gpg

Files (1)

• SKILL.md

SKILL.md (first lines)

# gpg

Encrypt, decrypt, sign, verify, and manage keys using `gpg` (GnuPG).

## Orientation

Run the following commands before proceeding:

```bash
which -a gpg
which gpg
gpg --version
gpg --list-keys
gpg --list-secret-keys
```

## Key Generation

### Non-interactive (batch mode — preferred in agent contexts)

```bash
cat > keygen-batch.txt << 'EOF'
%no-protection
Key-Type: RSA
Key-Length: 4096
Key-Usage: sign
Subkey-Type: RSA
Subkey-Length: 4096
Subkey-Usage: encrypt
Name-Real: Alice Smith
Name-Email: alice@example.com
Expire-Date: 1y
%commit
EOF

gpg --batch --generate-key keygen-batch.txt
```

Notes:
- `%no-protection` omits a passphrase. Remove it to prompt for one (interactive only).
- `ed25519`/`cv25519` key types in batch mode require GnuPG 2.3+; fall back to `RSA` if the batch file errors with `invalid algorithm`.
- A revocation certificate is automatically saved to `~/.gnupg/openpgp-revocs.d/<FINGERPRINT>.rev` on creation.

### Interactive (full key generation)

```bash
gpg --full-generate-key
```

## Listing Keys

```bash
# Public keys (human-readable)
gpg --list-keys
gpg --list-keys --keyid-format LONG
gpg --list-keys --with-fingerprint

# Secret keys
gpg --list-secret-keys --keyid-format LONG

# Machine-readable colon-delimited output
gpg --list-keys --with-colons

# Extract key ID from colon output
gpg --list-keys --with-colons | awk -F: '/^pub/{print $5}'

# Extract fingerprint from colon output
gpg --list-keys --with-colons | awk -F: '/^fpr/{print $10}'
```

## Key Import and Export

```bash
# Export public key (ASCII armored)
gpg --export --armor alice@example.com > alice-pub.asc
gpg --export --armor <FINGERPRINT> > key.asc

# Export secret key (keep secure — treat like a password)
gpg --export-secret-keys --armor alice@example.com > alice-sec.asc

# Import a key
gpg --import alice-pub.asc

# Extract public key(s) from a secret key file
gpg --import alice-sec.asc   # imports both pub and sec
```

## Trust

```bash
# Set ultimate trust non-interactively (use for your own keys after import)
echo "<FINGERPRINT>:6:" | gpg --import-ownertrust

# Export current trust assignments (for backup/migration)
gpg --export-ownertrust > ownertrust.txt
gpg --import-ownertrust < ownertrust.txt
```

Trust values: `2`=unknown, `3`=untrusted, `4`=marginal, `5`=full, `6`=ultimate.

`gpg --edit-key` trust prompts require an interactive terminal — use `--import-ownertrust` for non-interactive contexts.

## Encryption

```bash
# Encrypt to a recipient (by email or fingerprint)
gpg --encrypt --recipient alice@example.com --armor input.txt > encrypted.asc

# Encrypt to a file (binary)
gpg --encrypt --recipient alice@example.com -o encrypted.gpg input.txt

# Encrypt to multiple recipients
gpg --encrypt --recipient alice@example.com --recipient bob@example.com input.txt

# Symmetric encryption (passphrase only, no key needed)
gpg --symmetric --armor --batch --passphrase "yourpass" -o encrypted.asc input.txt

# Encrypt and sign in one step
gpg --encrypt --sign --recipient alice@example.com --armor input.txt

From jason-riddle/agent-skills, MIT.

More from jason-riddle/agent-skills