extend documentation

2026-07-26 03:01:52 +02:00
parent 40b6cd8bb5
commit 74aef29146
8 changed files with 196 additions and 1 deletions
@@ -0,0 +1,61 @@
+.docname {GnuPG}
+.include {docs}
+
+Make sure the package `gnupg` is installed
+
+## Configuration
+
+GPG configuration is stored in `~/.gnupg`. Default configuration file is `~/.gnupg/gpg.conf`.
+
+Enable the gpg agent by adding `~/.gnupg/gpg-agent.conf` with content
+
+```txt
+default-cache-ttl 3600
+pinentry-program
+```
+
+Select the GPG Keyserver by adding `~/.gnupg/gpg-dirmngr.conf` with content
+```txt
+keyserver hkps://keys.openpgp.org
+```
+
+## List Keys
+
+List known public keys with `gpg --list-keys` .br
+List known private keys with `gpg --list-secret-keys`
+
+## Backup Keys
+
+Export your secret key with `gpg --export-secret-keys --armor --output <private-key.asc> <user id>`
+
+If you need to export a subkey only, list subkeys first with `gpg --list-secret-keys --with-subkey-fingerprint`,
+then export the subkey with `gpg --armor --export-secret-subkeys --output <subkey.asc> <subkey-id>!`.
+
+The revocation certificate can be backed up with `gpg --gen-revoke --armor --output <revcert.asc> <user id>`
+
+## Import a Backed Up Key
+
+Import your key with `gpg --import <private-key.asc>`
+
+## Modify Trust
+
+Edit the key with `gpg --edit-key <user-id>` and choose `trust`.
+
+## Edit Expiry Date
+
+Never delete an expired key, edit the expiry date with `gpg --edit-key <user-id>` and choose `expiry`.
+
+## Create a New Key
+
+Run `gpg --full-generate-key --expert` to create the primary key. Choose
+
+- Key Type: `ECC (set your own capabilities)`
+- This key should only have the `Certify` capability
+
+Now edit the key to add subkeys `gpg --export --edit-key <user-id>`
+
+- Encryption Subkey: `addkey` choose `ECC (encrypt only)`
+- Signing Subkey: `addkey` choose `ECC (sign only)`
+- Authentication Subkey: `addkey` choose `ECC (set your own capabilities)`.
+  Only the Authenticate capability should be enabled
+- `save` to save the changes