Page MenuHome GnuPG

documentation fixes for 2.1.0
Closed, ResolvedPublic

Description

These should all be easy to fix, so to cut down on your overhead of closing
issues, I decided to put these all in one place. If you prefer otherwise, just
let me know.

  1. The fact that revocation certificates are generated, is mentioned no-where.

They should be mentioned at least:

  • in the man page for --gen-key
  • after the key generation process is finished

The wording in the revocation certificate itself is quite good, however "use it"
would not be clear to novice users. Instead, I would start off something like:

This is a revocation certificate for your key. Think of it as a "kill switch".
To use it, import it (--import) into your keyring and then publish the public
key (--send-key) to keyservers.

[..]

As with normal kill switches, this revocation certificate may be abused; if you
feel more comfortable without it, then you may delete this file. Note that you
cannot generate a new one without the secret key, and knowing its passphrase.

  1. Double redirect about batch mode using ambiguous wording.

In the man page for gpg, it says:

--gen-key

[..]
There is also a feature which allows you to create keys in batch mode.

See the file ‘doc/DETAILS’ in the source distribution on how to use this.

In DETAILS, it now (since 2.1.0) says:

  • Unattended key generation Please see the GnuPG manual for a description.

"X manual" is a generic term and it's not clear that this refers to a specific
document; "GnuPG manual" is not mentioned anywhere else in DETAILS. It would be
better to remove this section from DETAILS. In the man page for --gen-key, one
can point to the SEE ALSO section, which defines what the manual is and mentions
that info gnupg is available for offline users.

Details

Version
2.1.0

Event Timeline

werner lowered the priority of this task from Normal to Wishlist.Sep 25 2014, 8:51 PM
werner removed a project: Bug Report.
werner added a project: Feature Request.

The text now reads:

This is a revocation certificate for the OpenPGP key:

pub rsa2048/71201A64 2016-01-21

Key fingerprint = F6B8 598F 5E71 5104 D13C  1415 58D4 85FF 7120 1A64

uid baz@example.org

A revocation certificate is a kind of "kill switch" to publicly
declare that a key shall not anymore be used. It is not possible
to retract such a revocation certificate once it has been published.

Use it to revoke this key in case of a compromise or loss of
the secret key. However, if the secret key is still accessible,
it is better to generate a new revocation certificate and give
a reason for the revocation. For details see the description of
of the gpg command "--gen-revoke" in the GnuPG manual.

To avoid an accidental use of this file, a colon has been inserted
before the 5 dashes below. Remove this colon with a text editor

before importing and publishing this revocation certificate.

werner claimed this task.