GnuPG 速查表

gpg 命令負責幾項不同工作：

管理 OpenPGP 金鑰，並對資料加密給收件者；
為金鑰持有者解密資料；以及
建立或驗證簽章。

GPG 最常見的用途包括使用開發者的公開金鑰，驗證軟體發行版附帶的 .asc 檔案，或使用祕密金鑰簽署 Git 提交與標籤。

安裝 #

# archlinux
# gnupg and pinentry should already be installed on your system as it is a dependency of pacman.

# debian/ubuntu
sudo apt install gnupg pinentry-curses pinentry-gtk-2

# redhat/fedora/centos
sudo dnf install gnupg2 pinentry  # fedora/rhel 8+
sudo yum install gnupg2 pinentry  # rhel 7

# mac
brew install gnupg pinentry-mac

GPG 使用名為 pinentry 的程式，在解鎖私密金鑰時提示密碼片語。設計原則是分離：pinentry 以獨立程序執行，因此要求解密的應用程式永遠看不到你的密碼片語，只有 GPG agent 能看見。這在你與加密作業之間提供受信任的路徑。存在多種變體：pinentry-curses（CLI）、pinentry-gtk（GTK）、pinentry-qt（Qt）、pinentry-mac（macOS 原生）及其他變體。你可以在 ~/.gnupg/gpg-agent.conf 中使用 pinentry-program 指示詞設定要使用的變體。

金鑰管理 #

「Armor」是二進位資料的 base64 版本，方便複製與貼上。

# Generate a new key 
gpg --full-generate-key

# import a public key so GPG knows who he is
gpg --import public-or-private-key.asc

# export a public key
gpg --export you@example.com            # (binary key to stdout)
gpg --export --armor you@example.com    # (ASCII armor to be copied around)

# Export a secret key (you know the danger)
gpg --export-secret-keys you@example.com            # (binary key to stdout)
gpg --armor --export-secret-keys you@example.com    # (ASCII armor to be copied around)

# List locals keys
gpg --list-keys                             # public
gpg --list-secret-keys --keyid-format=long  # public-secret key pair

# Edit key metadata, expiration, trust, or subkeys
gpg --edit-key alice@example.com

# Delete a public key from your local keyring
gpg --delete-key alice@example.com

# When removing one of your own identities,
# delete the secret key first, then the public key
gpg --delete-secret-key you@example.com
gpg --delete-key you@example.com

# Show the fingerprint of a key
# the short key ID is not enough for identity verification:
gpg --fingerprint alice@example.com

加密／解密 #

# Encrypt a file for one recipient
# writes secret.txt.gpg by default
gpg --encrypt --recipient alice@example.com 

# Encrypt a file for multiple recipients
# every intended reader must be listed
gpg --encrypt \
  --recipient alice@example.com \
  --recipient bob@example.com \
  report.pdf

# Decrypt a file to stdout
gpg --decrypt secret.txt.gpg

# Decrypt to a specific output path
gpg --output secret.txt --decrypt secret.txt.gpg

簽署與驗證 #

# Create a detached signature
# use this when the receiver already has the original file
# writes release.tar.gz.asc
gpg --detach-sign --armor release.tar.gz

# Verify a detached signature
gpg --verify release.tar.gz.asc release.tar.gz

# Create a cleartext signature
# useful for text that should remain human-readable
gpg --clearsign notes.txt

# Verify a clearsigned file
gpg --verify notes.txt.asc

其他維護命令 #


# Reload the agent after changing configuration
gpgconf --kill gpg-agent

搭配標準輸入與輸出使用 #

# Encrypt piped data and emit ASCII armor
printf '%s\n' 'hello' | gpg --armor --encrypt --recipient alice@example.com

# Sign piped data without creating an input file
printf '%s\n' 'release approved' | gpg --clearsign