2012-03-22 13:45:01 +01:00
|
|
|
|
# Options for GnuPG
|
|
|
|
|
|
# Copyright 1998, 1999, 2000, 2001, 2002, 2003,
|
|
|
|
|
|
# 2010 Free Software Foundation, Inc.
|
2018-09-18 20:37:28 +02:00
|
|
|
|
# 2012 - 2018 Mikaela Suomalainen
|
2012-03-22 13:45:01 +01:00
|
|
|
|
# This file is free software; as a special exception the author gives
|
|
|
|
|
|
# unlimited permission to copy and/or distribute it, with or without
|
|
|
|
|
|
# modifications, as long as this notice is preserved.
|
|
|
|
|
|
#
|
|
|
|
|
|
# This file is distributed in the hope that it will be useful, but
|
|
|
|
|
|
# WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
|
|
|
|
|
|
# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
|
|
|
|
|
|
#
|
|
|
|
|
|
# Unless you specify which option file to use (with the command line
|
|
|
|
|
|
# option "--options filename"), GnuPG uses the file ~/.gnupg/gpg.conf
|
|
|
|
|
|
# by default.
|
|
|
|
|
|
#
|
|
|
|
|
|
# An options file can contain any long options which are available in
|
|
|
|
|
|
# GnuPG. If the first non white space character of a line is a '#',
|
|
|
|
|
|
# this line is ignored. Empty lines are also ignored.
|
|
|
|
|
|
#
|
|
|
|
|
|
# See the man page for a list of options.
|
|
|
|
|
|
|
2019-12-06 18:41:24 +01:00
|
|
|
|
# Use my key by default
|
|
|
|
|
|
#default-key 0x99392F62BAE30723 # MIKAELA_GREP # MIKAELA_GREP_GPG
|
|
|
|
|
|
# WTOP
|
|
|
|
|
|
#default-key 0xDC189FE6FA9BD685 # MIKAELA_GREP # MIKAELA_GREP_GPG
|
|
|
|
|
|
|
2019-12-06 19:22:32 +01:00
|
|
|
|
# Ignore preferred keyserver
|
|
|
|
|
|
keyserver-options no-honor-keyserver-url
|
|
|
|
|
|
# The defaults are apparently self-sigs-only,import-clean starting from
|
|
|
|
|
|
# gpg 2.2.17, but there seem to be controversial views on them and I am
|
|
|
|
|
|
# not sure what way to go, so I am opting to trust the distribution.
|
|
|
|
|
|
# Debian uses self-sigs-only (while I would be fine with import-clean)
|
|
|
|
|
|
# * https://dev.gnupg.org/T4628#128513
|
|
|
|
|
|
# Arch Linux reverts the change going by no-self-sigs-only,no-import-clean
|
|
|
|
|
|
# * https://bugs.archlinux.org/task/63147
|
2012-08-11 09:56:01 +02:00
|
|
|
|
|
2019-12-02 23:48:35 +01:00
|
|
|
|
# Try to automatically find keys from local/wkd if key for email address isn't found, but we are encrypting to email address.
|
2019-12-05 13:51:13 +01:00
|
|
|
|
auto-key-retrieve
|
2019-12-02 23:48:35 +01:00
|
|
|
|
auto-key-locate local,wkd
|
2012-12-21 18:50:44 +01:00
|
|
|
|
|
2019-12-06 18:44:49 +01:00
|
|
|
|
|
2012-12-21 12:19:49 +01:00
|
|
|
|
# Encrypt to sender's key by default
|
2012-03-22 13:45:01 +01:00
|
|
|
|
default-recipient-self
|
2012-12-21 12:19:49 +01:00
|
|
|
|
|
2019-12-06 18:40:00 +01:00
|
|
|
|
# I don't think there is point in "encrypt-to 0xOWNKEYID, because there
|
|
|
|
|
|
# is the default-recipient-self above.
|
2012-12-21 12:19:49 +01:00
|
|
|
|
|
|
|
|
|
|
# Use UTF-8 charset
|
2012-03-22 13:45:01 +01:00
|
|
|
|
charset UTF-8
|
2012-12-21 18:50:44 +01:00
|
|
|
|
display-charset utf-8
|
2012-12-21 12:19:49 +01:00
|
|
|
|
|
2018-09-18 20:37:28 +02:00
|
|
|
|
# use GPG Agent to avoid retyping passphrase very often.
|
2012-08-06 11:16:56 +02:00
|
|
|
|
use-agent
|
2012-12-21 12:19:49 +01:00
|
|
|
|
|
|
|
|
|
|
# Do everything in ASCII format by default instead of binary
|
2012-08-06 11:16:56 +02:00
|
|
|
|
armor
|
2012-12-21 12:19:49 +01:00
|
|
|
|
|
2012-12-22 15:43:34 +01:00
|
|
|
|
# Show the LONG KEYID and fingerprint by default and tell that it's hexadecimal string.
|
2012-07-26 12:17:43 +02:00
|
|
|
|
keyid-format 0xLONG
|
2012-12-22 15:43:34 +01:00
|
|
|
|
with-fingerprint
|
2019-12-06 19:55:58 +01:00
|
|
|
|
with-wkd-hash
|
2012-07-24 09:32:53 +02:00
|
|
|
|
|
2013-01-17 15:48:48 +01:00
|
|
|
|
# Ask everything
|
|
|
|
|
|
ask-cert-level
|
|
|
|
|
|
ask-cert-expire
|
2012-12-22 15:43:34 +01:00
|
|
|
|
|
2013-02-26 11:18:20 +01:00
|
|
|
|
# Copying https://we.riseup.net/riseuplabs+paow/openpgp-best-practices#update-your-gpg-defaults
|
|
|
|
|
|
# when outputting certificates, view user IDs distinctly from keys:
|
|
|
|
|
|
fixed-list-mode
|
|
|
|
|
|
# You should always know at a glance which User IDs gpg thinks are legitimately bound to the keys in your keyring:
|
|
|
|
|
|
verify-options show-uid-validity
|
|
|
|
|
|
list-options show-uid-validity
|
|
|
|
|
|
|
2019-08-01 11:19:44 +02:00
|
|
|
|
# Disable comments
|
|
|
|
|
|
no-comments
|
2019-08-26 19:35:43 +02:00
|
|
|
|
|
|
|
|
|
|
# Don't output version, small chance of having people put same keys on IPFS
|
|
|
|
|
|
no-emit-version
|
|
|
|
|
|
|
2019-12-06 22:23:36 +01:00
|
|
|
|
# Trust On First Use (marginal trust) with WoT being full trust. I find this
|
|
|
|
|
|
# less annoying in KMail than only WoT or the comment below, and I think it
|
|
|
|
|
|
# may be additional motivation for me to actually sign the keys I trust with
|
|
|
|
|
|
# all keyservers hiding signatures and gpg not importing them.
|
|
|
|
|
|
# I think `keybase pgp pull` also helps here as the people I am tracking
|
|
|
|
|
|
# there are going to be in my keyring, however it's still a centralized
|
|
|
|
|
|
# service.
|
|
|
|
|
|
trust-model tofu+pgp
|
|
|
|
|
|
# WoT with TOFU’s conflict detection, but without positive trust
|
|
|
|
|
|
#tofu-default-policy unknown
|
|
|
|
|
|
|
