7

Is there any way to source a secondary configuration file inside the usual gpg.conf?

I'd like to share a set of common configuration options across different workstations but I also need several local customizations.

4

GnuPG does not allow sourcing configuration files from within configuration files:

--options file
      Read options from file and do not try to read them from the default
      options file in the homedir (see --homedir). This option is ignored
      if used in an options file.

You can use the --options command line argument multiple times, though; so you might create an alias or wrapper script like this, loading a shared and a local configuration file:

gpg --options ~/.dotfiles/gnupg/gpg.conf --options ~/.gnupg/gpg.conf
2

Why not just make the gpg.conf file and then copy it to the second workstation? I can not envision the settings needing to change (much). Note that your keys are stored separately.

You could store the gpg.conf file on a secure network file share both workstations could access and then reference it with the command below. While not recommended it is possible. [If an attacker controlled gpg.conf they could try to downgrade you to old insecure DES encryption or many other undesirable things]

gpg.conf
This is the standard configuration file read by gpg2 on startup. It may >contain any valid long option; the leading two dashes may not be entered and >the option may not be abbreviated. This default name may be changed on the >command line (see gpg-option –options). You should backup this file.

gpg2 --options [config file in non default location]

To change the default signing key:

--default-key name

Use name as the default key to sign with. If this option is not used, the default key is the first key found in the secret keyring. Note that -u or

--local-user overrides this option.

Sample gpg.conf file designed with High Security in mind (may need to remove tor features if you don't use) Duraconfig : https://github.com/ioerror/duraconf/blob/master/configs/gnupg/gpg.conf

Discussion of increasing gpg.conf security

GPG Config File and command line options

9
  • 1
    I don't want a copy because I want ongoing changes which I make (e.g. for security settings) to be available on all hosts. But, .e.g the primary key IDs differ on the workstations due to separate contexts I am working in. – languitar Sep 1 '15 at 11:22
  • The primary key is by default the first public secret key pair and therefore does not need to be setup in gpg.conf – StackAbstraction Sep 1 '15 at 14:01
  • What do you mean by "first"? Is there any ordering of keys that I can change in my keyring assuming I have multiple secret keys? – languitar Sep 1 '15 at 14:58
  • 1
    But that is exactly the option I want to set per computer in my config. The help text does not explain what first means and since I have multiple private keys, I need to specify which one I want to use on which computer. – languitar Sep 1 '15 at 15:47
  • 1
    Sorry, but this does not answer the question. I want to share the configuration file for good reasons. I am working on many computers and I do not want to manually synchronize changes apart from the primary key. I would most likely forget one of the computers. Specifying the key via the command line will not easily work for programs which internally use gpg. – languitar Sep 3 '15 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.