aboutsummaryrefslogtreecommitdiffstats
path: root/doc/gpg.texi (follow)
Commit message (Collapse)AuthorAgeFilesLines
* gpg: add --passphrase-env VARNAME to read passphrase from environmentdkg/passphrase-envDaniel Kahn Gillmor2018-09-231-1/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keydb.h: declare set_passphrase_from_environment_variable() * g10/passphrase.c: set_passphrase_from_environment_variable() new function * g10/gpg.c: add new --passphrase-env argument, handle it. -- There are problems or difficulties (to varying degrees) with all of the techniques available for sending a passphrase directly to the GnuPG process when --pinentry-mode=loopback: * Passphrases on the command line often leak into the process table. * Passphrases in a file often leak into the disk. * Using an extra file descriptor to send a passphrase works well on platforms that make it easy to allocate and use extra file descriptors, but is pretty awkward on platforms that don't facilitate this. So this patch adds a new form of passphrase-passing, using an environment variable. In POSIX shell, this looks like (for example): mypass="IUuKctdEhH8' gpg --batch --pinentry-mode=loopback\ --passphrase-env=mypass --decrypt < message.txt Hopefully, this is easier to use than --passphrase-fd on platforms or language toolkits that don't facilitate file descriptor manipulation. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* doc: Minor additions to the gpg man pageWerner Koch2018-08-291-4/+10
| | | | | | | | | -- Includes a fix for GnuPG-bug-id: 3906 Signed-off-by: Werner Koch <[email protected]>
* doc: Show how to list envvars send to gpg-agent.Werner Koch2018-08-291-0/+9
| | | | | | | -- GnuPG-bug: 3353 Signed-off-by: Werner Koch <[email protected]>
* gpg: New option --known-notation.Werner Koch2018-08-291-0/+7
| | | | | | | | | | | | | | * g10/gpg.c (oKnownNotation): New const. (opts): Add option --known-notation. (main): Set option. * g10/parse-packet.c (known_notations_list): New local var. (register_known_notation): New. (can_handle_critical_notation): Rewrite to handle the new feature. Also print the name of unknown notations in verbose mode. -- GnuPG-bug-id: 4060 Signed-off-by: Werner Koch <[email protected]>
* gpg: Use 128 MiB as default AEAD chunk size.Werner Koch2018-07-241-4/+10
| | | | | | | | | * g10/gpg.c (oDebugAllowLargeChunks): New. (opts): New option --debug-allow-large-chunks. (main): Implement that option. -- Signed-off-by: Werner Koch <[email protected]>
* gpg: Add new usage option for drop-subkey filters.Daniel Kahn Gillmor2018-06-121-0/+5
| | | | | | | | | | | | | | * g10/import.c (impex_filter_getval): Add new "usage" property for drop-subkey filter. -- For example, this permits extraction of only encryption-capable subkeys like so: gpg --export-filter 'drop-subkey=usage !~ e' --export $FPR GnuPG-Bug-id: 4019 Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* gpg: Set some list options with --show-keysWerner Koch2018-06-111-3/+5
| | | | | | | | | | | | * g10/gpg.c (main): Set some list options. -- The new command --show-keys is commonly used to check the content of a file with keys. In this case it can be expected that all included subkeys and uids are of interested, even when they are already expired or have been revoked. Signed-off-by: Werner Koch <[email protected]>
* doc: Typo fixesWerner Koch2018-06-061-2/+2
| | | | | | | -- Reported-by: Claus Assmann <[email protected]> Signed-off-by: Werner Koch <[email protected]>
* gpg: New command --show-keys.Werner Koch2018-06-061-1/+10
| | | | | | | | | | | | | | | | | | | * g10/gpg.c (aShowKeys): New const. (opts): New command --show-keys. (main): Implement command. * g10/import.c (import_keys_internal): Don't print stats in show-only mode. (import_one): Be silent in show-only mode. -- Using --import --import-options show-only to look at a key is too cumbersome. Provide this shortcut and also remove some diagnostic cruft in this case. Signed-off-by: Werner Koch <[email protected]>
* gpg: Ignore the multiple message override options.Werner Koch2018-05-301-10/+1
| | | | | | | | | | | | | | | | | * g10/gpg.c (oAllowMultisigVerification) (oAllowMultipleMessages, oNoAllowMultipleMessages): Remove. (opts): Turn --allow-multisig-verification, --allow-multiple-messages and --no-allow-multiple-messages into NOPs * g10/options.h (struct opt): Remove flags.allow_multiple_messages. * g10/mainproc.c (proc_plaintext): Assume allow_multiple_messages is false. -- These options are very old compatibility hacks and should not be used anymore. We keep them as dummy options in case someone has them in the conf file. Signed-off-by: Werner Koch <[email protected]>
* gpg: Remove PGP6 compliance mode.Werner Koch2018-05-291-13/+6
| | | | | | | | * g10/gpg.c: Make --pgp6 an alias for --pgp7. * common/compliance.h (gnupg_compliance_mode): Remove CO_PGP6. * g10/options.h (PGP6): Remove. Adjust all users. Signed-off-by: Werner Koch <[email protected]>
* gpg: Remove MDC optionsWerner Koch2018-05-291-14/+15
| | | | | | | | | | | | | | | | * g10/gpg.c: Tuen options --force-mdc, --no-force-mdc, --disable-mdc and --no-disable-mdc into NOPs. * g10/encrypt.c (use_mdc): Simplify. MDC is now almost always used. (use_aead): Ignore MDC options. Print warning for missing MDC feature flags. * g10/pkclist.c (warn_missing_mdc_from_pklist): Rename to ... (warn_missing_aead_from_pklist): this and adjust. -- The MDC is now always used except with --rfc2440 which will lead to a a big fat warning. Signed-off-by: Werner Koch <[email protected]>
* gpg: Hard fail on a missing MDC even for legacy algorithms.Werner Koch2018-05-151-4/+5
| | | | | | | | * g10/mainproc.c (proc_encrypted): Require an MDC or AEAD * tests/openpgp/defs.scm (create-gpghome): Use --ignore-mdc-error to allow testing with the current files. Signed-off-by: Werner Koch <[email protected]>
* gpg: Turn --no-mdc-warn into a NOP.Werner Koch2018-05-151-4/+0
| | | | | | | | | | | | | | | * g10/gpg.c (oNoMDCWarn): Remove. (opts): Make --no-mdc-warn a NOP. (main): Don't set var. * g10/options.h (struct opt): Remove 'no_mdc_var'. * g10/cipher-cfb.c (write_header): Assume opt.no_mdc_warn is false. * g10/mainproc.c (proc_encrypted): Ditto. -- Users should not be allowed to suppress the warning that they are shooting into their foot. Signed-off-by: Werner Koch <[email protected]>
* Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2018-05-131-33/+27
|\ | | | | | | | | | | | | | | | | | | -- Resolved Conflicts: NEWS - removed configure.ac - removed Signed-off-by: Werner Koch <[email protected]>
| * doc: Update description of displayed trust values.Ineiev2018-05-071-31/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * doc/trust-values.texi: New file. * doc/Makefile.am (EXTRA_DIST): Add trust-values.texi. * doc/gnupg.texi (Trust Values): New chapter. * doc/gpg.texi (OpenPGP Key Management): Update the description of how trust values are displayed, replace table with a reference to Trust Values. * doc/gpg.texi (GPG Examples): Add @mansect trust values. -- Signed-off-by: Ineiev <[email protected]>
| * doc: Update NEWS and add an example to gpg.texi.Werner Koch2018-04-231-1/+7
| | | | | | | | --
| * gpg: New option --no-symkey-cache.Werner Koch2018-04-111-1/+10
| | | | | | | | | | | | | | | | | | | | * g10/gpg.c (oNoSymkeyCache): New. (opts): Add that option. (main): Set var. * g10/options.h (struct opt): New field no_symkey_cache. * g10/passphrase.c (passphrase_to_dek): Implement that feature. Signed-off-by: Werner Koch <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2018-04-101-4/+18
|\| | | | | | | | | | | | | | | | | -- Fixed conflicts: NEWS - keep master configure.ac - merge g10/card-util.c - mostly 2.2 g10/sig-check.c - 2.2
| * doc: Typo fix in gpg.texiWerner Koch2018-04-091-1/+1
| | | | | | | | | | | | -- Reported-by: Cody Brownstein
| * doc: Add an example for --default-new-key-algoWerner Koch2018-04-091-4/+9
| | | | | | | | --
| * doc: Document --key-edit:change-usageWerner Koch2018-04-091-0/+9
| | | | | | | | | | | | | | | | * g10/keyedit.c (menu_changeusage): Make strings translatable. -- GnuPG-bug-id: 3816 Signed-off-by: Werner Koch <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2018-03-271-3/+14
|\|
| * gpg,sm: New option --request-origin.Werner Koch2018-03-231-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (oRequestOrigin): New const. (opts): New option --request-origin. (main): Parse that option. * g10/options.h (struct opt): Add field request_origin. * g10/call-agent.c (start_agent): Send option to the agent. * sm/gpgsm.c (oRequestOrigin): New const. (opts): New option --request-origin. (main): Parse that option. * sm/gpgsm.h (struct opt): Add field request_origin. * sm/call-agent.c (start_agent): Send option to the agent. Signed-off-by: Werner Koch <[email protected]>
| * gpg: Implement --dry-run for --passwd.Werner Koch2018-03-221-1/+3
| | | | | | | | | | | | * g10/keyedit.c (change_passphrase): Take care of --dry-run. Signed-off-by: Werner Koch <[email protected]>
| * doc: man page grammarBen McGinnes2018-03-071-2/+2
| | | | | | | | | | | | -- Fixed two grammatical errors: their vs. there and oneself vs. one (one's self would still be too stilted).
* | Merge branch 'STABLE-BRANCH-2-2'Werner Koch2018-02-221-0/+13
|\|
| * doc: Add extra hint on unattended use of gpg.Werner Koch2018-02-211-0/+13
| | | | | | | | --
* | Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2018-01-251-6/+13
|\| | | | | | | Signed-off-by: Werner Koch <[email protected]>
| * doc: Note --quick-gen-key as an alias for --quick-generate-keyWerner Koch2018-01-251-0/+2
| | | | | | | | --
| * doc: Note pinentry-mode for passphrase optsAndre Heinecke2018-01-091-6/+11
| | | | | | | | | | | | | | * doc/gpg.texi (--passphrase, --passphrase-file, --passphrase-fd): Note that pinentry-mode needs to be loopback. Signed-off-by: Andre Heinecke <[email protected]>
| * doc: clarify that --encrypt refers to public key encryptionDaniel Kahn Gillmor2017-11-301-5/+7
| | | | | | | | | | | | | | | | | | | | | | -- A simple read of gpg(1) is ambiguous about whether --encrypt could be for either symmetric or pubkey encryption. Closer inference suggests that --encrypt is about pubkey encryption only. Make that clearer on a first read. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* | gpg: New maintainer option --debug-set-iobuf-size.Werner Koch2018-01-241-0/+6
| | | | | | | | | | | | | | | | | | | | * g10/gpg.c (opts): Add new option. (opt_set_iobuf_size): New var. (set_debug): Set the option. * tests/openpgp/armor.scm: Use this option to revert the buffer size to the one which used to exhibit the tested bugs. Signed-off-by: Werner Koch <[email protected]>
* | gpg: New option --chunk-size.Werner Koch2018-01-231-7/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (opts): New option --chunk-size. (oChunkSize): New const. (build_list_aead_test_algo, build_list_aead_algo_name): New. (my_strusage): List AEAD algos. (main): Implement --chunk-size.. * g10/options.h (struct opt): Add field 'chunk_size'. (DBG_IPC): Remove duplicated macro. * g10/main.h (DEFAULT_AEAD_ALGO): Depend on Libgcrypt version. * g10/misc.c (openpgp_aead_test_algo): Ditto. * g10/cipher-aead.c: Silence if not in debug mode. * g10/decrypt-data.c: Ditto. -- And that new option immediatley revealed bugs in our chunking code :-(.
* | doc: clarify that --encrypt refers to public key encryptionDaniel Kahn Gillmor2017-11-211-5/+7
|/ | | | | | | | | | | -- A simple read of gpg(1) is ambiguous about whether --encrypt could be for either symmetric or pubkey encryption. Closer inference suggests that --encrypt is about pubkey encryption only. Make that clearer on a first read. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* gpg: Print sec/sbb with --import-option import-show or show-only.Werner Koch2017-10-191-1/+2
| | | | | | | | | | | | | * g10/import.c (import_one): Pass FROM_SK to list_keyblock_direct. -- Note that this will likely add the suffix '#' top "sec" because the secret key has not yet (or will not be) imported. If the secret key already exists locally another suffix might be printed. The upshot is that the suffix has no usefulness. GnuPG-bug-id: 3431 Signed-off-by: Werner Koch <[email protected]>
* doc: Make --check-sigs more prominent.Werner Koch2017-09-271-39/+42
| | | | | | | | | | | -- It seems people are using --list-sigs instead of --check-sigs and do not realize that the signatures are not checked at all. We better highlight the use of --check-sigs to avoid this UI problem. Suggested-by: Andrew Gallagher Signed-off-by: Werner Koch <[email protected]>
* gpg: default to --no-auto-key-retrieve.Daniel Kahn Gillmor2017-08-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (main): remove KEYSERVER_AUTO_KEY_RETRIEVE from the default keyserver options. * doc/gpg.texi: document this change. -- This is a partial reversion of 7e1fe791d188b078398bf83c9af992cb1bd2a4b3. Werner and i discussed it earlier today, and came to the conclusion that: * the risk of metadata leakage represented by a default --auto-key-retrieve, both in e-mail (as a "web bug") and in other contexts where GnuPG is used to verified signatures, is quite high. * the advantages of --auto-key-retrieve (in terms of signature verification) can sometimes be achieved in other ways, such as when a signed message includes a copy of its own key. * when those other ways are not useful, a graphical, user-facing application can still offer the user the opportunity to choose to fetch the key; or it can apply its own policy about when to set --auto-key-retrieve, without needing to affect the defaults. Note that --auto-key-retrieve is specifically about signature verification. Decisions about how and whether to look up a key during message encryption are governed by --auto-key-locate. This change does not touch the --auto-key-locate default of "local,wkd". The user deliberately asking gpg to encrypt to an e-mail address is a different scenario than having an incoming e-mail trigger a potentially unique network request. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* gpg: Add option '--disable-dirmngr'.Justus Winter2017-08-081-0/+3
| | | | | | | | | | | | | | * doc/gpg.texi: Document new option. * g10/call-dirmngr.c (create_context): Fail if option is given. * g10/gpg.c (cmd_and_opt_values): New value. (opts): New option. (gpgconf_list): Add new option. (main): Handle new option. * g10/options.h (struct opt): New field 'disable_dirmngr'. * tools/gpgconf-comp.c (gc_options_gpg): New option. GnuPG-bug-id: 3334 Signed-off-by: Justus Winter <[email protected]>
* Fix spelling.Daniel Kahn Gillmor2017-08-071-1/+1
| | | | | | * doc/gpg.texi: s/occured/occurred/ Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* gpg: Default to --auto-key-locate "local,wkd" and --auto-key-retrieve.Werner Koch2017-08-041-9/+13
| | | | | | | | | | | | * g10/gpg.c (main): Add KEYSERVER_AUTO_KEY_RETRIEVE to the default keyserver options. Set the default for --auto-key-locate to "local,wkd". Reset that default iff --auto-key-locate has been given in the option file or in the commandline. * g10/getkey.c (parse_auto_key_locate): Work on a copy of the arg. -- GnuPG-bug-id: 3324 Signed-off-by: Werner Koch <[email protected]>
* gpg: New import option show-only.Werner Koch2017-08-041-1/+3
| | | | | | | | | | | | | * g10/options.h (IMPORT_DRY_RUN): New. * g10/import.c (parse_import_options): Add "show-only". (import_one): use that as alternative to opt.dry_run. -- This is just a convenience thing for --import-options import-show --dry-run Signed-off-by: Werner Koch <[email protected]>
* doc: Use @var for meta variables in gpg.texiWerner Koch2017-07-241-177/+179
| | | | | | | | -- This results in more standrard man pages. Signed-off-by: Werner Koch <[email protected]>
* gpg: Extend --key-origin to take an optional URL arg.Werner Koch2017-07-241-3/+5
| | | | | | | | | | | | | | | | * g10/getkey.c (parse_key_origin): Parse appended URL. * g10/options.h (struct opt): Add field 'key_origin_url'. * g10/gpg.c (main) <aImport>: Pass that option to import_keys. * g10/import.c (apply_meta_data): Extend for file and url. * g10/keyserver.c (keyserver_fetch): Pass the url to import_keys_es_stream. -- Example: gpg --key-origin url,myscheme://bla --import FILE Signed-off-by: Werner Koch <[email protected]>
* doc: Revert the bug reporting address to bugs.gnupg.orgWerner Koch2017-07-241-1/+1
| | | | | | | | | | | | | | -- dev.gnupg org is the development platform but the canonical bug address is and has always been bugs.gnupg.org. We should keep on using this address for the case that we switch the tracker again or split it off the development system. That is also the reason why we should keep on communicating a plain bug number without the 'T' prefix. Signed-off-by: Werner Koch <[email protected]>
* gpg: Extend --quick-set-expire to allow subkey expiration setting.Werner Koch2017-07-211-3/+9
| | | | | | | | | * g10/keyedit.c (keyedit_quick_set_expire): Add new arg subkeyfprs. (menu_expire): Rename arg force_mainkey to unattended and allow unattended changing of subkey expiration. * g10/gpg.c (main): Extend --quick-set-expire. Signed-off-by: Werner Koch <[email protected]>
* doc: Clarify wording of export-attributes.Marcus Brinkmann2017-07-201-3/+4
| | | | | | | * doc/gpg.texi: Clarify wording of export-attributes. Signed-off-by: Marcus Brinkmann <[email protected]> GnuPG-bug-id: 2228
* gpg: New option --with-key-origin.Werner Koch2017-07-201-0/+7
| | | | | | | | | | | | * g10/getkey.c (parse_key_origin): Factor list out as ... (key_origin_list): new struct. (key_origin_string): New. * g10/gpg.c (oWithKeyOrigin): New const. (opts): New option --with-key-origin. (main): Implement option. * g10/options.h (struct opt): New flag with_key_origin. * g10/keylist.c (list_keyblock_print): Print key origin info. (list_keyblock_colon): Ditto.
* gpg: New option --key-origin.Werner Koch2017-07-131-0/+7
| | | | | | | | | | | | | | | * g10/keydb.h (KEYORG_): Rename to KEYORG_. * g10/packet.h (PKT_user_id): Rename field keysrc to keyorg. Adjust users. (PKT_public_key): Ditto. (PKT_ring_trust): Ditto. * g10/options.h (struct opt): Add field key_origin. * g10/getkey.c (parse_key_origin): New. * g10/gpg.c (oKeyOrigin): New. (opts): Add "keys-origin". (main): Set option. Signed-off-by: Werner Koch <[email protected]>
* doc: Improve TOFU documentation.Neal H. Walfield2017-07-061-4/+8
| | | | | | | * doc/gpg.texi: Improve TOFU documentation. Signed-off-by: Neal H. Walfield <[email protected]> Suggested-by: Teemu Likonen <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-15 09:15:25 +0000