aboutsummaryrefslogtreecommitdiffstats
path: root/gnupg/gpg.conf
blob: 6aa561f5a06aea7410fe321fb43cfbe333bff0fa (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
default-key 5134EF9EAF65F95B6BB1608E50FB9B273A9D0BB5

# always encrypt things to my own key as well
# Fails with .10 if this is a fingerprint?
encrypt-to 0x50FB9B273A9D0BB5

# Use ASCII armored output instead of binary OpenPGP format.
armor

use-agent
utf8-strings
charset utf-8
display-charset utf-8
homedir ~/.config/gnupg

keyserver hkps://hkps.pool.sks-keyservers.net

keyserver-options auto-key-retrieve no-honor-keyserver-url honor-pka-record include-subkeys

auto-key-locate dane pka cert keyserver

verify-options show-notations show-keyserver-urls pka-lookups pka-trust-increase

# when outputting certificates, view user IDs distinctly from keys:
fixed-list-mode

# short-keyids are trivially spoofed; it's easy to create a long-keyid collision;
# if you care about strong key identifiers, you always want to see the fingerprint:
keyid-format 0xlong
with-fingerprint

# when multiple digests are supported by all recipients, choose the strongest one:
personal-digest-preferences SHA512 SHA384 SHA256 SHA224

# preferences chosen for new keys should prioritize stronger algorithms:
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 BZIP2 ZLIB ZIP Uncompressed

# You should always know at a glance which User IDs gpg thinks are legitimately bound to the keys in your keyring:
verify-options show-uid-validity
list-options show-uid-validity

# when making an OpenPGP certification, use a stronger digest than the default SHA1:
cert-digest-algo SHA512

# don't include the gpg version in the ASCII armored output
no-emit-version

sig-notation pka-address@gnupg.org=johannes@kyriasis.com
sig-notation issuer-fpr@notations.openpgp.fifthhorseman.net=%g