{"id":18733948,"url":"https://github.com/mgoltzsche/gpg-helper","last_synced_at":"2025-11-14T18:30:15.602Z","repository":{"id":101283010,"uuid":"89154190","full_name":"mgoltzsche/gpg-helper","owner":"mgoltzsche","description":"Letters instead of postcards! This little GnuPG 2 wrapper script helps you use PGP","archived":false,"fork":false,"pushed_at":"2024-05-16T01:26:54.000Z","size":17,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-12-28T15:49:55.609Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mgoltzsche.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-04-23T15:59:50.000Z","updated_at":"2024-05-16T01:26:57.000Z","dependencies_parsed_at":"2023-09-20T20:35:09.978Z","dependency_job_id":null,"html_url":"https://github.com/mgoltzsche/gpg-helper","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgoltzsche%2Fgpg-helper","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgoltzsche%2Fgpg-helper/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgoltzsche%2Fgpg-helper/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mgoltzsche%2Fgpg-helper/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mgoltzsche","download_url":"https://codeload.github.com/mgoltzsche/gpg-helper/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239605080,"owners_count":19667004,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-07T15:11:52.309Z","updated_at":"2025-11-14T18:30:15.537Z","avatar_url":"https://github.com/mgoltzsche.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# gpg-helper\nLetters instead of postcards! If you send an email you have to consider it a postcard unless it is encrypted. This can be done with Pretty Good Privacy (PGP).\nEmails can easily be en/decrypted using Thunderbird's EnigMail plugin. The keys can be managed using this GnuPG (gpg2) wrapper shell script.\nIt provides human readable parameters and a help text that covers common workflows.\nFurthermore it improves security by generating a secure configuration using best practices.\n\n## Requirements\nGnuPG \u003e=2.1.11\n\n## GnuPG configuration changes\nTo improve security the script overwrites the local gpg configuration in GNUPGHOME (default: ~/.gnupg) after a prompt.\nThe configuration written by this script is not GnuPG 1 (gpg) compatible. If you have a GnuPG 1 keystore it will be converted to a GnuPG 2 keystore.\nConfiguration improvements:\n- the use of high available key servers via the HKPS protocol: hkps://hkps.pool.sks-keyservers.net\n- strong cipher algorithm preference\n- show longer keyids (hashes)\n- show fingerprints with each key\n\nThe security configuration written with this script is considered up-to-date in 2017.\nIf you are reading this later review the cipher algorithm configuration.\n\n## TL;DR\n`$ ./gpg-helper.sh help`\n\n```\ngpg-helper is a simple wrapper script around gpg2 (GnuPG). [GNUPG]\nIt simplifies usage and encorporates some best practices.\nGnuPG configuration and keyring is stored in /home/max/.gnupg. [GNUPGHOME]\n\nUsage: ./gpg-helper.sh COMMAND\n  COMMAND\n    help                   Shows this help text.\n    gpgconfig              Writes gpg.conf and dirmngr.conf interactively.\n    listkeys [KEYID|UID]   Lists all keys in your keyring.\n    listsecretkeys         Lists your secret keys.\n    genkey                 Generates a new key pair interactively.\n    editkey KEYID [CMD]    Edit the key interactively.\n    deletekey KEYID        Delete the key from the local keyring.\n    deletesecretkey KEYID  Delete the secret key from the local keyring.\n    genrevoke KEYID FILE   Generates a key revocation certificate.\n    fingerprint KEYID      Shows the key's fingerprint.\n    signkey KEYID          Signs a key in the keyring and prints it to stdout.\n    fexport KEYID [FILE]   Exports the key to the file provided or stdout.\n    fimport FILE           Imports the keys from a file into your keyring.\n    export KEYID…          Exports keys from your keyring to key servers.\n    import KEYID…          Imports keys from the key servers into your keyring.\n    search UID             Searches for available keys by UID on key servers.\n    refresh [KEYID]        Reloads all imported keys from the key servers.\n    encrypt -r UID… [FILE] Encrypts the file using the recipient's public key.\n    decrypt [FILE]         Decrypts the file using your private key.\n    clearsign [FILE [OUT]] Create signature containing plaintext content.\n    sign FILE [OUTSIGFILE] Create detached signature using your private key.\n    verify [SIGFILE [FILE]]Verify file using signature + signer's public key.\n  PARAMETERS\n    UID                    A user's identifier or name.\n                           For instance 'Max Mustermann' or user@example.org.\n    KEYID                  A keypair identified by hexadecimal ID.\n\nExamples:\n  Generate a keypair and a revocation certificate:\n    ./gpg-helper.sh genkey\n    pgp\u003e 4 (creates RSA master key for key signing only, use 4096bit)\n    pgp\u003e 4096 (choose high key strength for master)\n    pgp\u003e 2y (do not choose more than 2 years, you can always extend time later)\n    ...\n    ./gpg-helper.sh genrevoke SUBKEYID OUTPUTREVOKECERTFILE\n  Generate a sub key to be used for encryption only + revoke certificate:\n    ./gpg-helper.sh editkey KEYID addkey\n    pgp\u003e 6 (choose RSA encryption key)\n    pgp\u003e 2048 (choose only 2048bit strength for faster computing ...)\n    pgp\u003e 1y   (... since it expires in a year)\n    pgp\u003e save (save the key in the local keyring)\n    ./gpg-helper.sh genrevoke SUBKEYID OUTREVOKECERTFILE\n  Export your key to the public key servers:\n    ./gpg-helper.sh export KEYID\n  Search for a person's key on the key servers:\n    ./gpg-helper.sh search 'John Doe'\n  Import John's key, check its fingerprint, mark it as trusted and sign it:\n    ./gpg-helper.sh import 0xD954726E5B31B1DC\n    ./gpg-helper.sh fingerprint 0xD954726E5B31B1DC # Call John to confirm\n    ./gpg-helper.sh editkey 0xD954726E5B31B1DC trust # See OWNER TRUST\n    ./gpg-helper.sh signkey 0xD954726E5B31B1DC \u003e enc-signed-key-john.asc\n    (Send the encrypted signed key file back to John so his key gains trust)\n  Encrypt a file for a specific recipient:\n    echo 'Hello!' | ./gpg-helper.sh encrypt -r 0xD954726E5B31B1DC\n  Encrypt a file for multiple recipients by name (resolved by UIDs in keyring):\n    ./gpg-helper.sh encrypt -r 'John Doe' -r user@example.org /secret/file\n  Decrypt an encrypted file (works only if you have the matching private key):\n    ./gpg-helper.sh decrypt /secret/file.asc\n  Extend a key's expiration date:\n    ./gpg-helper.sh editkey 0xA3E57D6E5B31B1FB\n    gpg\u003e key 1\n    gpg\u003e expire\n    Key is valid for? (0) 2y\n    gpg\u003e save\n    ./gpg-helper.sh export 0xA3E57D6E5B31B1FB\n  Mark compromised key as revoked using your initially created revocation cert:\n    ./gpg-helper.sh fimport REVOCATIONCERTFILE\n    ./gpg-helper.sh export KEYID\nRun gpg2 --help for more options.\n\nKey type identifiers as listed in gpg2 output:\n  sec: SECret key\n  ssb: Secret SuBkey\n  pub: PUBlic key\n  sub: public SUBkey\n  If a key type identifier is suffixed with '#' it means it could not be\n  found on the disk (e.g. sec#). This should be the case for the sec key on\n  laptops and build servers that only need to work with ssb and sub keys.\n\nKey roles as listed in gpg2 output:\n  A: key for authentication\n  C: key for certifying signatures\n  E: key for encryption\n  S: key for signing\n\nBest practices:\n  Your MASTER KEY (sec, pub) is your identity and should be kept very secret.\n  Use it for key creation, key signing and key revocation only!\n  Create SUB KEYS (ssb, sub) of your master key and use them for encryption and\n  signing! You can use a separate sub key per machine to sign files but to\n  decrypt files on multiple machines you need to copy one sub key to all\n  (see https://wiki.debian.org/Subkeys). Do not store your private master key\n  on your laptop but in a safe location! You can revoke a single sub key\n  without revoking all. If you revoke the master key you have to rebuild all\n  trust. To be able to revoke a key you don't have anymore create a revocation\n  cert together with the key and store it in a safer location. Refresh your\n  keys to minimize the risk of using a friend's compromised key for encryption!\n  Expand the WEB OF TRUST by letting a friend sign your public identity key and\n  sign his. Your friend gets your key from a key server, confirms the key's\n  fingerprint e.g. during a phone call with you, signs the key and sends it\n  encrypted back to you where you import it and the other way around\n  (see https://wiki.debian.org/Keysigning).\n  Both may send the signed keys to key servers to gain their SIGNATORY TRUST.\n  A 3rd person that trusts one of you completely in her local keyring\n  (OWNER TRUST) may now also trust in the other implicitly.\n  The more people have signed your key the more authentic your key becomes on\n  the key servers to people who don't know you directly.\n  Note: If your friend's key gets compromised or is unsafe the trust chain is\n  broken (without your knowledge). Also your key metadata is visible in the\n  public and you can never remove it or your old keys from the key servers.\n  Therefore think twice before you attach a picture to your key - which is also\n  possible.\n\nTroubleshooting:\n  If you cannot reach hkps key servers due to 'general error' restart dirmngr:\n      sudo killall dirmngr \u0026\u0026 sleep 7;\n      sudo rm -rf /home/max/.gnupg/dirmngr-cache.d; dirmngr \u003c/dev/null\n  If you still cannot reach hkps key servers use hkp servers in dirmngr.conf:\n      keyserver hkp://pool.sks-keyservers.net\n  If the key server responds with 'no data' to a key search request try again.\n  Some keyservers do not (yet) have all keys.\n```\n\nIf you read that far, understood everything and know how to use gpg2 you may not need this script.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmgoltzsche%2Fgpg-helper","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmgoltzsche%2Fgpg-helper","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmgoltzsche%2Fgpg-helper/lists"}