commit 64ab93ab6a4487e9a83387e3e4fe86f1352b2188 · hyperreal.bsky.moonshadow.dev/dotfiles

private_dot_gnupg/gpg-agent.conf

···

       1
       1
       +
       enable-ssh-support

     

       2
       2
       +
       

     

       3
       3
       +
       default-cache-ttl 60

     

       4
       4
       +
       max-cache-ttl 120

+96

private_dot_gnupg/gpg.conf

···

       1
       1
       +
       #

     

       2
       2
       +
       # This is an implementation of the Riseup OpenPGP Best Practices

     

       3
       3
       +
       # https://help.riseup.net/en/security/message-security/openpgp/best-practices

     

       4
       4
       +
       #

     

       5
       5
       +
       

     

       6
       6
       +
       #-----------------------------

     

       7
       7
       +
       # default key

     

       8
       8
       +
       #-----------------------------

     

       9
       9
       +
       

     

       10
       10
       +
       # The default key to sign with. If this option is not used, the default key is

     

       11
       11
       +
       # the first key found in the secret keyring

     

       12
       12
       +
       

     

       13
       13
       +
       default-key 0x9129BD07C3509CED

     

       14
       14
       +
       

     

       15
       15
       +
       #-----------------------------

     

       16
       16
       +
       # behavior

     

       17
       17
       +
       #-----------------------------

     

       18
       18
       +
       

     

       19
       19
       +
       # Disable inclusion of the version string in ASCII armored output

     

       20
       20
       +
       no-emit-version

     

       21
       21
       +
       

     

       22
       22
       +
       # Disable comment string in clear text signatures and ASCII armored messages

     

       23
       23
       +
       no-comments

     

       24
       24
       +
       

     

       25
       25
       +
       # Display long key IDs

     

       26
       26
       +
       keyid-format 0xlong

     

       27
       27
       +
       

     

       28
       28
       +
       # List all keys (or the specified ones) along with their fingerprints

     

       29
       29
       +
       with-fingerprint

     

       30
       30
       +
       

     

       31
       31
       +
       # Display the calculated validity of user IDs during key listings

     

       32
       32
       +
       list-options show-uid-validity

     

       33
       33
       +
       verify-options show-uid-validity

     

       34
       34
       +
       

     

       35
       35
       +
       # Try to use the GnuPG-Agent. With this option, GnuPG first tries to connect to

     

       36
       36
       +
       # the agent before it asks for a passphrase.

     

       37
       37
       +
       use-agent

     

       38
       38
       +
       

     

       39
       39
       +
       charset utf-8

     

       40
       40
       +
       fixed-list-mode

     

       41
       41
       +
       

     

       42
       42
       +
       #-----------------------------

     

       43
       43
       +
       # keyserver

     

       44
       44
       +
       #-----------------------------

     

       45
       45
       +
       

     

       46
       46
       +
       # This is the server that --recv-keys, --send-keys, and --search-keys will

     

       47
       47
       +
       # communicate with to receive keys from, send keys to, and search for keys on

     

       48
       48
       +
       #keyserver hkps://hkps.pool.sks-keyservers.net

     

       49
       49
       +
       keyserver pgp.mit.edu

     

       50
       50
       +
       

     

       51
       51
       +
       # Provide a certificate store to override the system default

     

       52
       52
       +
       # Get this from https://sks-keyservers.net/sks-keyservers.netCA.pem

     

       53
       53
       +
       #keyserver-options ca-cert-file=/usr/local/etc/ssl/certs/hkps.pool.sks-keyservers.net.pem

     

       54
       54
       +
       

     

       55
       55
       +
       # Set the proxy to use for HTTP and HKP keyservers - default to the standard

     

       56
       56
       +
       # local Tor socks proxy

     

       57
       57
       +
       # It is encouraged to use Tor for improved anonymity. Preferrably use either a

     

       58
       58
       +
       # dedicated SOCKSPort for GnuPG and/or enable IsolateDestPort and

     

       59
       59
       +
       # IsolateDestAddr

     

       60
       60
       +
       #

     

       61
       61
       +
       # I run my tor socks proxy in a container, see .dockerfunc and

     

       62
       62
       +
       # github.com/jfrazelle/dockerfiles

     

       63
       63
       +
       #keyserver-options http-proxy=socks5-hostname://torproxy:9050

     

       64
       64
       +
       

     

       65
       65
       +
       # Don't leak DNS, see https://trac.torproject.org/projects/tor/ticket/2846

     

       66
       66
       +
       #keyserver-options no-try-dns-srv

     

       67
       67
       +
       

     

       68
       68
       +
       # When using --refresh-keys, if the key in question has a preferred keyserver

     

       69
       69
       +
       # URL, then disable use of that preferred keyserver to refresh the key from

     

       70
       70
       +
       keyserver-options no-honor-keyserver-url

     

       71
       71
       +
       

     

       72
       72
       +
       # When searching for a key with --search-keys, include keys that are marked on

     

       73
       73
       +
       # the keyserver as revoked

     

       74
       74
       +
       keyserver-options include-revoked

     

       75
       75
       +
       

     

       76
       76
       +
       #-----------------------------

     

       77
       77
       +
       # algorithm and ciphers

     

       78
       78
       +
       #-----------------------------

     

       79
       79
       +
       

     

       80
       80
       +
       # list of personal digest preferences. When multiple digests are supported by

     

       81
       81
       +
       # all recipients, choose the strongest one

     

       82
       82
       +
       personal-cipher-preferences AES256 AES192 AES CAST5

     

       83
       83
       +
       

     

       84
       84
       +
       # list of personal digest preferences. When multiple ciphers are supported by

     

       85
       85
       +
       # all recipients, choose the strongest one

     

       86
       86
       +
       personal-digest-preferences SHA512 SHA384 SHA256 SHA224

     

       87
       87
       +
       

     

       88
       88
       +
       # message digest algorithm used when signing a key

     

       89
       89
       +
       cert-digest-algo SHA512

     

       90
       90
       +
       s2k-cipher-algo AES256

     

       91
       91
       +
       s2k-digest-algo SHA512

     

       92
       92
       +
       

     

       93
       93
       +
       # This preference list is used for new keys and becomes the default for

     

       94
       94
       +
       # "setpref" in the edit menu

     

       95
       95
       +
       default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed

     

       96
       96
       +

private_dot_gnupg/scdaemon.conf

···

       1
       1
       +
       disable-ccid