Page MenuHome GnuPG

Add more support for profiles in gpgconf
Closed, ResolvedPublic


To make it possible to switch to / from TOFU it would be nice to have the
trust-model setting available through gpgconf.

Event Timeline

Talked to werner about it. The way something like trust-model should be
switchable would be best to handle with profiles.

There is at least one profile planned for EasyGPG. Something like "Silent" or
automated. Riseup and VSNFD will probably also want to create profiles.

I think apply-defaults could be extended for this with a defaults file for each
Then something like:

gpgconf --list-defaults

    List all available default files.

Where the output format could be similar to list-components.

filename is the path to the config file.

Then --apply-defaults could be extended to take an optional filename as an
argument. (Like --list-config, --check-config)

With --dry-run it should only check if all the settings marked as no-change are
set correctly and indicate it through the return code.

For EasyGPG I think a config file could be:

  • gpg-agent max-cache-ttl [change] 30758400 gpg-agent default-cache-ttl [change] 30758400 gpg trust-model [no-change] tofu+pgp gpg auto-key-retrieve [change] gpg auto-key-locate [change] local,wkd,dane,pka,cert,keyserver
aheinecke renamed this task from Expose trust-model through gpgconf to Add support for profiles in gpgconf.Jun 30 2016, 4:00 PM

Ok profiles are now there and look workable, but it looks like they are only
supporting configuration values that are currently accessible through gpgconf:

trust-model tofu+pgp
keyserver-options auto-key-retrieve
auto-key-locate local,wkd,pka,cert,dane

Leads to:

gpgconf: /opt/gnupg/etc/gnupg/automated.profile:7:0: error: unknown option
'trust-model' in section 'gpg'
gpgconf: /opt/gnupg/etc/gnupg/automated.profile:8:0: error: unknown option
'keyserver-options' in section 'gpg'

So we need more options promoted to gpgconf. Which I think is ok, we can just
mark them as Expert / Invisible and GUI's should respect that.

justus added a project: Restricted Project.Feb 28 2017, 1:29 PM

Let's keep this one open to track missing options.

werner renamed this task from Add support for profiles in gpgconf to Add more support for profiles in gpgconf.Mar 1 2017, 9:09 PM
werner added a project: In Progress.
werner removed a project: Restricted Project.

I'm going to close this task now. If we need more options to be configurable, it is easy to open another task for them.