s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

gpg

GNU Privacy Guard: sign and verify files, packages and Git tags, and encrypt data with OpenPGP keys.

Level
DevSecOps service
Group
Secrets
Needs root
No
Package
gnupg2

What it does

gpg manages a keyring of OpenPGP keys. In operations you use it mostly to verify downloads and package signatures (RPM repos, HashiCorp releases), to sign releases and Git tags, and sometimes to encrypt files for a person. RPM and DNF check package signatures with GPG keys imported by rpm --import.

How to write it

gpg [OPTIONS] COMMAND [ARGS]

Main parts

Commands

--full-generate-key / --quick-generate-key
Make a key pair.
--list-keys / --list-secret-keys
Show keys.
--import FILE / --export -a ID
Import / export public keys.
--verify SIG [FILE]
Check a signature.
--detach-sign -a FILE
Make a separate signature file.
--clearsign FILE
Sign a text file in place.
-e -r ID FILE
Encrypt for a person.
-d FILE
Decrypt.
-c FILE
Encrypt with a passphrase (symmetric).
--fingerprint ID
Show the fingerprint (compare it!).
--edit-key ID
Trust, expire, add sub-keys.
--gen-revoke ID
Make a revocation certificate.

Options 6

Most used

Flags

-a, --armor
Text output (.asc).
-o FILE
Output file.
-r ID
Recipient.
-u ID
Which secret key to use.
--batch --yes
No questions (scripts).
--keyserver URL / --recv-keys ID
Get keys from a key server.

Examples 10

$ run as a normal user# run as root (or with sudo)

  1. 1Make a key

    gpg --quick-generate-key "s0sta release signing" ed25519 sign 2y
gpg --list-secret-keys --keyid-format long

  2. 2Verify a download (HashiCorp example)

    curl -sO https://releases.hashicorp.com/terraform/1.9.8/terraform_1.9.8_SHA256SUMS
curl -sO https://releases.hashicorp.com/terraform/1.9.8/terraform_1.9.8_SHA256SUMS.sig
gpg --verify terraform_1.9.8_SHA256SUMS.sig terraform_1.9.8_SHA256SUMS
sha256sum -c --ignore-missing terraform_1.9.8_SHA256SUMS

  3. 3Check the fingerprint of an imported key

    gpg --import hashicorp.asc
gpg --fingerprint security@hashicorp.com

  4. 4Sign a release file

    gpg --detach-sign -a shop-1.4.0.tar.gz
gpg --verify shop-1.4.0.tar.gz.asc shop-1.4.0.tar.gz

  5. 5Encrypt a file for a colleague

    gpg --import colleague.asc
gpg -e -a -r colleague@example.com handover.txt
gpg -d handover.txt.asc

  6. 6Encrypt with only a passphrase

    gpg -c --cipher-algo AES256 notes.txt

  7. 7Check RPM package signatures

    rpm --import https://download.docker.com/linux/rhel/gpg
rpm -qa gpg-pubkey --qf '%{NAME}-%{VERSION}-%{RELEASE}\t%{SUMMARY}\n'
rpm -K docker-ce-27.3.1-1.el9.x86_64.rpm

  8. 8Sign Git tags with GPG

    git config --global user.signingkey 0x1234ABCD5678EF90
git tag -s v1.4.0 -m "Shop 1.4.0"
git tag -v v1.4.0

  9. 9Export your public key for GitHub

    gpg --export -a 0x1234ABCD5678EF90

  10. 10Make a revocation certificate (keep it offline)

    gpg --gen-revoke 0x1234ABCD5678EF90 > revoke.asc

Watch out

  • Always compare fingerprints from a second trusted source; a key with the right name can be fake.
  • Back up the secret key and the revocation certificate offline.

Files

~/.gnupg/
Keyring and settings.

Tips to remember

  • For new projects, SSH signing (Git) and age (files) are simpler; GPG is still needed for RPM and many downloads.

Exit codes

0Success (good signature).
1Bad signature.
2Other error.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man gpg

Open the man page (linux.die.net)man7.org