From aaaa3a1de82245f2a7b79475182eca113a2dfab2 Mon Sep 17 00:00:00 2001 From: Alan Pearce Date: Fri, 18 Aug 2017 21:23:35 +0200 Subject: Configure GPG (version 2.1) --- git/.config/git/config | 5 ++- gnupg/.gnupg/dirmngr.conf | 1 + gnupg/.gnupg/gpa.conf | 2 ++ gnupg/.gnupg/gpg-agent.conf | 3 ++ gnupg/.gnupg/gpg.conf | 84 +++++++++++++++++++++++++++++++++++++++++++++ xprofile/.xprofile | 1 + zsh/.config/zsh/.zshrc | 18 +++++++++- 7 files changed, 112 insertions(+), 2 deletions(-) create mode 100644 gnupg/.gnupg/dirmngr.conf create mode 100644 gnupg/.gnupg/gpa.conf create mode 100644 gnupg/.gnupg/gpg-agent.conf create mode 100644 gnupg/.gnupg/gpg.conf diff --git a/git/.config/git/config b/git/.config/git/config index c82c149f..ab8143b1 100644 --- a/git/.config/git/config +++ b/git/.config/git/config @@ -1,6 +1,7 @@ [user] email = alan@alanpearce.eu name = Alan Pearce + signingkey = 0xE711C48B9C041266 [color] branch = auto diff = auto @@ -41,4 +42,6 @@ [difftool] prompt = false [difftool "icdiff"] - cmd = icdiff --line-numbers $LOCAL $REMOTE \ No newline at end of file + cmd = icdiff --line-numbers $LOCAL $REMOTE +[gpg] + program = gpg2 diff --git a/gnupg/.gnupg/dirmngr.conf b/gnupg/.gnupg/dirmngr.conf new file mode 100644 index 00000000..4392dc52 --- /dev/null +++ b/gnupg/.gnupg/dirmngr.conf @@ -0,0 +1 @@ +hkp-cacert = .gnupg/sks-keyservers.netCA.pem \ No newline at end of file diff --git a/gnupg/.gnupg/gpa.conf b/gnupg/.gnupg/gpa.conf new file mode 100644 index 00000000..2e33e80b --- /dev/null +++ b/gnupg/.gnupg/gpa.conf @@ -0,0 +1,2 @@ +default-key 5FA779613E2AB0EEFC6DD3056A56F2A314E23293 +detailed-view diff --git a/gnupg/.gnupg/gpg-agent.conf b/gnupg/.gnupg/gpg-agent.conf new file mode 100644 index 00000000..52eb1dca --- /dev/null +++ b/gnupg/.gnupg/gpg-agent.conf @@ -0,0 +1,3 @@ +enable-ssh-support +default-cache-ttl 600 +max-cache-ttl 7200 diff --git a/gnupg/.gnupg/gpg.conf b/gnupg/.gnupg/gpg.conf new file mode 100644 index 00000000..c043b31d --- /dev/null +++ b/gnupg/.gnupg/gpg.conf @@ -0,0 +1,84 @@ +# +# This is an implementation of the Riseup OpenPGP Best Practices +# https://help.riseup.net/en/security/message-security/openpgp/best-practices +# + + +#----------------------------- +# default key +#----------------------------- + +# The default key to sign with. If this option is not used, the default key is +# the first key found in the secret keyring + +# default-key + +#----------------------------- +# behavior +#----------------------------- + +# Disable inclusion of the version string in ASCII armored output +no-emit-version + +# Disable comment string in clear text signatures and ASCII armored messages +no-comments + +# Display long key IDs +keyid-format 0xlong + +# List all keys (or the specified ones) along with their fingerprints +with-fingerprint + +# Display the calculated validity of user IDs during key listings +list-options show-uid-validity +verify-options show-uid-validity + +# Try to use the GnuPG-Agent. With this option, GnuPG first tries to connect to +# the agent before it asks for a passphrase. +use-agent + +#----------------------------- +# keyserver +#----------------------------- + +# This is the server that --recv-keys, --send-keys, and --search-keys will +# communicate with to receive keys from, send keys to, and search for keys on +keyserver hkps://hkps.pool.sks-keyservers.net + +# Provide a certificate store to override the system default +# Get this from https://sks-keyservers.net/sks-keyservers.netCA.pem +# keyserver-options ca-cert-file=.gnupg/sks-keyservers.netCA.pem + +# Set the proxy to use for HTTP and HKP keyservers - default to the standard +# local Tor socks proxy +# It is encouraged to use Tor for improved anonymity. Preferrably use either a +# dedicated SOCKSPort for GnuPG and/or enable IsolateDestPort and +# IsolateDestAddr +keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050 + +# When using --refresh-keys, if the key in question has a preferred keyserver +# URL, then disable use of that preferred keyserver to refresh the key from +keyserver-options no-honor-keyserver-url + +# When searching for a key with --search-keys, include keys that are marked on +# the keyserver as revoked +keyserver-options include-revoked + +#----------------------------- +# algorithm and ciphers +#----------------------------- + +# list of personal digest preferences. When multiple digests are supported by +# all recipients, choose the strongest one +personal-cipher-preferences AES256 AES192 AES CAST5 + +# list of personal digest preferences. When multiple ciphers are supported by +# all recipients, choose the strongest one +personal-digest-preferences SHA512 SHA384 SHA256 SHA224 + +# message digest algorithm used when signing a key +cert-digest-algo SHA512 + +# This preference list is used for new keys and becomes the default for +# "setpref" in the edit menu +default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed \ No newline at end of file diff --git a/xprofile/.xprofile b/xprofile/.xprofile index dbb8d92c..2811220a 100755 --- a/xprofile/.xprofile +++ b/xprofile/.xprofile @@ -1,6 +1,7 @@ #!/bin/sh sh -c 'sleep 5 && xsetroot -cursor_name left_ptr' & xmodmap .xmodmaprc +gpg-connect-agent /bye xrdb -I$HOME/.xresources .xresources/main cmst --minimized & sxhkd & diff --git a/zsh/.config/zsh/.zshrc b/zsh/.config/zsh/.zshrc index 818cdf5f..b7a20b9c 100644 --- a/zsh/.config/zsh/.zshrc +++ b/zsh/.config/zsh/.zshrc @@ -106,7 +106,18 @@ bindkey '\e ' hist-complete zstyle ':completion:*' matcher-list 'm:{a-zA-Z-_}={A-Za-z_-}' 'r:|=*' 'l:|=* r:|=*' zstyle ':completion:*' completer _expand _complete _match -if [[ -z $SSH_AUTH_SOCK && $commands[ssh-agent] ]] +if [[ -n $commands[gpg-connect-agent] ]] +then + # When using SSH support, use the current TTY for passphrase prompts + gpg-connect-agent updatestartuptty /bye > /dev/null + + # Point the SSH_AUTH_SOCK to the one handled by gpg-agent + if [ -S $(gpgconf --list-dirs agent-ssh-socket) ]; then + export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket) + else + echo "$(gpgconf --list-dirs agent-ssh-socket) doesn't exist. Is gpg-agent running ?" + fi +elif [[ -z $SSH_AUTH_SOCK && $commands[ssh-agent] ]] then eval $(ssh-agent) fi @@ -167,6 +178,11 @@ then alias gh=hub fi +if [[ -n $commands[gpg2] && -z $commands[gpg] ]] +then + alias gpg=gpg2 +fi + if [[ -n $commands[lunchy] ]] then LUNCHY_DIR=$(dirname $(gem which lunchy))/../extras -- cgit 1.4.1