GnuPG 速查表

gpg 命令承担几项不同的工作：

管理 OpenPGP 密钥、向接收者加密数据；
为密钥持有者解密数据；
创建或验证签名。

GPG 最常见的用途包括：使用开发者的公钥验证软件发布版本随附的 .asc 文件，或使用私钥签署 Git 提交和标签。

安装 #

# archlinux
# gnupg and pinentry should already be installed on your system as it is a dependency of pacman.

# debian/ubuntu
sudo apt install gnupg pinentry-curses pinentry-gtk-2

# redhat/fedora/centos
sudo dnf install gnupg2 pinentry  # fedora/rhel 8+
sudo yum install gnupg2 pinentry  # rhel 7

# mac
brew install gnupg pinentry-mac

GPG 使用名为 pinentry 的程序，在解锁私钥时提示输入口令。其设计原则是分离：pinentry 作为独立进程运行，因此请求解密的应用程序永远看不到口令，只有 GPG 代理可以看到。这在用户与加密操作之间提供了受信任的路径。存在多个变体：pinentry-curses（CLI）、pinentry-gtk（GTK）、pinentry-qt（Qt）、pinentry-mac（macOS 原生）等。可以在 ~/.gnupg/gpg-agent.conf 中使用 pinentry-program 指令配置所用变体。

密钥管理 #

“Armor”是二进制数据的 base64 版本，便于复制和粘贴。

# Generate a new key 
gpg --full-generate-key

# import a public key so GPG knows who he is
gpg --import public-or-private-key.asc

# export a public key
gpg --export you@example.com            # (binary key to stdout)
gpg --export --armor you@example.com    # (ASCII armor to be copied around)

# Export a secret key (you know the danger)
gpg --export-secret-keys you@example.com            # (binary key to stdout)
gpg --armor --export-secret-keys you@example.com    # (ASCII armor to be copied around)

# List locals keys
gpg --list-keys                             # public
gpg --list-secret-keys --keyid-format=long  # public-secret key pair

# Edit key metadata, expiration, trust, or subkeys
gpg --edit-key alice@example.com

# Delete a public key from your local keyring
gpg --delete-key alice@example.com

# When removing one of your own identities,
# delete the secret key first, then the public key
gpg --delete-secret-key you@example.com
gpg --delete-key you@example.com

# Show the fingerprint of a key
# the short key ID is not enough for identity verification:
gpg --fingerprint alice@example.com

加密/解密 #

# Encrypt a file for one recipient
# writes secret.txt.gpg by default
gpg --encrypt --recipient alice@example.com 

# Encrypt a file for multiple recipients
# every intended reader must be listed
gpg --encrypt \
  --recipient alice@example.com \
  --recipient bob@example.com \
  report.pdf

# Decrypt a file to stdout
gpg --decrypt secret.txt.gpg

# Decrypt to a specific output path
gpg --output secret.txt --decrypt secret.txt.gpg

签名和验证 #

# Create a detached signature
# use this when the receiver already has the original file
# writes release.tar.gz.asc
gpg --detach-sign --armor release.tar.gz

# Verify a detached signature
gpg --verify release.tar.gz.asc release.tar.gz

# Create a cleartext signature
# useful for text that should remain human-readable
gpg --clearsign notes.txt

# Verify a clearsigned file
gpg --verify notes.txt.asc

其他维护命令 #


# Reload the agent after changing configuration
gpgconf --kill gpg-agent

与标准输入和输出结合使用 #

# Encrypt piped data and emit ASCII armor
printf '%s\n' 'hello' | gpg --armor --encrypt --recipient alice@example.com

# Sign piped data without creating an input file
printf '%s\n' 'release approved' | gpg --clearsign