no spaces to the left or any non +white space characters to the right. + + In reject mode the program exits on the first match with an exit code +of 1 (failure). If at the end of the pattern list the reject mode is +still active the program exits with code 0 (success). + + In accept mode blocks of patterns are used. A block starts at the +next pattern after an "accept" tag and ends with the last pattern before +the next "accept" or "reject" tag or at the end of the pattern list. If +all patterns in a block match the program exits with an exit code of 0 +(success). If any pattern in a block do not match the next pattern +block is evaluated. If at the end of the pattern list the accept mode +is still active the program exits with code 1 (failure). + + +'--verbose' + Enable extra informational output. + +'--check' + Run only a syntax check on the patternfile. + +'--null' + Input is expected to be null delimited. + + +File: gnupg.info, Node: Web Key Service, Next: Howtos, Prev: Helper Tools, Up: Top + +10 Web Key Service +****************** + +GnuPG comes with tools used to maintain and access a Web Key Directory. + +* Menu: + +* gpg-wks-client:: Send requests via WKS +* gpg-wks-server:: Server to provide the WKS. + + +File: gnupg.info, Node: gpg-wks-client, Next: gpg-wks-server, Up: Web Key Service + +10.1 Send requests via WKS +========================== + +The 'gpg-wks-client' is used to send requests to a Web Key Service +provider. This is usually done to upload a key into a Web Key +Directory. + + With the '--supported' command the caller can test whether a site +supports the Web Key Service. The argument is an arbitrary address in +the to be tested domain. For example 'foo@example.net'. The command +returns success if the Web Key Service is supported. The operation is +silent; to get diagnostic output use the option '--verbose'. See option +'--with-colons' for a variant of this command. + + With the '--check' command the caller can test whether a key exists +for a supplied mail address. The command returns success if a key is +available. + + The '--create' command is used to send a request for publication in +the Web Key Directory. The arguments are the fingerprint of the key and +the user id to publish. The output from the command is a properly +formatted mail with all standard headers. This mail can be fed to +'sendmail(8)' or any other tool to actually send that mail. If +'sendmail(8)' is installed the option '--send' can be used to directly +send the created request. If the provider request a 'mailbox-only' user +id and no such user id is found, 'gpg-wks-client' will try an additional +user id. + + The '--receive' and '--read' commands are used to process +confirmation mails as send from the service provider. The former +expects an encrypted MIME messages, the latter an already decrypted MIME +message. The result of these commands are another mail which can be +send in the same way as the mail created with '--create'. + + The command '--install-key' manually installs a key into a local +directory (see option '-C') reflecting the structure of a WKD. The +arguments are a file with the keyblock and the user-id to install. If +the first argument resembles a fingerprint the key is taken from the +current keyring; to force the use of a file, prefix the first argument +with "./". If no arguments are given the parameters are read from +stdin; the expected format are lines with the fingerprint and the +mailbox separated by a space. The command '--remove-key' removes a key +from that directory, its only argument is a user-id. + + The command '--mirror' is similar to '--install-key' but takes the +keys from the the LDAP server configured for Dirmngr. If no arguments +are given all keys and user ids are installed. If arguments are given +they are taken as domain names to limit the to be installed keys. The +option '--blacklist' may be used to further limit the to be installed +keys. + + The command '--print-wkd-hash' prints the WKD user-id identifiers and +the corresponding mailboxes from the user-ids given on the command line +or via stdin (one user-id per line). + + The command '--print-wkd-url' prints the URLs used to fetch the key +for the given user-ids from WKD. The meanwhile preferred format with +sub-domains is used here. + + 'gpg-wks-client' is not commonly invoked directly and thus it is not +installed in the bin directory. Here is an example how it can be +invoked manually to check for a Web Key Directory entry for +'foo@example.org': + + $(gpgconf --list-dirs libexecdir)/gpg-wks-client --check foo@example.net + +'gpg-wks-client' understands these options: + +'--send' + Directly send created mails using the 'sendmail' command. Requires + installation of that command. + +'--with-colons' + This option has currently only an effect on the '--supported' + command. If it is used all arguments on the command line are taken + as domain names and tested for WKD support. The output format is + one line per domain with colon delimited fields. The currently + specified fields are (future versions may specify additional + fields): + + 1 - domain + This is the domain name. Although quoting is not required for + valid domain names this field is specified to be quoted in + standard C manner. + + 2 - WKD + If the value is true the domain supports the Web Key + Directory. + + 3 - WKS + If the value is true the domain supports the Web Key Service + protocol to upload keys to the directory. + + 4 - error-code + This may contain an gpg-error code to describe certain + failures. Use 'gpg-error CODE' to explain the code. + + 5 - protocol-version + The minimum protocol version supported by the server. + + 6 - auth-submit + The auth-submit flag from the policy file of the server. + + 7 - mailbox-only + The mailbox-only flag from the policy file of the server. + +'--output FILE' +'-o' + Write the created mail to FILE instead of stdout. Note that the + value '-' for FILE is the same as writing to stdout. + +'--status-fd N' + Write special status strings to the file descriptor N. This + program returns only the status messages SUCCESS or FAILURE which + are helpful when the caller uses a double fork approach and can't + easily get the return code of the process. + +'-C DIR' +'--directory DIR' + Use DIR as top level directory for the commands '--mirror', + '--install-key' and '--remove-key'. The default is 'openpgpkey'. + +'--blacklist FILE' + This option is used to exclude certain mail addresses from a mirror + operation. The format of FILE is one mail address (just the + addrspec, e.g. "postel@isi.edu") per line. Empty lines and lines + starting with a '#' are ignored. + +'--verbose' + Enable extra informational output. + +'--quiet' + Disable almost all informational output. + +'--version' + Print version of the program and exit. + +'--help' + Display a brief help page and exit. + + +File: gnupg.info, Node: gpg-wks-server, Prev: gpg-wks-client, Up: Web Key Service + +10.2 Provide the Web Key Service +================================ + +The 'gpg-wks-server' is a server site implementation of the Web Key +Service. It receives requests for publication, sends confirmation +requests, receives confirmations, and published the key. It also has +features to ease the setup and maintenance of a Web Key Directory. + + When used with the command '--receive' a single Web Key Service mail +is processed. Commonly this command is used with the option '--send' to +directly send the crerated mails back. See below for an installation +example. + + The command '--cron' is used for regualr cleanup tasks. For example +non-confirmed requested should be removed after their expire time. It +is best to run this command once a day from a cronjob. + + The command '--list-domains' prints all configured domains. Further +it creates missing directories for the configuration and prints warnings +pertaining to problems in the configuration. + + The command '--check-key' (or just '--check') checks whether a key +with the given user-id is installed. The process returns success in +this case; to also print a diagnostic use the option '-v'. If the key +is not installed a diagnostic is printed and the process returns +failure; to suppress the diagnostic, use option '-q'. More than one +user-id can be given; see also option 'with-file'. + + The command '--install-key' manually installs a key into the WKD. The +arguments are a file with the keyblock and the user-id to install. If +the first argument resembles a fingerprint the key is taken from the +current keyring; to force the use of a file, prefix the first argument +with "./". If no arguments are given the parameters are read from +stdin; the expected format are lines with the fingerprint and the +mailbox separated by a space. + + The command '--remove-key' uninstalls a key from the WKD. The process +returns success in this case; to also print a diagnostic, use option +'-v'. If the key is not installed a diagnostic is printed and the +process returns failure; to suppress the diagnostic, use option '-q'. + + The command '--revoke-key' is not yet functional. + +'gpg-wks-server' understands these options: + +'-C DIR' +'--directory DIR' + Use DIR as top level directory for domains. The default is + '/var/lib/gnupg/wks'. + +'--from MAILADDR' + Use MAILADDR as the default sender address. + +'--header NAME=VALUE' + Add the mail header "NAME: VALUE" to all outgoing mails. + +'--send' + Directly send created mails using the 'sendmail' command. Requires + installation of that command. + +'-o FILE' +'--output FILE' + Write the created mail also to FILE. Note that the value '-' for + FILE would write it to stdout. + +'--with-dir' + When used with the command '--list-domains' print for each + installed domain the domain name and its directory name. + +'--with-file' + When used with the command '--check-key' print for each user-id, + the address, 'i' for installed key or 'n' for not installed key, + and the filename. + +'--verbose' + Enable extra informational output. + +'--quiet' + Disable almost all informational output. + +'--version' + Print version of the program and exit. + +'--help' + Display a brief help page and exit. + + +Examples +******** + +The Web Key Service requires a working directory to store keys pending +for publication. As root create a working directory: + + # mkdir /var/lib/gnupg/wks + # chown webkey:webkey /var/lib/gnupg/wks + # chmod 2750 /var/lib/gnupg/wks + + Then under your webkey account create directories for all your +domains. Here we do it for "example.net": + + $ mkdir /var/lib/gnupg/wks/example.net + + Finally run + + $ gpg-wks-server --list-domains + + to create the required sub-directories with the permissions set +correctly. For each domain a submission address needs to be configured. +All service mails are directed to that address. It can be the same +address for all configured domains, for example: + + $ cd /var/lib/gnupg/wks/example.net + $ echo key-submission@example.net >submission-address + + The protocol requires that the key to be published is send with an +encrypted mail to the service. Thus you need to create a key for the +submission address: + + $ gpg --batch --passphrase '' --quick-gen-key key-submission@example.net + $ gpg -K key-submission@example.net + + The output of the last command looks similar to this: + + sec rsa2048 2016-08-30 [SC] + C0FCF8642D830C53246211400346653590B3795B + uid [ultimate] key-submission@example.net + ssb rsa2048 2016-08-30 [E] + + Take the fingerprint from that output and manually publish the key: + + $ gpg-wks-server --install-key C0FCF8642D830C53246211400346653590B3795B \ + > key-submission@example.net + + Finally that submission address needs to be redirected to a script +running 'gpg-wks-server'. The 'procmail' command can be used for this: +Redirect the submission address to the user "webkey" and put this into +webkey's '.procmailrc': + + :0 + * !^From: webkey@example.net + * !^X-WKS-Loop: webkey.example.net + |gpg-wks-server -v --receive \ + --header X-WKS-Loop=webkey.example.net \ + --from webkey@example.net --send + + +File: gnupg.info, Node: Howtos, Next: System Notes, Prev: Web Key Service, Up: Top + +11 How to do certain things +*************************** + +This is a collection of small howto documents. + +* Menu: + +* Howto Create a Server Cert:: Creating a TLS server certificate. + + +File: gnupg.info, Node: Howto Create a Server Cert, Up: Howtos + +11.1 Creating a TLS server certificate +====================================== + +Here is a brief run up on how to create a server certificate. It has +actually been done this way to get a certificate from CAcert to be used +on a real server. It has only been tested with this CA, but there +shouldn't be any problem to run this against any other CA. + + We start by generating an X.509 certificate signing request. As +there is no need for a configuration file, you may simply enter: + + $ gpgsm --generate-key >example.com.cert-req.pem + Please select what kind of key you want: + (1) RSA + (2) Existing key + (3) Existing key from card + Your selection? 1 + + I opted for creating a new RSA key. The other option is to use an +already existing key, by selecting '2' and entering the so-called +keygrip. Running the command 'gpgsm --dump-secret-key USERID' shows you +this keygrip. Using '3' offers another menu to create a certificate +directly from a smart card based key. + + Let's continue: + + What keysize do you want? (3072) + Requested keysize is 3072 bits + + Hitting enter chooses the default RSA key size of 3072 bits. Keys +smaller than 2048 bits are too weak on the modern Internet. If you +choose a larger (stronger) key, your server will need to do more work. + + Possible actions for a RSA key: + (1) sign, encrypt + (2) sign + (3) encrypt + Your selection? 1 + + Selecting "sign" enables use of the key for Diffie-Hellman key +exchange mechanisms (DHE and ECDHE) in TLS, which are preferred because +they offer forward secrecy. Selecting "encrypt" enables RSA key +exchange mechanisms, which are still common in some places. Selecting +both enables both key exchange mechanisms. + + Now for some real data: + + Enter the X.509 subject name: CN=example.com + + This is the most important value for a server certificate. Enter +here the canonical name of your server machine. You may add other +virtual server names later. + + E-Mail addresses (end with an empty line): + > + + We don't need email addresses in a TLS server certificate and CAcert +would anyway ignore such a request. Thus just hit enter. + + If you want to create a client certificate for email encryption, this +would be the place to enter your mail address (e.g. <joe@example.org>). +You may enter as many addresses as you like, however the CA may not +accept them all or reject the entire request. + + Enter DNS names (optional; end with an empty line): + > example.com + > www.example.com + > + + Here I entered the names of the services which the machine actually +provides. You almost always want to include the canonical name here +too. The browser will accept a certificate for any of these names. As +usual the CA must approve all of these names. + + URIs (optional; end with an empty line): + > + + It is possible to insert arbitrary URIs into a certificate; for a +server certificate this does not make sense. + + Create self-signed certificate? (y/N) + + Since we are creating a certificate signing request, and not a full +certificate, we answer no here, or just hit enter for the default. + + We have now entered all required information and 'gpgsm' will display +what it has gathered and ask whether to create the certificate request: + + These parameters are used: + Key-Type: RSA + Key-Length: 3072 + Key-Usage: sign, encrypt + Name-DN: CN=example.com + Name-DNS: example.com + Name-DNS: www.example.com + + Proceed with creation? (y/N) y + + 'gpgsm' will now start working on creating the request. As this +includes the creation of an RSA key it may take a while. During this +time you will be asked 3 times for a passphrase to protect the created +private key on your system. A pop up window will appear to ask for it. +The first two prompts are for the new passphrase and for re-entering it; +the third one is required to actually create the certificate signing +request. + + When it is ready, you should see the final notice: + + Ready. You should now send this request to your CA. + + Now, you may look at the created request: + + $ cat example.com.cert-req.pem + -----BEGIN CERTIFICATE REQUEST----- + MIIClTCCAX0CAQAwFjEUMBIGA1UEAxMLZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3 + DQEBAQUAA4IBDwAwggEKAoIBAQDP1QEcbTvOLLCX4gAoOzH9AW7jNOMj7OSOL0uW + h2bCdkK5YVpnX212Z6COTC3ZG0pJiCeGt1TbbDJUlTa4syQ6JXavjK66N8ASZsyC + Rwcl0m6hbXp541t1dbgt2VgeGk25okWw3j+brw6zxLD2TnthJxOatID0lDIG47HW + GqzZmA6WHbIBIONmGnReIHTpPAPCDm92vUkpKG1xLPszuRmsQbwEl870W/FHrsvm + DPvVUUSdIvTV9NuRt7/WY6G4nPp9QlIuTf1ESPzIuIE91gKPdrRCAx0yuT708S1n + xCv3ETQ/bKPoAQ67eE3mPBqkcVwv9SE/2/36Lz06kAizRgs5AgMBAAGgOjA4Bgkq + hkiG9w0BCQ4xKzApMCcGA1UdEQQgMB6CC2V4YW1wbGUuY29tgg93d3cuZXhhbXBs + ZS5jb20wDQYJKoZIhvcNAQELBQADggEBAEWD0Qqz4OENLYp6yyO/KqF0ig9FDsLN + b5/R+qhms5qlhdB5+Dh+j693Sj0UgbcNKc6JT86IuBqEBZmRCJuXRoKoo5aMS1cJ + hXga7N9IA3qb4VBUzBWvlL92U2Iptr/cEbikFlYZF2Zv3PBv8RfopVlI3OLbKV9D + bJJTt/6kuoydXKo/Vx4G0DFzIKNdFdJk86o/Ziz8NOs9JjZxw9H9VY5sHKFM5LKk + VcLwnnLRlNjBGB+9VK/Tze575eG0cJomTp7UGIB+1xzIQVAhUZOizRDv9tHDeaK3 + k+tUhV0kuJcYHucpJycDSrP/uAY5zuVJ0rs2QSjdnav62YrRgEsxJrU= + -----END CERTIFICATE REQUEST----- + $ + + You may now proceed by logging into your account at the CAcert +website, choose 'Server Certificates - New', check 'sign by class 3 root +certificate', paste the above request block into the text field and +click on 'Submit'. + + If everything works out fine, a certificate will be shown. Now run + + $ gpgsm --import + + and paste the certificate from the CAcert page into your terminal +followed by a Ctrl-D + + -----BEGIN CERTIFICATE----- + MIIEIjCCAgqgAwIBAgIBTDANBgkqhkiG9w0BAQQFADBUMRQwEgYDVQQKEwtDQWNl + [...] + rUTFlNElRXCwIl0YcJkIaYYqWf7+A/aqYJCi8+51usZwMy3Jsq3hJ6MA3h1BgwZs + Rtct3tIX + -----END CERTIFICATE----- + gpgsm: issuer certificate (#/CN=CAcert Class 3 Ro[...]) not found + gpgsm: certificate imported + + gpgsm: total number processed: 1 + gpgsm: imported: 1 + + 'gpgsm' tells you that it has imported the certificate. It is now +associated with the key you used when creating the request. The root +certificate has not been found, so you may want to import it from the +CACert website. + + To see the content of your certificate, you may now enter: + + $ gpgsm -K example.com + /home/foo/.gnupg/pubring.kbx + --------------------------- + Serial number: 4C + Issuer: /CN=CAcert Class 3 Root/OU=http:\x2f\x2fwww.[...] + Subject: /CN=example.com + aka: (dns-name example.com) + aka: (dns-name www.example.com) + validity: 2015-07-01 16:20:51 through 2016-07-01 16:20:51 + key type: 3072 bit RSA + key usage: digitalSignature keyEncipherment + ext key usage: clientAuth (suggested), serverAuth (suggested), [...] + fingerprint: 0F:9C:27:B2:DA:05:5F:CB:33:D8:19:E9:65:B9:4F:BD:B1:98:CC:57 + + I used '-K' above because this will only list certificates for which +a private key is available. To see more details, you may use +'--dump-secret-keys' instead of '-K'. + + To make actual use of the certificate you need to install it on your +server. Server software usually expects a PKCS\#12 file with key and +certificate. To create such a file, run: + + $ gpgsm --export-secret-key-p12 -a >example.com-cert.pem + + You will be asked for the passphrase as well as for a new passphrase +to be used to protect the PKCS\#12 file. The file now contains the +certificate as well as the private key: + + $ cat example-cert.pem + Issuer ...: /CN=CAcert Class 3 Root/OU=http:\x2f\x2fwww.CA[...] + Serial ...: 4C + Subject ..: /CN=example.com + aka ..: (dns-name example.com) + aka ..: (dns-name www.example.com) + + -----BEGIN PKCS12----- + MIIHlwIBAzCCB5AGCSqGSIb37QdHAaCCB4EEggd9MIIHeTk1BJ8GCSqGSIb3DQEu + [...many more lines...] + -----END PKCS12----- + $ + + Copy this file in a secure way to the server, install it there and +delete the file then. You may export the file again at any time as long +as it is available in GnuPG's private key database. + + +File: gnupg.info, Node: System Notes, Next: Debugging, Prev: Howtos, Up: Top + +12 Notes pertaining to certain OSes +*********************************** + +GnuPG has been developed on GNU/Linux systems and is know to work on +almost all Free OSes. All modern POSIX systems should be supported +right now, however there are probably a lot of smaller glitches we need +to fix first. The major problem areas are: + + * We are planning to use file descriptor passing for interprocess + communication. This will allow us save a lot of resources and + improve performance of certain operations a lot. Systems not + supporting this won't gain these benefits but we try to keep them + working the standard way as it is done today. + + * We require more or less full POSIX compatibility. This has been + around for 15 years now and thus we don't believe it makes sense to + support non POSIX systems anymore. Well, we of course the usual + workarounds for near POSIX systems well be applied. + + There is one exception of this rule: Systems based the Microsoft + Windows API (called here _W32_) will be supported to some extend. + +* Menu: + +* W32 Notes:: Microsoft Windows Notes + + +File: gnupg.info, Node: W32 Notes, Up: System Notes + +12.1 Microsoft Windows Notes +============================ + +Current limitations are: + + * 'gpgconf' does not create backup files, so in case of trouble your + configuration file might get lost. + + * 'watchgnupg' is not available. Logging to sockets is not possible. + + * The periodical smartcard status checking done by 'scdaemon' is not + yet supported. + + +File: gnupg.info, Node: Debugging, Next: Copying, Prev: System Notes, Up: Top + +13 How to solve problems +************************ + +Everyone knows that software often does not do what it should do and +thus there is a need to track down problems. We call this debugging in +a reminiscent to the moth jamming a relay in a Mark II box back in 1947. + + Most of the problems a merely configuration and user problems but +nevertheless they are the most annoying ones and responsible for many +gray hairs. We try to give some guidelines here on how to identify and +solve the problem at hand. + +* Menu: + +* Debugging Tools:: Description of some useful tools. +* Debugging Hints:: Various hints on debugging. +* Common Problems:: Commonly seen problems. +* Architecture Details:: How the whole thing works internally. + + +File: gnupg.info, Node: Debugging Tools, Next: Debugging Hints, Up: Debugging + +13.1 Debugging Tools +==================== + +The GnuPG distribution comes with a couple of tools, useful to help find +and solving problems. + +* Menu: + +* kbxutil:: Scrutinizing a keybox file. + + +File: gnupg.info, Node: kbxutil, Up: Debugging Tools + +13.1.1 Scrutinizing a keybox file +--------------------------------- + +A keybox is a file format used to store public keys along with meta +information and indices. The commonly used one is the file +'pubring.kbx' in the '.gnupg' directory. It contains all X.509 +certificates as well as OpenPGP keys. + +When called the standard way, e.g.: + + 'kbxutil ~/.gnupg/pubring.kbx' + +it lists all records (called blobs) with there meta-information in a +human readable format. + +To see statistics on the keybox in question, run it using + + 'kbxutil --stats ~/.gnupg/pubring.kbx' + +and you get an output like: + + Total number of blobs: 99 + header: 1 + empty: 0 + openpgp: 0 + x509: 98 + non flagged: 81 + secret flagged: 0 + ephemeral flagged: 17 + + In this example you see that the keybox does not have any OpenPGP +keys but contains 98 X.509 certificates and a total of 17 keys or +certificates are flagged as ephemeral, meaning that they are only +temporary stored (cached) in the keybox and won't get listed using the +usual commands provided by 'gpgsm' or 'gpg'. 81 certificates are stored +in a standard way and directly available from 'gpgsm'. + +To find duplicated certificates and keyblocks in a keybox file (this +should not occur but sometimes things go wrong), run it using + + 'kbxutil --find-dups ~/.gnupg/pubring.kbx' + + +File: gnupg.info, Node: Debugging Hints, Next: Common Problems, Prev: Debugging Tools, Up: Debugging + +13.2 Various hints on debugging +=============================== + + * How to find the IP address of a keyserver + + If a round robin URL of is used for a keyserver (e.g. + subkeys.gnupg.org); it is not easy to see what server is actually + used. Using the keyserver debug option as in + + gpg --keyserver-options debug=1 -v --refresh-key 1E42B367 + + is thus often helpful. Note that the actual output depends on the + backend and may change from release to release. + + * Logging on WindowsCE + + For development, the best logging method on WindowsCE is the use of + remote debugging using a log file name of 'tcp://<ip-addr>:<port>'. + The command 'watchgnupg' may be used on the remote host to listen + on the given port (*note option watchgnupg --tcp::). For in the + field tests it is better to make use of the logging facility + provided by the 'gpgcedev' driver (part of libassuan); this is + enabled by using a log file name of 'GPG2:' (*note option + --log-file::). + + +File: gnupg.info, Node: Common Problems, Next: Architecture Details, Prev: Debugging Hints, Up: Debugging + +13.3 Commonly Seen Problems +=========================== + + * Error code 'Not supported' from Dirmngr + + Most likely the option 'enable-ocsp' is active for gpgsm but + Dirmngr's OCSP feature has not been enabled using 'allow-ocsp' in + 'dirmngr.conf'. + + * The Curses based Pinentry does not work + + The far most common reason for this is that the environment + variable 'GPG_TTY' has not been set correctly. Make sure that it + has been set to a real tty device and not just to '/dev/tty'; i.e. + 'GPG_TTY=tty' is plainly wrong; what you want is 'GPG_TTY=`tty`' -- + note the back ticks. Also make sure that this environment variable + gets exported, that is you should follow up the setting with an + 'export GPG_TTY' (assuming a Bourne style shell). Even for GUI + based Pinentries; you should have set 'GPG_TTY'. See the section + on installing the 'gpg-agent' on how to do it. + + * SSH hangs while a popping up pinentry was expected + + SSH has no way to tell the gpg-agent what terminal or X display it + is running on. So when remotely logging into a box where a + gpg-agent with SSH support is running, the pinentry will get popped + up on whatever display the gpg-agent has been started. To solve + this problem you may issue the command + + echo UPDATESTARTUPTTY | gpg-connect-agent + + and the next pinentry will pop up on your display or screen. + However, you need to kill the running pinentry first because only + one pinentry may be running at once. If you plan to use ssh on a + new display you should issue the above command before invoking ssh + or any other service making use of ssh. + + * Exporting a secret key without a certificate + + It may happen that you have created a certificate request using + 'gpgsm' but not yet received and imported the certificate from the + CA. However, you want to export the secret key to another machine + right now to import the certificate over there then. You can do + this with a little trick but it requires that you know the + approximate time you created the signing request. By running the + command + + ls -ltr ~/.gnupg/private-keys-v1.d + + you get a listing of all private keys under control of 'gpg-agent'. + Pick the key which best matches the creation time and run the + command + + /usr/local/libexec/gpg-protect-tool --p12-export \ + ~/.gnupg/private-keys-v1.d/FOO >FOO.p12 + + (Please adjust the path to 'gpg-protect-tool' to the appropriate + location). FOO is the name of the key file you picked (it should + have the suffix '.key'). A Pinentry box will pop up and ask you + for the current passphrase of the key and a new passphrase to + protect it in the pkcs#12 file. + + To import the created file on the machine you use this command: + + /usr/local/libexec/gpg-protect-tool --p12-import --store FOO.p12 + + You will be asked for the pkcs#12 passphrase and a new passphrase + to protect the imported private key at its new location. + + Note that there is no easy way to match existing certificates with + stored private keys because some private keys are used for Secure + Shell or other purposes and don't have a corresponding certificate. + + * A root certificate does not verify + + A common problem is that the root certificate misses the required + basicConstraints attribute and thus 'gpgsm' rejects this + certificate. An error message indicating "no value" is a sign for + such a certificate. You may use the 'relax' flag in + 'trustlist.txt' to accept the certificate anyway. Note that the + fingerprint and this flag may only be added manually to + 'trustlist.txt'. + + * Error message: "digest algorithm N has not been enabled" + + The signature is broken. You may try the option + '--extra-digest-algo SHA256' to workaround the problem. The number + N is the internal algorithm identifier; for example 8 refers to + SHA-256. + + * The Windows version does not work under Wine + + When running the W32 version of 'gpg' under Wine you may get an + error messages like: + + gpg: fatal: WriteConsole failed: Access denied + + The solution is to use the command 'wineconsole'. + + Some operations like '--generate-key' really want to talk to the + console directly for increased security (for example to prevent the + passphrase from appearing on the screen). So, you should use + 'wineconsole' instead of 'wine', which will launch a windows + console that implements those additional features. + + * Why does GPG's -search-key list weird keys? + + For performance reasons the keyservers do not check the keys the + same way 'gpg' does. It may happen that the listing of keys + available on the keyservers shows keys with wrong user IDs or with + user Ids from other keys. If you try to import this key, the bad + keys or bad user ids won't get imported, though. This is a bit + unfortunate but we can't do anything about it without actually + downloading the keys. + + +File: gnupg.info, Node: Architecture Details, Prev: Common Problems, Up: Debugging + +13.4 How the whole thing works internally +========================================= + +* Menu: + +* Component interaction:: How the components work together. +* GnuPG-1 and GnuPG-2:: Relationship between GnuPG 1.4 and 2.x. + + +File: gnupg.info, Node: Component interaction, Next: GnuPG-1 and GnuPG-2, Up: Architecture Details + +13.4.1 How the components work together +--------------------------------------- + + + +Figure 13.1: GnuPG module overview + + +File: gnupg.info, Node: GnuPG-1 and GnuPG-2, Prev: Component interaction, Up: Architecture Details + +13.4.2 Relationship between GnuPG 1.4 and 2.x +--------------------------------------------- + +Here is a little picture showing how the different GnuPG versions make +use of a smartcard: + + + +Figure 13.2: GnuPG card architecture + + +File: gnupg.info, Node: Copying, Next: Contributors, Prev: Debugging, Up: Top + +GNU General Public License +************************** + + Version 3, 29 June 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/> + + Everyone is permitted to copy and distribute verbatim copies of this + license document, but changing it is not allowed. + +Preamble +======== + +The GNU General Public License is a free, copyleft license for software +and other kinds of works. + + The licenses for most software and other practical works are designed +to take away your freedom to share and change the works. By contrast, +the GNU General Public License is intended to guarantee your freedom to +share and change all versions of a program-to make sure it remains free +software for all its users. We, the Free Software Foundation, use the +GNU General Public License for most of our software; it applies also to +any other work released this way by its authors. You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +them if you wish), that you receive source code or can get it if you +want it, that you can change the software or use pieces of it in new +free programs, and that you know you can do these things. + + To protect your rights, we need to prevent others from denying you +these rights or asking you to surrender the rights. Therefore, you have +certain responsibilities if you distribute copies of the software, or if +you modify it: responsibilities to respect the freedom of others. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must pass on to the recipients the same +freedoms that you received. You must make sure that they, too, receive +or can get the source code. And you must show them these terms so they +know their rights. + + Developers that use the GNU GPL protect your rights with two steps: +(1) assert copyright on the software, and (2) offer you this License +giving you legal permission to copy, distribute and/or modify it. + + For the developers' and authors' protection, the GPL clearly explains +that there is no warranty for this free software. For both users' and +authors' sake, the GPL requires that modified versions be marked as +changed, so that their problems will not be attributed erroneously to +authors of previous versions. + + Some devices are designed to deny users access to install or run +modified versions of the software inside them, although the manufacturer +can do so. This is fundamentally incompatible with the aim of +protecting users' freedom to change the software. The systematic +pattern of such abuse occurs in the area of products for individuals to +use, which is precisely where it is most unacceptable. Therefore, we +have designed this version of the GPL to prohibit the practice for those +products. If such problems arise substantially in other domains, we +stand ready to extend this provision to those domains in future versions +of the GPL, as needed to protect the freedom of users. + + Finally, every program is threatened constantly by software patents. +States should not allow patents to restrict development and use of +software on general-purpose computers, but in those that do, we wish to +avoid the special danger that patents applied to a free program could +make it effectively proprietary. To prevent this, the GPL assures that +patents cannot be used to render the program non-free. + + The precise terms and conditions for copying, distribution and +modification follow. + + TERMS AND CONDITIONS + + 0. Definitions. + + "This License" refers to version 3 of the GNU General Public + License. + + "Copyright" also means copyright-like laws that apply to other + kinds of works, such as semiconductor masks. + + "The Program" refers to any copyrightable work licensed under this + License. Each licensee is addressed as "you". "Licensees" and + "recipients" may be individuals or organizations. + + To "modify" a work means to copy from or adapt all or part of the + work in a fashion requiring copyright permission, other than the + making of an exact copy. The resulting work is called a "modified + version" of the earlier work or a work "based on" the earlier work. + + A "covered work" means either the unmodified Program or a work + based on the Program. + + To "propagate" a work means to do anything with it that, without + permission, would make you directly or secondarily liable for + infringement under applicable copyright law, except executing it on + a computer or modifying a private copy. Propagation includes + copying, distribution (with or without modification), making + available to the public, and in some countries other activities as + well. + + To "convey" a work means any kind of propagation that enables other + parties to make or receive copies. Mere interaction with a user + through a computer network, with no transfer of a copy, is not + conveying. + + An interactive user interface displays "Appropriate Legal Notices" + to the extent that it includes a convenient and prominently visible + feature that (1) displays an appropriate copyright notice, and (2) + tells the user that there is no warranty for the work (except to + the extent that warranties are provided), that licensees may convey + the work under this License, and how to view a copy of this + License. If the interface presents a list of user commands or + options, such as a menu, a prominent item in the list meets this + criterion. + + 1. Source Code. + + The "source code" for a work means the preferred form of the work + for making modifications to it. "Object code" means any non-source + form of a work. + + A "Standard Interface" means an interface that either is an + official standard defined by a recognized standards body, or, in + the case of interfaces specified for a particular programming + language, one that is widely used among developers working in that + language. + + The "System Libraries" of an executable work include anything, + other than the work as a whole, that (a) is included in the normal + form of packaging a Major Component, but which is not part of that + Major Component, and (b) serves only to enable use of the work with + that Major Component, or to implement a Standard Interface for + which an implementation is available to the public in source code + form. A "Major Component", in this context, means a major + essential component (kernel, window system, and so on) of the + specific operating system (if any) on which the executable work + runs, or a compiler used to produce the work, or an object code + interpreter used to run it. + + The "Corresponding Source" for a work in object code form means all + the source code needed to generate, install, and (for an executable + work) run the object code and to modify the work, including scripts + to control those activities. However, it does not include the + work's System Libraries, or general-purpose tools or generally + available free programs which are used unmodified in performing + those activities but which are not part of the work. For example, + Corresponding Source includes interface definition files associated + with source files for the work, and the source code for shared + libraries and dynamically linked subprograms that the work is + specifically designed to require, such as by intimate data + communication or control flow between those subprograms and other + parts of the work. + + The Corresponding Source need not include anything that users can + regenerate automatically from other parts of the Corresponding + Source. + + The Corresponding Source for a work in source code form is that + same work. + + 2. Basic Permissions. + + All rights granted under this License are granted for the term of + copyright on the Program, and are irrevocable provided the stated + conditions are met. This License explicitly affirms your unlimited + permission to run the unmodified Program. The output from running + a covered work is covered by this License only if the output, given + its content, constitutes a covered work. This License acknowledges + your rights of fair use or other equivalent, as provided by + copyright law. + + You may make, run and propagate covered works that you do not + convey, without conditions so long as your license otherwise + remains in force. You may convey covered works to others for the + sole purpose of having them make modifications exclusively for you, + or provide you with facilities for running those works, provided + that you comply with the terms of this License in conveying all + material for which you do not control copyright. Those thus making + or running the covered works for you must do so exclusively on your + behalf, under your direction and control, on terms that prohibit + them from making any copies of your copyrighted material outside + their relationship with you. + + Conveying under any other circumstances is permitted solely under + the conditions stated below. Sublicensing is not allowed; section + 10 makes it unnecessary. + + 3. Protecting Users' Legal Rights From Anti-Circumvention Law. + + No covered work shall be deemed part of an effective technological + measure under any applicable law fulfilling obligations under + article 11 of the WIPO copyright treaty adopted on 20 December + 1996, or similar laws prohibiting or restricting circumvention of + such measures. + + When you convey a covered work, you waive any legal power to forbid + circumvention of technological measures to the extent such + circumvention is effected by exercising rights under this License + with respect to the covered work, and you disclaim any intention to + limit operation or modification of the work as a means of + enforcing, against the work's users, your or third parties' legal + rights to forbid circumvention of technological measures. + + 4. Conveying Verbatim Copies. + + You may convey verbatim copies of the Program's source code as you + receive it, in any medium, provided that you conspicuously and + appropriately publish on each copy an appropriate copyright notice; + keep intact all notices stating that this License and any + non-permissive terms added in accord with section 7 apply to the + code; keep intact all notices of the absence of any warranty; and + give all recipients a copy of this License along with the Program. + + You may charge any price or no price for each copy that you convey, + and you may offer support or warranty protection for a fee. + + 5. Conveying Modified Source Versions. + + You may convey a work based on the Program, or the modifications to + produce it from the Program, in the form of source code under the + terms of section 4, provided that you also meet all of these + conditions: + + a. The work must carry prominent notices stating that you + modified it, and giving a relevant date. + + b. The work must carry prominent notices stating that it is + released under this License and any conditions added under + section 7. This requirement modifies the requirement in + section 4 to "keep intact all notices". + + c. You must license the entire work, as a whole, under this + License to anyone who comes into possession of a copy. This + License will therefore apply, along with any applicable + section 7 additional terms, to the whole of the work, and all + its parts, regardless of how they are packaged. This License + gives no permission to license the work in any other way, but + it does not invalidate such permission if you have separately + received it. + + d. If the work has interactive user interfaces, each must display + Appropriate Legal Notices; however, if the Program has + interactive interfaces that do not display Appropriate Legal + Notices, your work need not make them do so. + + A compilation of a covered work with other separate and independent + works, which are not by their nature extensions of the covered + work, and which are not combined with it such as to form a larger + program, in or on a volume of a storage or distribution medium, is + called an "aggregate" if the compilation and its resulting + copyright are not used to limit the access or legal rights of the + compilation's users beyond what the individual works permit. + Inclusion of a covered work in an aggregate does not cause this + License to apply to the other parts of the aggregate. + + 6. Conveying Non-Source Forms. + + You may convey a covered work in object code form under the terms + of sections 4 and 5, provided that you also convey the + machine-readable Corresponding Source under the terms of this + License, in one of these ways: + + a. Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by the + Corresponding Source fixed on a durable physical medium + customarily used for software interchange. + + b. Convey the object code in, or embodied in, a physical product + (including a physical distribution medium), accompanied by a + written offer, valid for at least three years and valid for as + long as you offer spare parts or customer support for that + product model, to give anyone who possesses the object code + either (1) a copy of the Corresponding Source for all the + software in the product that is covered by this License, on a + durable physical medium customarily used for software + interchange, for a price no more than your reasonable cost of + physically performing this conveying of source, or (2) access + to copy the Corresponding Source from a network server at no + charge. + + c. Convey individual copies of the object code with a copy of the + written offer to provide the Corresponding Source. This + alternative is allowed only occasionally and noncommercially, + and only if you received the object code with such an offer, + in accord with subsection 6b. + + d. Convey the object code by offering access from a designated + place (gratis or for a charge), and offer equivalent access to + the Corresponding Source in the same way through the same + place at no further charge. You need not require recipients + to copy the Corresponding Source along with the object code. + If the place to copy the object code is a network server, the + Corresponding Source may be on a different server (operated by + you or a third party) that supports equivalent copying + facilities, provided you maintain clear directions next to the + object code saying where to find the Corresponding Source. + Regardless of what server hosts the Corresponding Source, you + remain obligated to ensure that it is available for as long as + needed to satisfy these requirements. + + e. Convey the object code using peer-to-peer transmission, + provided you inform other peers where the object code and + Corresponding Source of the work are being offered to the + general public at no charge under subsection 6d. + + A separable portion of the object code, whose source code is + excluded from the Corresponding Source as a System Library, need + not be included in conveying the object code work. + + A "User Product" is either (1) a "consumer product", which means + any tangible personal property which is normally used for personal, + family, or household purposes, or (2) anything designed or sold for + incorporation into a dwelling. In determining whether a product is + a consumer product, doubtful cases shall be resolved in favor of + coverage. For a particular product received by a particular user, + "normally used" refers to a typical or common use of that class of + product, regardless of the status of the particular user or of the + way in which the particular user actually uses, or expects or is + expected to use, the product. A product is a consumer product + regardless of whether the product has substantial commercial, + industrial or non-consumer uses, unless such uses represent the + only significant mode of use of the product. + + "Installation Information" for a User Product means any methods, + procedures, authorization keys, or other information required to + install and execute modified versions of a covered work in that + User Product from a modified version of its Corresponding Source. + The information must suffice to ensure that the continued + functioning of the modified object code is in no case prevented or + interfered with solely because modification has been made. + + If you convey an object code work under this section in, or with, + or specifically for use in, a User Product, and the conveying + occurs as part of a transaction in which the right of possession + and use of the User Product is transferred to the recipient in + perpetuity or for a fixed term (regardless of how the transaction + is characterized), the Corresponding Source conveyed under this + section must be accompanied by the Installation Information. But + this requirement does not apply if neither you nor any third party + retains the ability to install modified object code on the User + Product (for example, the work has been installed in ROM). + + The requirement to provide Installation Information does not + include a requirement to continue to provide support service, + warranty, or updates for a work that has been modified or installed + by the recipient, or for the User Product in which it has been + modified or installed. Access to a network may be denied when the + modification itself materially and adversely affects the operation + of the network or violates the rules and protocols for + communication across the network. + + Corresponding Source conveyed, and Installation Information + provided, in accord with this section must be in a format that is + publicly documented (and with an implementation available to the + public in source code form), and must require no special password + or key for unpacking, reading or copying. + + 7. Additional Terms. + + "Additional permissions" are terms that supplement the terms of + this License by making exceptions from one or more of its + conditions. Additional permissions that are applicable to the + entire Program shall be treated as though they were included in + this License, to the extent that they are valid under applicable + law. If additional permissions apply only to part of the Program, + that part may be used separately under those permissions, but the + entire Program remains governed by this License without regard to + the additional permissions. + + When you convey a copy of a covered work, you may at your option + remove any additional permissions from that copy, or from any part + of it. (Additional permissions may be written to require their own + removal in certain cases when you modify the work.) You may place + additional permissions on material, added by you to a covered work, + for which you have or can give appropriate copyright permission. + + Notwithstanding any other provision of this License, for material + you add to a covered work, you may (if authorized by the copyright + holders of that material) supplement the terms of this License with + terms: + + a. Disclaiming warranty or limiting liability differently from + the terms of sections 15 and 16 of this License; or + + b. Requiring preservation of specified reasonable legal notices + or author attributions in that material or in the Appropriate + Legal Notices displayed by works containing it; or + + c. Prohibiting misrepresentation of the origin of that material, + or requiring that modified versions of such material be marked + in reasonable ways as different from the original version; or + + d. Limiting the use for publicity purposes of names of licensors + or authors of the material; or + + e. Declining to grant rights under trademark law for use of some + trade names, trademarks, or service marks; or + + f. Requiring indemnification of licensors and authors of that + material by anyone who conveys the material (or modified + versions of it) with contractual assumptions of liability to + the recipient, for any liability that these contractual + assumptions directly impose on those licensors and authors. + + All other non-permissive additional terms are considered "further + restrictions" within the meaning of section 10. If the Program as + you received it, or any part of it, contains a notice stating that + it is governed by this License along with a term that is a further + restriction, you may remove that term. If a license document + contains a further restriction but permits relicensing or conveying + under this License, you may add to a covered work material governed + by the terms of that license document, provided that the further + restriction does not survive such relicensing or conveying. + + If you add terms to a covered work in accord with this section, you + must place, in the relevant source files, a statement of the + additional terms that apply to those files, or a notice indicating + where to find the applicable terms. + + Additional terms, permissive or non-permissive, may be stated in + the form of a separately written license, or stated as exceptions; + the above requirements apply either way. + + 8. Termination. + + You may not propagate or modify a covered work except as expressly + provided under this License. Any attempt otherwise to propagate or + modify it is void, and will automatically terminate your rights + under this License (including any patent licenses granted under the + third paragraph of section 11). + + However, if you cease all violation of this License, then your + license from a particular copyright holder is reinstated (a) + provisionally, unless and until the copyright holder explicitly and + finally terminates your license, and (b) permanently, if the + copyright holder fails to notify you of the violation by some + reasonable means prior to 60 days after the cessation. + + Moreover, your license from a particular copyright holder is + reinstated permanently if the copyright holder notifies you of the + violation by some reasonable means, this is the first time you have + received notice of violation of this License (for any work) from + that copyright holder, and you cure the violation prior to 30 days + after your receipt of the notice. + + Termination of your rights under this section does not terminate + the licenses of parties who have received copies or rights from you + under this License. If your rights have been terminated and not + permanently reinstated, you do not qualify to receive new licenses + for the same material under section 10. + + 9. Acceptance Not Required for Having Copies. + + You are not required to accept this License in order to receive or + run a copy of the Program. Ancillary propagation of a covered work + occurring solely as a consequence of using peer-to-peer + transmission to receive a copy likewise does not require + acceptance. However, nothing other than this License grants you + permission to propagate or modify any covered work. These actions + infringe copyright if you do not accept this License. Therefore, + by modifying or propagating a covered work, you indicate your + acceptance of this License to do so. + + 10. Automatic Licensing of Downstream Recipients. + + Each time you convey a covered work, the recipient automatically + receives a license from the original licensors, to run, modify and + propagate that work, subject to this License. You are not + responsible for enforcing compliance by third parties with this + License. + + An "entity transaction" is a transaction transferring control of an + organization, or substantially all assets of one, or subdividing an + organization, or merging organizations. If propagation of a + covered work results from an entity transaction, each party to that + transaction who receives a copy of the work also receives whatever + licenses to the work the party's predecessor in interest had or + could give under the previous paragraph, plus a right to possession + of the Corresponding Source of the work from the predecessor in + interest, if the predecessor has it or can get it with reasonable + efforts. + + You may not impose any further restrictions on the exercise of the + rights granted or affirmed under this License. For example, you + may not impose a license fee, royalty, or other charge for exercise + of rights granted under this License, and you may not initiate + litigation (including a cross-claim or counterclaim in a lawsuit) + alleging that any patent claim is infringed by making, using, + selling, offering for sale, or importing the Program or any portion + of it. + + 11. Patents. + + A "contributor" is a copyright holder who authorizes use under this + License of the Program or a work on which the Program is based. + The work thus licensed is called the contributor's "contributor + version". + + A contributor's "essential patent claims" are all patent claims + owned or controlled by the contributor, whether already acquired or + hereafter acquired, that would be infringed by some manner, + permitted by this License, of making, using, or selling its + contributor version, but do not include claims that would be + infringed only as a consequence of further modification of the + contributor version. For purposes of this definition, "control" + includes the right to grant patent sublicenses in a manner + consistent with the requirements of this License. + + Each contributor grants you a non-exclusive, worldwide, + royalty-free patent license under the contributor's essential + patent claims, to make, use, sell, offer for sale, import and + otherwise run, modify and propagate the contents of its contributor + version. + + In the following three paragraphs, a "patent license" is any + express agreement or commitment, however denominated, not to + enforce a patent (such as an express permission to practice a + patent or covenant not to sue for patent infringement). To "grant" + such a patent license to a party means to make such an agreement or + commitment not to enforce a patent against the party. + + If you convey a covered work, knowingly relying on a patent + license, and the Corresponding Source of the work is not available + for anyone to copy, free of charge and under the terms of this + License, through a publicly available network server or other + readily accessible means, then you must either (1) cause the + Corresponding Source to be so available, or (2) arrange to deprive + yourself of the benefit of the patent license for this particular + work, or (3) arrange, in a manner consistent with the requirements + of this License, to extend the patent license to downstream + recipients. "Knowingly relying" means you have actual knowledge + that, but for the patent license, your conveying the covered work + in a country, or your recipient's use of the covered work in a + country, would infringe one or more identifiable patents in that + country that you have reason to believe are valid. + + If, pursuant to or in connection with a single transaction or + arrangement, you convey, or propagate by procuring conveyance of, a + covered work, and grant a patent license to some of the parties + receiving the covered work authorizing them to use, propagate, + modify or convey a specific copy of the covered work, then the + patent license you grant is automatically extended to all + recipients of the covered work and works based on it. + + A patent license is "discriminatory" if it does not include within + the scope of its coverage, prohibits the exercise of, or is + conditioned on the non-exercise of one or more of the rights that + are specifically granted under this License. You may not convey a + covered work if you are a party to an arrangement with a third + party that is in the business of distributing software, under which + you make payment to the third party based on the extent of your + activity of conveying the work, and under which the third party + grants, to any of the parties who would receive the covered work + from you, a discriminatory patent license (a) in connection with + copies of the covered work conveyed by you (or copies made from + those copies), or (b) primarily for and in connection with specific + products or compilations that contain the covered work, unless you + entered into that arrangement, or that patent license was granted, + prior to 28 March 2007. + + Nothing in this License shall be construed as excluding or limiting + any implied license or other defenses to infringement that may + otherwise be available to you under applicable patent law. + + 12. No Surrender of Others' Freedom. + + If conditions are imposed on you (whether by court order, agreement + or otherwise) that contradict the conditions of this License, they + do not excuse you from the conditions of this License. If you + cannot convey a covered work so as to satisfy simultaneously your + obligations under this License and any other pertinent obligations, + then as a consequence you may not convey it at all. For example, + if you agree to terms that obligate you to collect a royalty for + further conveying from those to whom you convey the Program, the + only way you could satisfy both those terms and this License would + be to refrain entirely from conveying the Program. + + 13. Use with the GNU Affero General Public License. + + Notwithstanding any other provision of this License, you have + permission to link or combine any covered work with a work licensed + under version 3 of the GNU Affero General Public License into a + single combined work, and to convey the resulting work. The terms + of this License will continue to apply to the part which is the + covered work, but the special requirements of the GNU Affero + General Public License, section 13, concerning interaction through + a network will apply to the combination as such. + + 14. Revised Versions of this License. + + The Free Software Foundation may publish revised and/or new + versions of the GNU General Public License from time to time. Such + new versions will be similar in spirit to the present version, but + may differ in detail to address new problems or concerns. + + Each version is given a distinguishing version number. If the + Program specifies that a certain numbered version of the GNU + General Public License "or any later version" applies to it, you + have the option of following the terms and conditions either of + that numbered version or of any later version published by the Free + Software Foundation. If the Program does not specify a version + number of the GNU General Public License, you may choose any + version ever published by the Free Software Foundation. + + If the Program specifies that a proxy can decide which future + versions of the GNU General Public License can be used, that + proxy's public statement of acceptance of a version permanently + authorizes you to choose that version for the Program. + + Later license versions may give you additional or different + permissions. However, no additional obligations are imposed on any + author or copyright holder as a result of your choosing to follow a + later version. + + 15. Disclaimer of Warranty. + + THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY + APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE + COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" + WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE + RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. + SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL + NECESSARY SERVICING, REPAIR OR CORRECTION. + + 16. Limitation of Liability. + + IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN + WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES + AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR + DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR + CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE + THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA + BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD + PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER + PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF + THE POSSIBILITY OF SUCH DAMAGES. + + 17. Interpretation of Sections 15 and 16. + + If the disclaimer of warranty and limitation of liability provided + above cannot be given local legal effect according to their terms, + reviewing courts shall apply local law that most closely + approximates an absolute waiver of all civil liability in + connection with the Program, unless a warranty or assumption of + liability accompanies a copy of the Program in return for a fee. + + END OF TERMS AND CONDITIONS + +How to Apply These Terms to Your New Programs +============================================= + +If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these +terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +state the exclusion of warranty; and each file should have at least the +"copyright" line and a pointer to where the full notice is found. + + ONE LINE TO GIVE THE PROGRAM'S NAME AND A BRIEF IDEA OF WHAT IT DOES. + Copyright (C) YEAR NAME OF AUTHOR + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or (at + your option) any later version. + + This program is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <https://www.gnu.org/licenses/>. + +Also add information on how to contact you by electronic and paper mail. + +If the program does terminal interaction, make it output a short notice +like this when it starts in an interactive mode: + + PROGRAM Copyright (C) YEAR NAME OF AUTHOR + This program comes with ABSOLUTELY NO WARRANTY; for details + type 'show w'. This is free software, and you are + welcome to redistribute it under certain conditions; + type 'show c' for details. + + The hypothetical commands 'show w' and 'show c' should show the +appropriate parts of the General Public License. Of course, your +program's commands might be different; for a GUI interface, you would +use an "about box". + + You should also get your employer (if you work as a programmer) or +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. For more information on this, and how to apply and follow +the GNU GPL, see <https://www.gnu.org/licenses/>. + + The GNU General Public License does not permit incorporating your +program into proprietary programs. If your program is a subroutine +library, you may consider it more useful to permit linking proprietary +applications with the library. If this is what you want to do, use the +GNU Lesser General Public License instead of this License. But first, +please read <https://www.gnu.org/philosophy/why-not-lgpl.html>. + + +File: gnupg.info, Node: Contributors, Next: Glossary, Prev: Copying, Up: Top + +Contributors to GnuPG +********************* + +The GnuPG project would like to thank its many contributors. Without +them the project would not have been nearly as successful as it has +been. Any omissions in this list are accidental. Feel free to contact +the maintainer if you have been left out or some of your contributions +are not listed. + + David Shaw, Matthew Skala, Michael Roth, Niklas Hernaeus, Nils +Ellmenreich, Rémi Guyomarch, Stefan Bellon, Timo Schulz and Werner Koch +wrote the code. Birger Langkjer, Daniel Resare, Dokianakis Theofanis, +Edmund GRIMLEY EVANS, Gaël Quéri, Gregory Steuck, Nagy Ferenc +László, Ivo Timmermans, Jacobo Tarri'o Barreiro, Janusz Aleksander +Urbanowicz, Jedi Lin, Jouni Hiltunen, Laurentiu Buzdugan, Magda +Procha'zkova', Michael Anckaert, Michal Majer, Marco d'Itri, Nilgun +Belma Buguner, Pedro Morais, Tedi Heriyanto, Thiago Jung Bauermann, +Rafael Caetano dos Santos, Toomas Soome, Urko Lusa, Walter Koch, Yosiaki +IIDA did the official translations. Mike Ashley wrote and maintains the +GNU Privacy Handbook. David Scribner is the current FAQ editor. +Lorenzo Cappelletti maintains the web site. + + The new modularized architecture of gnupg 1.9 as well as the +X.509/CMS part has been developed as part of the Ägypten project. +Direct contributors to this project are: Bernhard Herzog, who did +extensive testing and tracked down a lot of bugs. Bernhard Reiter, who +made sure that we met the specifications and the deadlines. He did +extensive testing and came up with a lot of suggestions. Jan-Oliver +Wagner made sure that we met the specifications and the deadlines. He +also did extensive testing and came up with a lot of suggestions. +Karl-Heinz Zimmer and Marc Mutz had to struggle with all the bugs and +misconceptions while working on KDE integration. Marcus Brinkman +extended GPGME, cleaned up the Assuan code and fixed bugs all over the +place. Moritz Schulte took over Libgcrypt maintenance and developed it +into a stable an useful library. Steffen Hansen had a hard time to +write the dirmngr due to underspecified interfaces. Thomas Koester did +extensive testing and tracked down a lot of bugs. Werner Koch designed +the system and wrote most of the code. + + The following people helped greatly by suggesting improvements, +testing, fixing bugs, providing resources and doing other important +tasks: Adam Mitchell, Albert Chin, Alec Habig, Allan Clark, Anand +Kumria, Andreas Haumer, Anthony Mulcahy, Ariel T Glenn, Bob Mathews, +Bodo Moeller, Brendan O'Dea, Brenno de Winter, Brian M. Carlson, Brian +Moore, Brian Warner, Bryan Fullerton, Caskey L. Dickson, Cees van de +Griend, Charles Levert, Chip Salzenberg, Chris Adams, Christian Biere, +Christian Kurz, Christian von Roques, Christopher Oliver, Christian +Recktenwald, Dan Winship, Daniel Eisenbud, Daniel Koening, Dave Dykstra, +David C Niemi, David Champion, David Ellement, David Hallinan, David +Hollenberg, David Mathog, David R. Bergstein, Detlef Lannert, Dimitri, +Dirk Lattermann, Dirk Meyer, Disastry, Douglas Calvert, Ed Boraas, +Edmund GRIMLEY EVANS, Edwin Woudt, Enzo Michelangeli, Ernst Molitor, +Fabio Coatti, Felix von Leitner, fish stiqz, Florian Weimer, Francesco +Potorti, Frank Donahoe, Frank Heckenbach, Frank Stajano, Frank Tobin, +Gabriel Rosenkoetter, Gaël Quéri, Gene Carter, Geoff Keating, Georg +Schwarz, Giampaolo Tomassoni, Gilbert Fernandes, Greg Louis, Greg +Troxel, Gregory Steuck, Gregery Barton, Harald Denker, Holger Baust, +Hendrik Buschkamp, Holger Schurig, Holger Smolinski, Holger Trapp, Hugh +Daniel, Huy Le, Ian McKellar, Ivo Timmermans, Jan Krueger, Jan +Niehusmann, Janusz A. Urbanowicz, James Troup, Jean-loup Gailly, Jeff +Long, Jeffery Von Ronne, Jens Bachem, Jeroen C. van Gelderen, J Horacio +MG, J. Michael Ashley, Jim Bauer, Jim Small, Joachim Backes, Joe Rhett, +John A. Martin, Johnny Teveßen, Jörg Schilling, Jos Backus, Joseph +Walton, Juan F. Codagnone, Jun Kuriyama, Kahil D. Jallad, Karl Fogel, +Karsten Thygesen, Katsuhiro Kondou, Kazu Yamamoto, Keith Clayton, Kevin +Ryde, Klaus Singvogel, Kurt Garloff, Lars Kellogg-Stedman, L. Sassaman, +M Taylor, Marcel Waldvogel, Marco d'Itri, Marco Parrone, Marcus +Brinkmann, Mark Adler, Mark Elbrecht, Mark Pettit, Markus Friedl, Martin +Kahlert, Martin Hamilton, Martin Schulte, Matt Kraai, Matthew Skala, +Matthew Wilcox, Matthias Urlichs, Max Valianskiy, Michael Engels, +Michael Fischer v. Mollard, Michael Roth, Michael Sobolev, Michael +Tokarev, Nicolas Graner, Mike McEwan, Neal H Walfield, Nelson H. F. +Beebe, NIIBE Yutaka, Niklas Hernaeus, Nimrod Zimerman, N J Doye, Oliver +Haakert, Oskari Jääskeläinen, Pascal Scheffers, Paul D. Smith, Per +Cederqvist, Phil Blundell, Philippe Laliberte, Peter Fales, Peter +Gutmann, Peter Marschall, Peter Valchev, Piotr Krukowiecki, QingLong, +Ralph Gillen, Rat, Reinhard Wobst, Rémi Guyomarch, Reuben Sumner, +Richard Outerbridge, Robert Joop, Roddy Strachan, Roger Sondermann, +Roland Rosenfeld, Roman Pavlik, Ross Golder, Ryan Malayter, Sam Roberts, +Sami Tolvanen, Sean MacLennan, Sebastian Klemke, Serge Munhoven, SL +Baur, Stefan Bellon, Dr.Stefan.Dalibor, Stefan Karrmann, Stefan Keller, +Steffen Ullrich, Steffen Zahn, Steven Bakker, Steven Murdoch, Susanne +Schultz, Ted Cabeen, Thiago Jung Bauermann, Thijmen Klok, Thomas +Roessler, Tim Mooney, Timo Schulz, Todd Vierling, TOGAWA Satoshi, Tom +Spindler, Tom Zerucha, Tomas Fasth, Tommi Komulainen, Thomas Klausner, +Tomasz Kozlowski, Thomas Mikkelsen, Ulf Möller, Urko Lusa, Vincent P. +Broman, Volker Quetschke, W Lewis, Walter Hofmann, Walter Koch, Wayne +Chapeskie, Wim Vandeputte, Winona Brown, Yosiaki IIDA, Yoshihiro Kajiki +and Gerlinde Klaes. + + This software has been made possible by the previous work of Chris +Wedgwood, Jean-loup Gailly, Jon Callas, Mark Adler, Martin Hellman, Paul +Kendall, Philip R. Zimmermann, Peter Gutmann, Philip A. Nelson, Taher +Elgamal, Torbjorn Granlund, Whitfield Diffie, some unknown NSA +mathematicians and all the folks who have worked hard to create complete +and free operating systems. + + And finally we'd like to thank everyone who uses these tools, submits +bug reports and generally reminds us why we're doing this work in the +first place. + + +File: gnupg.info, Node: Glossary, Next: Option Index, Prev: Contributors, Up: Top + +Glossary +******** + +'ARL' + The _Authority Revocation List_ is technical identical to a CRL but + used for CAs and not for end user certificates. + +'Chain model' + Verification model for X.509 which uses the creation date of a + signature as the date the validation starts and in turn checks that + each certificate has been issued within the time frame, the issuing + certificate was valid. This allows the verification of signatures + after the CA's certificate expired. The validation test also + required an online check of the certificate status. The chain + model is required by the German signature law. See also _Shell + model_. + +'CMS' + The _Cryptographic Message Standard_ describes a message format for + encryption and digital signing. It is closely related to the X.509 + certificate format. CMS was formerly known under the name 'PKCS#7' + and is described by 'RFC3369'. + +'CRL' + The _Certificate Revocation List_ is a list containing certificates + revoked by the issuer. + +'CSR' + The _Certificate Signing Request_ is a message send to a CA to ask + them to issue a new certificate. The data format of such a signing + request is called PCKS#10. + +'OpenPGP' + A data format used to build a PKI and to exchange encrypted or + signed messages. In contrast to X.509, OpenPGP also includes the + message format but does not explicitly demand a specific PKI. + However any kind of PKI may be build upon the OpenPGP protocol. + +'Keygrip' + This term is used by GnuPG to describe a 20 byte hash value used to + identify a certain key without referencing to a concrete protocol. + It is used internally to access a private key. Usually it is shown + and entered as a 40 character hexadecimal formatted string. + +'OCSP' + The _Online Certificate Status Protocol_ is used as an alternative + to a CRL. It is described in 'RFC 2560'. + +'PSE' + The _Personal Security Environment_ describes a database to store + private keys. This is either a smartcard or a collection of files + on a disk; the latter is often called a Soft-PSE. + +'Shell model' + The standard model for validation of certificates under X.509. At + the time of the verification all certificates must be valid and not + expired. See also _Chain model_. + +'X.509' + Description of a PKI used with CMS. It is for example defined by + 'RFC3280'. + + +File: gnupg.info, Node: Option Index, Next: Environment Index, Prev: Glossary, Up: Top + +Option Index +************ + + +* Menu: + +* --override-compliance-check: GPG Esoteric Options. + (line 424) +* add-servers: Dirmngr Options. (line 313) +* agent-program: GPG Configuration Options. + (line 755) +* agent-program <1>: Configuration Options. + (line 53) +* agent-program <2>: Invoking gpg-connect-agent. + (line 42) +* allow-admin: Scdaemon Options. (line 204) +* allow-emacs-pinentry: Agent Options. (line 206) +* allow-freeform-uid: GPG Esoteric Options. + (line 367) +* allow-loopback-pinentry: Agent Options. (line 188) +* allow-multiple-messages: GPG Esoteric Options. + (line 560) +* allow-non-selfsigned-uid: GPG Esoteric Options. + (line 362) +* allow-ocsp: Dirmngr Options. (line 330) +* allow-preset-passphrase: Agent Options. (line 183) +* allow-secret-key-import: GPG Esoteric Options. + (line 556) +* allow-version-check: Dirmngr Options. (line 138) +* allow-weak-digest-algos: GPG Esoteric Options. + (line 403) +* allow-weak-key-signatures: GPG Esoteric Options. + (line 419) +* always-trust: Deprecated Options. (line 21) +* armor: GPG Input and Output. + (line 8) +* armor <1>: Input and Output. (line 8) +* ask-cert-expire: GPG Esoteric Options. + (line 521) +* ask-cert-level: GPG Configuration Options. + (line 360) +* ask-sig-expire: GPG Esoteric Options. + (line 507) +* assume-armor: Input and Output. (line 14) +* assume-base64: Input and Output. (line 18) +* assume-binary: Input and Output. (line 21) +* attribute-fd: GPG Esoteric Options. + (line 92) +* attribute-file: GPG Esoteric Options. + (line 98) +* auto-check-trustdb: GPG Configuration Options. + (line 742) +* auto-expand-secmem: Agent Options. (line 456) +* auto-issuer-key-retrieve: Certificate Options. (line 62) +* auto-key-import: GPG Configuration Options. + (line 578) +* auto-key-locate: GPG Configuration Options. + (line 509) +* auto-key-retrieve: GPG Configuration Options. + (line 590) +* base64: Input and Output. (line 11) +* batch: Agent Options. (line 48) +* batch <1>: GPG Configuration Options. + (line 45) +* batch <2>: gpgtar. (line 104) +* blacklist: gpg-wks-client. (line 126) +* bzip2-compress-level: GPG Configuration Options. + (line 334) +* bzip2-decompress-lowmem: GPG Configuration Options. + (line 344) +* c: Dirmngr Options. (line 87) +* cache-cert: dirmngr-client. (line 72) +* call-dirmngr: Operational GPGSM Commands. + (line 27) +* call-protect-tool: Operational GPGSM Commands. + (line 41) +* card-edit: Operational GPG Commands. + (line 210) +* card-status: Operational GPG Commands. + (line 216) +* card-timeout: Scdaemon Options. (line 180) +* cert-digest-algo: GPG Esoteric Options. + (line 238) +* cert-notation: GPG Esoteric Options. + (line 124) +* cert-policy-url: GPG Esoteric Options. + (line 160) +* change-passphrase: OpenPGP Key Management. + (line 452) +* change-passphrase <1>: Certificate Management. + (line 109) +* change-pin: Operational GPG Commands. + (line 219) +* check: gpg-check-pattern. (line 56) +* check-passphrase-pattern: Agent Options. (line 260) +* check-signatures: Operational GPG Commands. + (line 140) +* check-sigs: Operational GPG Commands. + (line 141) +* check-sym-passphrase-pattern: Agent Options. (line 260) +* check-trustdb: Operational GPG Commands. + (line 349) +* cipher-algo: GPG Esoteric Options. + (line 199) +* cipher-algo <1>: CMS Options. (line 13) +* clear-sign: Operational GPG Commands. + (line 17) +* clearsign: Operational GPG Commands. + (line 18) +* cms: gpgtar. (line 99) +* command-fd: GPG Esoteric Options. + (line 350) +* command-file: GPG Esoteric Options. + (line 357) +* comment: GPG Esoteric Options. + (line 103) +* compatibility-flags: Esoteric Options. (line 57) +* compliance: Compliance Options. (line 67) +* compliance <1>: Esoteric Options. (line 18) +* compliant-needed: GPG Configuration Options. + (line 717) +* compress-algo: GPG Esoteric Options. + (line 215) +* compress-level: GPG Configuration Options. + (line 334) +* connect-quick-timeout: Dirmngr Options. (line 125) +* connect-timeout: Dirmngr Options. (line 125) +* create: gpgtar. (line 16) +* create-socketdir: Invoking gpgconf. (line 96) +* csh: Agent Options. (line 146) +* csh <1>: Dirmngr Options. (line 87) +* ctapi-driver: Scdaemon Options. (line 157) +* daemon: Agent Commands. (line 27) +* daemon <1>: Dirmngr Commands. (line 27) +* daemon <2>: Scdaemon Commands. (line 31) +* dearmor: Operational GPG Commands. + (line 403) +* debug: Agent Options. (line 82) +* debug <1>: Dirmngr Options. (line 59) +* debug <2>: GPG Esoteric Options. + (line 47) +* debug <3>: Esoteric Options. (line 90) +* debug <4>: Scdaemon Options. (line 69) +* debug-all: Agent Options. (line 106) +* debug-all <1>: Dirmngr Options. (line 66) +* debug-all <2>: GPG Esoteric Options. + (line 53) +* debug-all <3>: Esoteric Options. (line 117) +* debug-all <4>: Scdaemon Options. (line 96) +* debug-allow-core-dump: Esoteric Options. (line 120) +* debug-allow-core-dump <1>: Scdaemon Options. (line 113) +* debug-assuan-log-cats: Scdaemon Options. (line 122) +* debug-disable-ticker: Scdaemon Options. (line 109) +* debug-ignore-expiration: Esoteric Options. (line 131) +* debug-iolbf: GPG Esoteric Options. + (line 56) +* debug-level: Agent Options. (line 57) +* debug-level <1>: Dirmngr Options. (line 34) +* debug-level <2>: GPG Esoteric Options. + (line 22) +* debug-level <3>: Esoteric Options. (line 65) +* debug-level <4>: Scdaemon Options. (line 40) +* debug-log-tid: Scdaemon Options. (line 119) +* debug-no-chain-validation: Esoteric Options. (line 127) +* debug-pinentry: Agent Options. (line 126) +* debug-quick-random: Agent Options. (line 114) +* debug-wait: Agent Options. (line 109) +* debug-wait <1>: Dirmngr Options. (line 74) +* debug-wait <2>: Scdaemon Options. (line 99) +* debug-wait <3>: Scdaemon Options. (line 104) +* decode: Invoking gpg-connect-agent. + (line 95) +* decrypt: Operational GPG Commands. + (line 59) +* decrypt <1>: Operational GPGSM Commands. + (line 11) +* decrypt <2>: gpgtar. (line 29) +* decrypt-files: Operational GPG Commands. + (line 114) +* default-cache-ttl: Agent Options. (line 217) +* default-cache-ttl <1>: Agent Options. (line 226) +* default-cert-expire: GPG Esoteric Options. + (line 527) +* default-cert-level: GPG Configuration Options. + (line 368) +* default-key: GPG Configuration Options. + (line 10) +* default-key <1>: Input and Output. (line 34) +* default-keyserver-url: GPG Esoteric Options. + (line 589) +* default-new-key-algo STRING: GPG Esoteric Options. + (line 534) +* default-preference-list: GPG Esoteric Options. + (line 584) +* default-recipient: GPG Configuration Options. + (line 19) +* default-recipient-self: GPG Configuration Options. + (line 23) +* default-sig-expire: GPG Esoteric Options. + (line 513) +* delete-keys: Operational GPG Commands. + (line 224) +* delete-keys <1>: Certificate Management. + (line 60) +* delete-secret-and-public-key: Operational GPG Commands. + (line 244) +* delete-secret-keys: Operational GPG Commands. + (line 233) +* deny-admin: Scdaemon Options. (line 204) +* desig-revoke: OpenPGP Key Management. + (line 134) +* detach-sign: Operational GPG Commands. + (line 28) +* digest-algo: GPG Esoteric Options. + (line 208) +* directory: gpgtar. (line 76) +* directory <1>: gpg-wks-client. (line 122) +* directory <2>: gpg-wks-server. (line 50) +* dirmngr: Invoking gpg-connect-agent. + (line 54) +* dirmngr-program: GPG Configuration Options. + (line 762) +* dirmngr-program <1>: Configuration Options. + (line 59) +* dirmngr-program <2>: Invoking gpg-connect-agent. + (line 49) +* disable-application: Scdaemon Options. (line 214) +* disable-ccid: Scdaemon Options. (line 162) +* disable-check-own-socket: Agent Options. (line 342) +* disable-check-own-socket <1>: Dirmngr Options. (line 79) +* disable-cipher-algo: GPG Esoteric Options. + (line 246) +* disable-crl-checks: Certificate Options. (line 13) +* disable-dsa2: GPG Configuration Options. + (line 196) +* disable-extended-key-format: Agent Options. (line 388) +* disable-http: Dirmngr Options. (line 217) +* disable-ipv4: Dirmngr Options. (line 211) +* disable-ipv6: Dirmngr Options. (line 211) +* disable-large-rsa: GPG Configuration Options. + (line 187) +* disable-ldap: Dirmngr Options. (line 214) +* disable-mdc: OpenPGP Options. (line 25) +* disable-ocsp: Certificate Options. (line 53) +* disable-pinpad: Scdaemon Options. (line 201) +* disable-policy-checks: Certificate Options. (line 8) +* disable-pubkey-algo: GPG Esoteric Options. + (line 251) +* disable-scdaemon: Agent Options. (line 336) +* disable-signer-uid: OpenPGP Options. (line 31) +* disable-trusted-cert-crl-check: Certificate Options. (line 24) +* display: Agent Options. (line 360) +* display-charset: GPG Configuration Options. + (line 281) +* display-charset:iso-8859-1: GPG Configuration Options. + (line 291) +* display-charset:iso-8859-15: GPG Configuration Options. + (line 297) +* display-charset:iso-8859-2: GPG Configuration Options. + (line 294) +* display-charset:koi8-r: GPG Configuration Options. + (line 300) +* display-charset:utf-8: GPG Configuration Options. + (line 303) +* dry-run: GPG Esoteric Options. + (line 8) +* dry-run <1>: gpgtar. (line 72) +* dump-cert: Certificate Management. + (line 36) +* dump-chain: Certificate Management. + (line 40) +* dump-external-keys: Certificate Management. + (line 47) +* dump-keys: Certificate Management. + (line 36) +* dump-options: Agent Commands. (line 19) +* dump-options <1>: Dirmngr Commands. (line 18) +* dump-options <2>: General GPG Commands. + (line 20) +* dump-options <3>: General GPGSM Commands. + (line 19) +* dump-options <4>: Scdaemon Commands. (line 18) +* dump-secret-keys: Certificate Management. + (line 43) +* edit-card: Operational GPG Commands. + (line 209) +* edit-key: OpenPGP Key Management. + (line 139) +* emit-version: GPG Esoteric Options. + (line 114) +* enable-crl-checks: Certificate Options. (line 13) +* enable-dsa2: GPG Configuration Options. + (line 196) +* enable-extended-key-format: Agent Options. (line 388) +* enable-issuer-based-crl-check: Certificate Options. (line 45) +* enable-large-rsa: GPG Configuration Options. + (line 187) +* enable-ocsp: Certificate Options. (line 53) +* enable-passphrase-history: Agent Options. (line 283) +* enable-pinpad-varlen: Scdaemon Options. (line 193) +* enable-policy-checks: Certificate Options. (line 8) +* enable-progress-filter: GPG Esoteric Options. + (line 69) +* enable-putty-support: Agent Options. (line 402) +* enable-special-filenames: GPG Esoteric Options. + (line 571) +* enable-special-filenames <1>: gpgv. (line 97) +* enable-ssh-support: Agent Options. (line 402) +* enable-trusted-cert-crl-check: Certificate Options. (line 24) +* enarmor: Operational GPG Commands. + (line 403) +* encrypt: Operational GPG Commands. + (line 32) +* encrypt <1>: Operational GPGSM Commands. + (line 7) +* encrypt <2>: gpgtar. (line 23) +* encrypt-files: Operational GPG Commands. + (line 111) +* encrypt-to: GPG Key related Options. + (line 35) +* enforce-passphrase-constraints: Agent Options. (line 244) +* escape-from-lines: GPG Esoteric Options. + (line 276) +* exec: Invoking gpg-connect-agent. + (line 65) +* exec-path: GPG Configuration Options. + (line 225) +* exit-on-status-write-error: GPG Configuration Options. + (line 791) +* expert: GPG Configuration Options. + (line 846) +* export: Operational GPG Commands. + (line 250) +* export <1>: Certificate Management. + (line 69) +* export-filter: GPG Input and Output. + (line 131) +* export-options: GPG Input and Output. + (line 220) +* export-ownertrust: Operational GPG Commands. + (line 364) +* export-secret-key-p12: Certificate Management. + (line 82) +* export-secret-key-p8: Certificate Management. + (line 91) +* export-secret-key-raw: Certificate Management. + (line 91) +* export-secret-keys: Operational GPG Commands. + (line 268) +* export-secret-subkeys: Operational GPG Commands. + (line 268) +* export-ssh-key: Operational GPG Commands. + (line 290) +* extra-digest-algo: Esoteric Options. (line 7) +* extra-socket: Agent Options. (line 374) +* extract: gpgtar. (line 19) +* faked-system-time: Agent Options. (line 52) +* faked-system-time <1>: GPG Esoteric Options. + (line 60) +* faked-system-time <2>: Esoteric Options. (line 46) +* fast-list-mode: GPG Esoteric Options. + (line 462) +* fetch-crl: Dirmngr Commands. (line 52) +* fetch-keys: Operational GPG Commands. + (line 333) +* fingerprint: Operational GPG Commands. + (line 194) +* fixed-list-mode: GPG Input and Output. + (line 284) +* flush: Dirmngr Commands. (line 62) +* for-your-eyes-only: GPG Esoteric Options. + (line 185) +* forbid-gen-key: GPG Esoteric Options. + (line 551) +* force: Dirmngr Options. (line 93) +* force <1>: watchgnupg. (line 23) +* force-crl-refresh: Certificate Options. (line 35) +* force-default-responder: dirmngr-client. (line 64) +* force-mdc: OpenPGP Options. (line 25) +* force-sign-key: GPG Esoteric Options. + (line 545) +* forget: Invoking gpg-preset-passphrase. + (line 26) +* from: gpg-wks-server. (line 54) +* full-gen-key: OpenPGP Key Management. + (line 111) +* full-generate-key: OpenPGP Key Management. + (line 110) +* gen-key: OpenPGP Key Management. + (line 104) +* gen-key <1>: Certificate Management. + (line 8) +* gen-prime: Operational GPG Commands. + (line 398) +* gen-random: Operational GPG Commands. + (line 391) +* gen-revoke: OpenPGP Key Management. + (line 120) +* generate-designated-revocation: OpenPGP Key Management. + (line 133) +* generate-key: OpenPGP Key Management. + (line 103) +* generate-key <1>: Certificate Management. + (line 7) +* generate-revocation: OpenPGP Key Management. + (line 119) +* gnupg: Compliance Options. (line 12) +* gpg: gpgtar. (line 135) +* gpg-agent-info: GPG Configuration Options. + (line 752) +* gpg-args: gpgtar. (line 138) +* gpgconf-list: GPG Esoteric Options. + (line 605) +* gpgconf-test: GPG Esoteric Options. + (line 609) +* grab: Agent Options. (line 153) +* group: GPG Key related Options. + (line 55) +* header: gpg-wks-server. (line 57) +* help: Agent Commands. (line 15) +* help <1>: Dirmngr Commands. (line 14) +* help <2>: General GPG Commands. + (line 12) +* help <3>: General GPGSM Commands. + (line 11) +* help <4>: Scdaemon Commands. (line 14) +* help <5>: watchgnupg. (line 39) +* help <6>: dirmngr-client. (line 44) +* help <7>: gpgtar. (line 150) +* help <8>: gpg-wks-client. (line 141) +* help <9>: gpg-wks-server. (line 87) +* hex: Invoking gpg-connect-agent. + (line 91) +* hidden-encrypt-to: GPG Key related Options. + (line 43) +* hidden-recipient: GPG Key related Options. + (line 14) +* hidden-recipient-file: GPG Key related Options. + (line 29) +* homedir: Agent Options. (line 17) +* homedir <1>: GPG Configuration Options. + (line 260) +* homedir <2>: Configuration Options. + (line 16) +* homedir <3>: Scdaemon Options. (line 13) +* homedir <4>: gpgv. (line 69) +* homedir <5>: Invoking gpgconf. (line 120) +* homedir <6>: Invoking gpg-connect-agent. + (line 21) +* honor-http-proxy: Dirmngr Options. (line 236) +* http-proxy: Dirmngr Options. (line 240) +* ignore-cache-for-signing: Agent Options. (line 211) +* ignore-cert: Dirmngr Options. (line 389) +* ignore-cert-extension: Dirmngr Options. (line 379) +* ignore-cert-extension <1>: Certificate Options. (line 82) +* ignore-cert-with-oid: Esoteric Options. (line 37) +* ignore-crc-error: GPG Esoteric Options. + (line 387) +* ignore-http-dp: Dirmngr Options. (line 220) +* ignore-ldap-dp: Dirmngr Options. (line 227) +* ignore-mdc-error: GPG Esoteric Options. + (line 394) +* ignore-ocsp-service-url: Dirmngr Options. (line 232) +* ignore-time-conflict: GPG Esoteric Options. + (line 373) +* ignore-time-conflict <1>: gpgv. (line 63) +* ignore-valid-from: GPG Esoteric Options. + (line 380) +* import: Operational GPG Commands. + (line 304) +* import <1>: Certificate Management. + (line 99) +* import-filter: GPG Input and Output. + (line 131) +* import-options: GPG Input and Output. + (line 45) +* import-ownertrust: Operational GPG Commands. + (line 370) +* include-certs: CMS Options. (line 7) +* include-key-block: OpenPGP Options. (line 38) +* input-size-hint: GPG Input and Output. + (line 29) +* interactive: GPG Esoteric Options. + (line 19) +* keep-display: Agent Options. (line 365) +* keep-tty: Agent Options. (line 365) +* key-origin: GPG Input and Output. + (line 37) +* keydb-clear-some-cert-flags: Certificate Management. + (line 52) +* keyedit:addcardkey: OpenPGP Key Management. + (line 281) +* keyedit:addkey: OpenPGP Key Management. + (line 278) +* keyedit:addphoto: OpenPGP Key Management. + (line 201) +* keyedit:addrevoker: OpenPGP Key Management. + (line 330) +* keyedit:adduid: OpenPGP Key Management. + (line 198) +* keyedit:bkuptocard: OpenPGP Key Management. + (line 295) +* keyedit:change-usage: OpenPGP Key Management. + (line 357) +* keyedit:check: OpenPGP Key Management. + (line 194) +* keyedit:clean: OpenPGP Key Management. + (line 343) +* keyedit:cross-certify: OpenPGP Key Management. + (line 366) +* keyedit:delkey: OpenPGP Key Management. + (line 306) +* keyedit:delsig: OpenPGP Key Management. + (line 184) +* keyedit:deluid: OpenPGP Key Management. + (line 211) +* keyedit:disable: OpenPGP Key Management. + (line 326) +* keyedit:enable: OpenPGP Key Management. + (line 326) +* keyedit:expire: OpenPGP Key Management. + (line 315) +* keyedit:key: OpenPGP Key Management. + (line 148) +* keyedit:keyserver: OpenPGP Key Management. + (line 228) +* keyedit:keytocard: OpenPGP Key Management. + (line 284) +* keyedit:lsign: OpenPGP Key Management. + (line 159) +* keyedit:minimize: OpenPGP Key Management. + (line 352) +* keyedit:notation: OpenPGP Key Management. + (line 235) +* keyedit:nrsign: OpenPGP Key Management. + (line 164) +* keyedit:passwd: OpenPGP Key Management. + (line 336) +* keyedit:pref: OpenPGP Key Management. + (line 243) +* keyedit:primary: OpenPGP Key Management. + (line 220) +* keyedit:quit: OpenPGP Key Management. + (line 377) +* keyedit:revkey: OpenPGP Key Management. + (line 312) +* keyedit:revsig: OpenPGP Key Management. + (line 189) +* keyedit:revuid: OpenPGP Key Management. + (line 217) +* keyedit:save: OpenPGP Key Management. + (line 374) +* keyedit:setpref: OpenPGP Key Management. + (line 255) +* keyedit:showphoto: OpenPGP Key Management. + (line 208) +* keyedit:showpref: OpenPGP Key Management. + (line 247) +* keyedit:sign: OpenPGP Key Management. + (line 152) +* keyedit:toggle: OpenPGP Key Management. + (line 339) +* keyedit:trust: OpenPGP Key Management. + (line 321) +* keyedit:tsign: OpenPGP Key Management. + (line 168) +* keyedit:uid: OpenPGP Key Management. + (line 144) +* keyid-format: GPG Configuration Options. + (line 627) +* keyring: GPG Configuration Options. + (line 229) +* keyring <1>: gpgv. (line 38) +* keyserver: Dirmngr Options. (line 148) +* keyserver <1>: GPG Configuration Options. + (line 636) +* keyserver <2>: Configuration Options. + (line 43) +* keyserver-options: GPG Configuration Options. + (line 655) +* kill: Invoking gpgconf. (line 89) +* known-notation: GPG Esoteric Options. + (line 151) +* launch: Invoking gpgconf. (line 80) +* lc-ctype: Agent Options. (line 360) +* lc-messages: Agent Options. (line 360) +* ldap-proxy: Dirmngr Options. (line 245) +* ldapserver: Dirmngr Options. (line 275) +* ldapserverlist-file: Dirmngr Options. (line 256) +* ldaptimeout: Dirmngr Options. (line 309) +* learn-card: Certificate Management. + (line 104) +* legacy-list-mode: GPG Input and Output. + (line 290) +* limit-card-insert-tries: GPG Configuration Options. + (line 800) +* list-archive: gpgtar. (line 39) +* list-chain: Certificate Management. + (line 32) +* list-config: GPG Esoteric Options. + (line 594) +* list-crls: Dirmngr Commands. (line 40) +* list-gcrypt-config: GPG Esoteric Options. + (line 602) +* list-keys: Operational GPG Commands. + (line 119) +* list-keys <1>: Certificate Management. + (line 17) +* list-keys <2>: Certificate Management. + (line 28) +* list-only: GPG Esoteric Options. + (line 11) +* list-options: GPG Configuration Options. + (line 71) +* list-options:show-keyring: GPG Configuration Options. + (line 119) +* list-options:show-keyserver-urls: GPG Configuration Options. + (line 103) +* list-options:show-notations: GPG Configuration Options. + (line 99) +* list-options:show-only-fpr-mbox: GPG Configuration Options. + (line 134) +* list-options:show-photos: GPG Configuration Options. + (line 79) +* list-options:show-policy-urls: GPG Configuration Options. + (line 93) +* list-options:show-sig-expire: GPG Configuration Options. + (line 123) +* list-options:show-sig-subpackets: GPG Configuration Options. + (line 127) +* list-options:show-std-notations: GPG Configuration Options. + (line 99) +* list-options:show-uid-validity: GPG Configuration Options. + (line 107) +* list-options:show-unusable-subkeys: GPG Configuration Options. + (line 115) +* list-options:show-unusable-uids: GPG Configuration Options. + (line 111) +* list-options:show-usage: GPG Configuration Options. + (line 87) +* list-options:show-user-notations: GPG Configuration Options. + (line 99) +* list-packets: Operational GPG Commands. + (line 203) +* list-secret-keys: Operational GPG Commands. + (line 130) +* list-secret-keys <1>: Certificate Management. + (line 24) +* list-signatures: GPG Esoteric Options. + (line 450) +* list-sigs: GPG Esoteric Options. + (line 451) +* listen-backlog: Agent Options. (line 370) +* listen-backlog <1>: Dirmngr Options. (line 134) +* listen-backlog <2>: Scdaemon Options. (line 135) +* load-crl: Dirmngr Commands. (line 44) +* load-crl <1>: dirmngr-client. (line 80) +* local-user: GPG Key related Options. + (line 77) +* local-user <1>: Input and Output. (line 41) +* local-user <2>: gpgtar. (line 53) +* locate-external-keys: Operational GPG Commands. + (line 170) +* locate-keys: Operational GPG Commands. + (line 170) +* lock-multiple: GPG Configuration Options. + (line 780) +* lock-never: GPG Configuration Options. + (line 784) +* lock-once: GPG Configuration Options. + (line 776) +* log-file: Agent Options. (line 159) +* log-file <1>: Dirmngr Options. (line 30) +* log-file <2>: GPG Esoteric Options. + (line 86) +* log-file <3>: Configuration Options. + (line 80) +* log-file <4>: Scdaemon Options. (line 140) +* log-file <5>: gpgv. (line 59) +* logger-fd: GPG Esoteric Options. + (line 82) +* logger-fd <1>: gpgv. (line 56) +* lookup: dirmngr-client. (line 86) +* lsign-key: OpenPGP Key Management. + (line 392) +* mangle-dos-filenames: GPG Configuration Options. + (line 352) +* marginals-needed: GPG Configuration Options. + (line 721) +* max-cache-ttl: Agent Options. (line 232) +* max-cache-ttl-ssh: Agent Options. (line 238) +* max-cert-depth: GPG Configuration Options. + (line 729) +* max-output: GPG Input and Output. + (line 19) +* max-passphrase-days: Agent Options. (line 278) +* max-replies: Dirmngr Options. (line 376) +* min-cert-level: GPG Configuration Options. + (line 397) +* min-passphrase-len: Agent Options. (line 248) +* min-passphrase-nonalpha: Agent Options. (line 253) +* min-rsa-length: Compliance Options. (line 72) +* min-rsa-length <1>: Esoteric Options. (line 22) +* multi-server: Scdaemon Commands. (line 26) +* multifile: Operational GPG Commands. + (line 100) +* nameserver: Dirmngr Options. (line 203) +* no: GPG Configuration Options. + (line 67) +* no <1>: gpgtar. (line 113) +* no-allow-external-cache: Agent Options. (line 196) +* no-allow-loopback-pinentry: Agent Options. (line 188) +* no-allow-mark-trusted: Agent Options. (line 167) +* no-armor: GPG Input and Output. + (line 12) +* no-auto-key-import: GPG Configuration Options. + (line 578) +* no-auto-key-retrieve: GPG Configuration Options. + (line 590) +* no-autostart: GPG Configuration Options. + (line 769) +* no-autostart <1>: Configuration Options. + (line 69) +* no-autostart <2>: Invoking gpg-connect-agent. + (line 77) +* no-batch: GPG Configuration Options. + (line 45) +* no-common-certs-import: Esoteric Options. (line 168) +* no-default-keyring: GPG Esoteric Options. + (line 432) +* no-default-recipient: GPG Configuration Options. + (line 29) +* no-detach: Agent Options. (line 131) +* no-detach <1>: Scdaemon Options. (line 131) +* no-encrypt-to: GPG Key related Options. + (line 51) +* no-expensive-trust-checks: GPG Esoteric Options. + (line 576) +* no-ext-connect: Invoking gpg-connect-agent. + (line 72) +* no-grab: Agent Options. (line 153) +* no-greeting: GPG Configuration Options. + (line 814) +* no-groups: GPG Key related Options. + (line 73) +* no-keyring: GPG Esoteric Options. + (line 438) +* no-literal: GPG Esoteric Options. + (line 470) +* no-mangle-dos-filenames: GPG Configuration Options. + (line 352) +* no-options: GPG Configuration Options. + (line 327) +* no-random-seed-file: GPG Configuration Options. + (line 808) +* no-secmem-warning: GPG Configuration Options. + (line 817) +* no-secmem-warning <1>: Configuration Options. + (line 76) +* no-sig-cache: GPG Configuration Options. + (line 732) +* no-skip-hidden-recipients: GPG Key related Options. + (line 108) +* no-symkey-cache: GPG Esoteric Options. + (line 337) +* no-tty: GPG Configuration Options. + (line 58) +* no-use-standard-socket: Agent Options. (line 350) +* no-use-tor: Dirmngr Options. (line 98) +* no-user-trustlist: Agent Options. (line 172) +* no-verbose: GPG Configuration Options. + (line 37) +* not-dash-escaped: GPG Esoteric Options. + (line 266) +* null: gpgtar. (line 86) +* null <1>: gpg-check-pattern. (line 59) +* ocsp: dirmngr-client. (line 61) +* ocsp-current-period: Dirmngr Options. (line 371) +* ocsp-max-clock-skew: Dirmngr Options. (line 363) +* ocsp-max-period: Dirmngr Options. (line 367) +* ocsp-responder: Dirmngr Options. (line 337) +* ocsp-signer: Dirmngr Options. (line 342) +* only-ldap-proxy: Dirmngr Options. (line 251) +* openpgp: Compliance Options. (line 19) +* openpgp <1>: gpgtar. (line 95) +* options: Agent Options. (line 10) +* options <1>: Dirmngr Options. (line 11) +* options <2>: Dirmngr Options. (line 16) +* options <3>: GPG Configuration Options. + (line 322) +* options <4>: Configuration Options. + (line 10) +* options <5>: Scdaemon Options. (line 7) +* output: GPG Input and Output. + (line 16) +* output <1>: Input and Output. (line 51) +* output <2>: gpgv. (line 45) +* output <3>: gpgtar. (line 57) +* output <4>: gpg-wks-client. (line 111) +* output <5>: gpg-wks-server. (line 65) +* override-session-key: GPG Esoteric Options. + (line 494) +* p12-charset: Input and Output. (line 24) +* passphrase: GPG Esoteric Options. + (line 312) +* passphrase <1>: Invoking gpg-preset-passphrase. + (line 36) +* passphrase-fd: GPG Esoteric Options. + (line 291) +* passphrase-fd <1>: Esoteric Options. (line 136) +* passphrase-file: GPG Esoteric Options. + (line 301) +* passphrase-repeat: GPG Esoteric Options. + (line 283) +* passwd: OpenPGP Key Management. + (line 453) +* passwd <1>: Certificate Management. + (line 110) +* pcsc-driver: Scdaemon Options. (line 150) +* pcsc-shared: Scdaemon Options. (line 144) +* pem: dirmngr-client. (line 58) +* permission-warning: GPG Configuration Options. + (line 820) +* personal-cipher-preferences: OpenPGP Options. (line 46) +* personal-compress-preferences: OpenPGP Options. (line 64) +* personal-digest-preferences: OpenPGP Options. (line 55) +* pgp6: Compliance Options. (line 44) +* pgp7: Compliance Options. (line 54) +* pgp8: Compliance Options. (line 60) +* photo-viewer: GPG Configuration Options. + (line 202) +* pinentry-formatted-passphrase: Agent Options. (line 297) +* pinentry-invisible-char: Agent Options. (line 286) +* pinentry-mode: GPG Esoteric Options. + (line 322) +* pinentry-mode <1>: Esoteric Options. (line 145) +* pinentry-program: Agent Options. (line 310) +* pinentry-timeout: Agent Options. (line 291) +* pinentry-touch-file: Agent Options. (line 323) +* ping: dirmngr-client. (line 69) +* policy-file: Configuration Options. + (line 50) +* prefer-system-dirmngr: Configuration Options. + (line 63) +* preserve-permissions: GPG Esoteric Options. + (line 579) +* preset: Invoking gpg-preset-passphrase. + (line 22) +* primary-keyring: GPG Configuration Options. + (line 243) +* print-md: Operational GPG Commands. + (line 386) +* q: Invoking gpg-connect-agent. + (line 18) +* quick-add-key: OpenPGP Key Management. + (line 69) +* quick-add-uid: OpenPGP Key Management. + (line 420) +* quick-gen-key: OpenPGP Key Management. + (line 10) +* quick-generate-key: OpenPGP Key Management. + (line 10) +* quick-lsign-key: OpenPGP Key Management. + (line 398) +* quick-revoke-sig: OpenPGP Key Management. + (line 435) +* quick-revoke-uid: OpenPGP Key Management. + (line 427) +* quick-set-expire: OpenPGP Key Management. + (line 60) +* quick-set-primary-uid: OpenPGP Key Management. + (line 445) +* quick-sign-key: OpenPGP Key Management. + (line 398) +* quiet: Agent Options. (line 45) +* quiet <1>: GPG Configuration Options. + (line 40) +* quiet <2>: gpgv. (line 35) +* quiet <3>: Invoking gpgconf. (line 117) +* quiet <4>: Invoking gpg-connect-agent. + (line 18) +* quiet <5>: dirmngr-client. (line 48) +* quiet <6>: gpgtar. (line 65) +* quiet <7>: gpg-wks-client. (line 135) +* quiet <8>: gpg-wks-server. (line 81) +* raw-socket: Invoking gpg-connect-agent. + (line 59) +* reader-port: Scdaemon Options. (line 168) +* rebuild-keydb-caches: Operational GPG Commands. + (line 380) +* receive-keys: Operational GPG Commands. + (line 313) +* recipient: GPG Key related Options. + (line 8) +* recipient <1>: Input and Output. (line 46) +* recipient <2>: gpgtar. (line 49) +* recipient-file: GPG Key related Options. + (line 22) +* recursive-resolver: Dirmngr Options. (line 117) +* recv-keys: Operational GPG Commands. + (line 314) +* refresh-keys: Operational GPG Commands. + (line 317) +* reload: Invoking gpgconf. (line 74) +* remove-socketdir: Invoking gpgconf. (line 102) +* request-origin: GPG Esoteric Options. + (line 342) +* request-origin <1>: Esoteric Options. (line 160) +* require-compliance: Compliance Options. (line 77) +* require-compliance <1>: Esoteric Options. (line 27) +* require-compliance <2>: gpgtar. (line 117) +* require-cross-certification: GPG Configuration Options. + (line 839) +* require-secmem: GPG Configuration Options. + (line 834) +* resolver-timeout: Dirmngr Options. (line 120) +* rfc2440: Compliance Options. (line 37) +* rfc4880: Compliance Options. (line 25) +* rfc4880bis: Compliance Options. (line 30) +* run: Invoking gpg-connect-agent. + (line 82) +* s: Dirmngr Options. (line 87) +* s2k-calibration: Agent Options. (line 465) +* s2k-cipher-algo: OpenPGP Options. (line 74) +* s2k-count: Agent Options. (line 472) +* s2k-count <1>: OpenPGP Options. (line 90) +* s2k-digest-algo: OpenPGP Options. (line 79) +* s2k-mode: OpenPGP Options. (line 83) +* scdaemon-program: Agent Options. (line 332) +* search-keys: Operational GPG Commands. + (line 323) +* secret-keyring: GPG Configuration Options. + (line 248) +* send: gpg-wks-client. (line 72) +* send <1>: gpg-wks-server. (line 60) +* send-keys: Operational GPG Commands. + (line 257) +* sender: GPG Key related Options. + (line 81) +* server: Agent Commands. (line 23) +* server <1>: Dirmngr Commands. (line 22) +* server <2>: Operational GPGSM Commands. + (line 24) +* server <3>: Scdaemon Commands. (line 22) +* set-filename: GPG Esoteric Options. + (line 178) +* set-filename <1>: gpgtar. (line 129) +* set-filesize: GPG Esoteric Options. + (line 474) +* set-notation: GPG Esoteric Options. + (line 124) +* set-policy-url: GPG Esoteric Options. + (line 160) +* sh: Agent Options. (line 146) +* sh <1>: Dirmngr Options. (line 87) +* show-keyring: Deprecated Options. (line 16) +* show-keys: Operational GPG Commands. + (line 185) +* show-notation: Deprecated Options. (line 25) +* show-photos: Deprecated Options. (line 8) +* show-policy-url: Deprecated Options. (line 33) +* show-session-key: GPG Esoteric Options. + (line 478) +* shutdown: Dirmngr Commands. (line 58) +* sig-keyserver-url: GPG Esoteric Options. + (line 170) +* sig-notation: GPG Esoteric Options. + (line 124) +* sig-policy-url: GPG Esoteric Options. + (line 160) +* sign: Operational GPG Commands. + (line 8) +* sign <1>: Operational GPGSM Commands. + (line 16) +* sign-key: OpenPGP Key Management. + (line 388) +* skip-crypto: gpgtar. (line 68) +* skip-hidden-recipients: GPG Key related Options. + (line 108) +* skip-verify: GPG Esoteric Options. + (line 442) +* squid-mode: dirmngr-client. (line 101) +* ssh-fingerprint-digest: Agent Options. (line 450) +* standard-resolver: Dirmngr Options. (line 110) +* status-fd: GPG Esoteric Options. + (line 74) +* status-fd <1>: gpgv. (line 52) +* status-fd <2>: Invoking gpgconf. (line 158) +* status-fd <3>: gpgtar. (line 120) +* status-fd <4>: gpg-wks-client. (line 115) +* status-file: GPG Esoteric Options. + (line 78) +* steal-socket: Agent Options. (line 135) +* store: Operational GPG Commands. + (line 55) +* subst: Invoking gpg-connect-agent. + (line 88) +* supervised: Agent Commands. (line 36) +* supervised <1>: Dirmngr Commands. (line 33) +* symmetric: Operational GPG Commands. + (line 42) +* sys-trustlist-name: Agent Options. (line 177) +* tar-args: gpgtar. (line 141) +* textmode: OpenPGP Options. (line 8) +* throw-keyids: GPG Esoteric Options. + (line 257) +* time-only: watchgnupg. (line 30) +* tls-debug: Dirmngr Options. (line 69) +* tofu-default-policy: GPG Configuration Options. + (line 725) +* tofu-policy: Operational GPG Commands. + (line 408) +* trust-model: GPG Configuration Options. + (line 412) +* trust-model:always: GPG Configuration Options. + (line 493) +* trust-model:auto: GPG Configuration Options. + (line 502) +* trust-model:classic: GPG Configuration Options. + (line 420) +* trust-model:direct: GPG Configuration Options. + (line 485) +* trust-model:pgp: GPG Configuration Options. + (line 415) +* trust-model:tofu: GPG Configuration Options. + (line 423) +* trust-model:tofu+pgp: GPG Configuration Options. + (line 473) +* trustdb-name: GPG Configuration Options. + (line 253) +* trusted-key: GPG Configuration Options. + (line 403) +* try-all-secrets: GPG Key related Options. + (line 100) +* try-secret-key: GPG Key related Options. + (line 89) +* ttyname: Agent Options. (line 360) +* ttytype: Agent Options. (line 360) +* ungroup: GPG Key related Options. + (line 70) +* update-trustdb: Operational GPG Commands. + (line 339) +* url: dirmngr-client. (line 94) +* url <1>: dirmngr-client. (line 98) +* use-agent: GPG Configuration Options. + (line 749) +* use-embedded-filename: GPG Esoteric Options. + (line 194) +* use-standard-socket: Agent Options. (line 350) +* use-standard-socket-p: Agent Options. (line 350) +* use-tor: Dirmngr Options. (line 98) +* utf8-strings: GPG Configuration Options. + (line 308) +* utf8-strings <1>: gpgtar. (line 90) +* v: Dirmngr Options. (line 25) +* v <1>: Configuration Options. + (line 38) +* v <2>: Scdaemon Options. (line 35) +* v <3>: dirmngr-client. (line 53) +* validate: dirmngr-client. (line 76) +* validation-model: Certificate Options. (line 73) +* verbose: Agent Options. (line 39) +* verbose <1>: Dirmngr Options. (line 25) +* verbose <2>: GPG Configuration Options. + (line 33) +* verbose <3>: Configuration Options. + (line 38) +* verbose <4>: Scdaemon Options. (line 35) +* verbose <5>: watchgnupg. (line 33) +* verbose <6>: gpgv. (line 30) +* verbose <7>: Invoking gpg-preset-passphrase. + (line 32) +* verbose <8>: Invoking gpg-connect-agent. + (line 14) +* verbose <9>: dirmngr-client. (line 53) +* verbose <10>: gpgtar. (line 61) +* verbose <11>: gpg-check-pattern. (line 53) +* verbose <12>: gpg-wks-client. (line 132) +* verbose <13>: gpg-wks-server. (line 78) +* verify: Operational GPG Commands. + (line 67) +* verify <1>: Operational GPGSM Commands. + (line 20) +* verify-files: Operational GPG Commands. + (line 108) +* verify-options: GPG Configuration Options. + (line 138) +* verify-options:pka-lookups: GPG Configuration Options. + (line 174) +* verify-options:pka-trust-increase: GPG Configuration Options. + (line 181) +* verify-options:show-keyserver-urls: GPG Configuration Options. + (line 157) +* verify-options:show-notations: GPG Configuration Options. + (line 153) +* verify-options:show-photos: GPG Configuration Options. + (line 143) +* verify-options:show-policy-urls: GPG Configuration Options. + (line 147) +* verify-options:show-primary-uid-only: GPG Configuration Options. + (line 169) +* verify-options:show-std-notations: GPG Configuration Options. + (line 153) +* verify-options:show-uid-validity: GPG Configuration Options. + (line 161) +* verify-options:show-unusable-uids: GPG Configuration Options. + (line 165) +* verify-options:show-user-notations: GPG Configuration Options. + (line 153) +* version: Agent Commands. (line 10) +* version <1>: Dirmngr Commands. (line 10) +* version <2>: General GPG Commands. + (line 7) +* version <3>: General GPGSM Commands. + (line 7) +* version <4>: Scdaemon Commands. (line 10) +* version <5>: watchgnupg. (line 36) +* version <6>: dirmngr-client. (line 40) +* version <7>: gpgtar. (line 147) +* version <8>: gpg-wks-client. (line 138) +* version <9>: gpg-wks-server. (line 84) +* warranty: General GPG Commands. + (line 17) +* warranty <1>: General GPGSM Commands. + (line 15) +* weak-digest: GPG Esoteric Options. + (line 411) +* weak-digest <1>: gpgv. (line 90) +* with-colons: GPG Input and Output. + (line 276) +* with-colons <1>: gpg-wks-client. (line 76) +* with-dir: gpg-wks-server. (line 69) +* with-ephemeral-keys: Esoteric Options. (line 52) +* with-file: gpg-wks-server. (line 73) +* with-fingerprint: GPG Input and Output. + (line 296) +* with-icao-spelling: GPG Input and Output. + (line 307) +* with-key-data: GPG Esoteric Options. + (line 446) +* with-key-data <1>: Input and Output. (line 54) +* with-key-origin: GPG Input and Output. + (line 315) +* with-keygrip: GPG Input and Output. + (line 311) +* with-log: gpgtar. (line 124) +* with-secret: GPG Input and Output. + (line 326) +* with-secret <1>: Input and Output. (line 78) +* with-subkey-fingerprint: GPG Input and Output. + (line 300) +* with-validation: Input and Output. (line 60) +* with-wkd-hash: GPG Input and Output. + (line 321) +* xauthority: Agent Options. (line 360) +* yes: GPG Configuration Options. + (line 63) +* yes <1>: gpgtar. (line 108) + + +File: gnupg.info, Node: Environment Index, Next: Index, Prev: Option Index, Up: Top + +Environment Variable and File Index +*********************************** + + +* Menu: + +* .gpg-v21-migrated: GPG Configuration. (line 77) +* ~/.gnupg: GPG Configuration. (line 27) +* ASSUAN_DEBUG: Scdaemon Options. (line 122) +* COLUMNS: GPG Configuration. (line 118) +* com-certs.pem: GPGSM Configuration. (line 84) +* dirmngr.conf: Dirmngr Configuration. + (line 12) +* DISPLAY: GPGSM OPTION. (line 21) +* GNUPGHOME: Agent Options. (line 17) +* GNUPGHOME <1>: GPG Configuration Options. + (line 260) +* GNUPGHOME <2>: GPG Configuration. (line 106) +* GNUPGHOME <3>: Configuration Options. + (line 16) +* GNUPGHOME <4>: Scdaemon Options. (line 13) +* GNUPGHOME <5>: gpgv. (line 69) +* GNUPGHOME <6>: Invoking gpgconf. (line 120) +* GNUPGHOME <7>: Invoking gpg-connect-agent. + (line 21) +* GNUPG_BUILD_ROOT: GPG Configuration. (line 130) +* GNUPG_EXEC_DEBUG_FLAGS: GPG Configuration. (line 135) +* gpg-agent.conf: Agent Configuration. (line 11) +* gpg.conf: GPG Configuration. (line 11) +* gpgconf.ctl: Agent Options. (line 28) +* gpgconf.ctl <1>: GPG Configuration Options. + (line 271) +* gpgconf.ctl <2>: Configuration Options. + (line 27) +* gpgconf.ctl <3>: Scdaemon Options. (line 24) +* gpgconf.ctl <4>: gpgv. (line 80) +* gpgconf.ctl <5>: Invoking gpgconf. (line 131) +* gpgconf.ctl <6>: Invoking gpg-connect-agent. + (line 32) +* gpgsm.conf: GPGSM Configuration. (line 11) +* GPG_TTY: Invoking GPG-AGENT. (line 22) +* GPG_TTY <1>: GPGSM OPTION. (line 23) +* help.txt: GPGSM Configuration. (line 72) +* HKCU\Software\GNU\GnuPG:DefaultLogFile: Agent Options. (line 159) +* HKCU\Software\GNU\GnuPG:HomeDir: Agent Options. (line 17) +* HKCU\Software\GNU\GnuPG:HomeDir <1>: GPG Configuration Options. + (line 260) +* HKCU\Software\GNU\GnuPG:HomeDir <2>: Configuration Options. + (line 16) +* HKCU\Software\GNU\GnuPG:HomeDir <3>: Scdaemon Options. (line 13) +* HKCU\Software\GNU\GnuPG:HomeDir <4>: gpgv. (line 69) +* HKCU\Software\GNU\GnuPG:HomeDir <5>: Invoking gpgconf. (line 120) +* HKCU\Software\GNU\GnuPG:HomeDir <6>: Invoking gpg-connect-agent. + (line 21) +* HOME: GPG Configuration. (line 103) +* http_proxy: Dirmngr Options. (line 240) +* LANGUAGE: GPG Configuration. (line 121) +* LC_CTYPE: GPGSM OPTION. (line 27) +* LC_MESSAGES: GPGSM OPTION. (line 29) +* LINES: GPG Configuration. (line 118) +* openpgp-revocs.d: GPG Configuration. (line 91) +* PATH: GPG Configuration Options. + (line 225) +* PINENTRY_USER_DATA: GPG Configuration. (line 113) +* PINENTRY_USER_DATA <1>: GPGSM OPTION. (line 33) +* policies.txt: GPGSM Configuration. (line 18) +* private-keys-v1.d: Agent Configuration. (line 106) +* pubring.gpg: GPG Configuration. (line 32) +* pubring.kbx: GPG Configuration. (line 50) +* pubring.kbx <1>: GPGSM Configuration. (line 100) +* qualified.txt: GPGSM Configuration. (line 33) +* random_seed: GPG Configuration. (line 88) +* random_seed <1>: GPGSM Configuration. (line 106) +* S.gpg-agent: GPGSM Configuration. (line 111) +* secring.gpg: GPG Configuration. (line 69) +* SHELL: Agent Options. (line 146) +* sshcontrol: Agent Configuration. (line 76) +* TERM: GPGSM OPTION. (line 25) +* trustdb.gpg: GPG Configuration. (line 80) +* trustlist.txt: Agent Configuration. (line 20) +* XAUTHORITY: GPGSM OPTION. (line 31) + + +File: gnupg.info, Node: Index, Prev: Environment Index, Up: Top + +Index +***** + + +* Menu: + +* command options: Invoking GPG-AGENT. (line 6) +* command options <1>: Invoking DIRMNGR. (line 6) +* command options <2>: Invoking GPG. (line 6) +* command options <3>: Invoking GPGSM. (line 6) +* command options <4>: Invoking SCDAEMON. (line 6) +* contributors: Contributors. (line 6) +* DIRMNGR command options: Invoking DIRMNGR. (line 6) +* GPG command options: Invoking GPG. (line 6) +* GPG-AGENT command options: Invoking GPG-AGENT. (line 6) +* gpgconf.conf: Files used by gpgconf. + (line 7) +* GPGSM command options: Invoking GPGSM. (line 6) +* options, DIRMNGR command: Invoking DIRMNGR. (line 6) +* options, GPG command: Invoking GPG. (line 6) +* options, GPG-AGENT command: Invoking GPG-AGENT. (line 6) +* options, GPGSM command: Invoking GPGSM. (line 6) +* options, SCDAEMON command: Invoking SCDAEMON. (line 6) +* relax: Agent Configuration. (line 64) +* scd-event: Scdaemon Configuration. + (line 18) +* SCDAEMON command options: Invoking SCDAEMON. (line 6) +* scdaemon.conf: Scdaemon Configuration. + (line 11) +* SIGHUP: Agent Signals. (line 12) +* SIGHUP <1>: Dirmngr Signals. (line 12) +* SIGINT: Agent Signals. (line 31) +* SIGINT <1>: Dirmngr Signals. (line 26) +* SIGTERM: Agent Signals. (line 26) +* SIGTERM <1>: Dirmngr Signals. (line 19) +* SIGUSR1: Agent Signals. (line 34) +* SIGUSR1 <1>: Dirmngr Signals. (line 29) +* SIGUSR2: Agent Signals. (line 37) +* swdb.lst: Files used by gpgconf. + (line 14) +* trust values: Trust Values. (line 6) + |