otty / apps

All apps/GnuPG

GnuPG

gnupg

A free implementation of the OpenPGP standard: signing, encryption and key management.

Runs as gpg, gpg2, gpgconf|macOS, Linux|gnupg.org

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

GnuPG in your home directory Every rule on this page, by file

· gpg.conf Sync

default-cache-ttl 600

max-cache-ttl 7200

enable-ssh-support

pinentry-program /opt/homebrew/bin/pinentry-macmachine-local

Each machine keeps its own copy of these.

· dirmngr.conf Sync

· scdaemon.conf Sync

· sshcontrol Sync

· random_seed Exclude

· S.* Exclude

· *.lock Exclude

· crls.d/ Exclude

· public-keys.d/ Exclude

· openpgp-revocs.d/ Exclude

· pubring.kbx~ Exclude

· private-keys-v1.d/ Never synced

· secring.gpg Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/gnupg/otty.tomlThe file this page is generated from

id = "gnupg"

name = "GnuPG"

homepage = "https://gnupg.org"

description = "A free implementation of the OpenPGP standard: signing, encryption and key management."

icon = "theSVG:gnupg"

executables = ["gpg", "gpg2", "gpgconf"]

platforms = ["macos", "linux"]

[dotfiles]

# gpg(1) FILES and gpg-agent(1) FILES: $GNUPGHOME, defaulting to ~/.gnupg.

# The .conf files and sshcontrol are configuration; everything else in there

# is key material or runtime state.

paths = [

"~/.gnupg/gpg.conf",

"~/.gnupg/gpg-agent.conf",

"~/.gnupg/dirmngr.conf",

"~/.gnupg/scdaemon.conf",

"~/.gnupg/sshcontrol",

]

exclude = [

"~/.gnupg/random_seed",

"~/.gnupg/S.*",

"~/.gnupg/*.lock",

"~/.gnupg/crls.d/",

"~/.gnupg/public-keys.d/",

"~/.gnupg/openpgp-revocs.d/",

"~/.gnupg/pubring.kbx~",

]

# private-keys-v1.d is where gpg-agent stores every secret key it holds.

secret = ["~/.gnupg/private-keys-v1.d/", "~/.gnupg/secring.gpg"]

# An absolute path to the pinentry binary this machine has installed —

# /opt/homebrew on Apple Silicon, /usr/local on Intel, /usr/bin on Linux. That

# is the platform choosing rather than the machine: the value is the same on

# every box of that kind whoever is logged in, so it travels to one of them.

[[dotfiles.machine_lines]]

file = "~/.gnupg/gpg-agent.conf"

match = { prefix = ["pinentry-program"] }

scope = "platform"

[commands]

format = 1

label = "GnuPG keys"

description = "List, export, import and fetch keys and decrypt files with gpg. Encrypting and signing are not covered because the completion data lacks their file arguments."

quality = "ai-draft"

base = "fig:gpg"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/gpg.ts"

license = "MIT"

[[commands.subcommand]]

path = ["--list-keys"]

label = "List public keys"

description = "List keys from the public keyrings."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/gpg.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "names"

label = "Key IDs or names"

type = "string"

position = 0

multiple = true

description = "Leave empty for all keys."

sources = ["fig"]

[[commands.subcommand.field]]

id = "with_colons"

label = "Machine-readable"

type = "boolean"

option = ["--with-colons"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "fingerprint"

label = "Show fingerprints"

type = "boolean"

option = ["--with-fingerprint"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "homedir"

label = "GnuPG home"

type = "path"

option = ["--homedir"]

path = { kind = "directory", role = "input" }

sources = ["fig"]

[[commands.subcommand.task]]

id = "list"

label = "List keys"

fields = ["names", "fingerprint"]

required = []

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["names", "fingerprint"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["with_colons", "homedir"]

[[commands.subcommand]]

path = ["--export"]

label = "Export keys"

description = "Export public keys to the terminal or a file."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/gpg.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "names"

label = "Key IDs or names"

type = "string"

position = 0

multiple = true

description = "Leave empty for all keys."

sources = ["fig"]

[[commands.subcommand.field]]

id = "armour"

label = "ASCII armour"

type = "boolean"

option = ["--armour", "-a"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "output"

label = "Output file"

type = "path"

option = ["--output", "-o"]

path = { kind = "file", role = "output" }

effect = "overwrite"

sources = ["fig"]

[[commands.subcommand.task]]

id = "export"

label = "Export armoured"

fields = ["names", "armour", "output"]

required = ["names"]

set = { armour = [true] }

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["names", "armour", "output"]

[[commands.subcommand]]

path = ["--import"]

label = "Import keys"

description = "Import and merge keys from files."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/gpg.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "files"

label = "Key files"

type = "path"

position = 0

multiple = true

path = { kind = "file", role = "input" }

sources = ["fig"]

[[commands.subcommand.field]]

id = "merge_only"

label = "Merge only"

description = "Do not add new keys to the keyrings."

type = "boolean"

option = ["--merge-only"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "import"

label = "Import"

fields = ["files"]

required = ["files"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["files", "merge_only"]

[[commands.subcommand]]

path = ["--recv-keys"]

label = "Fetch keys"

description = "Download keys by ID from a keyserver."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/gpg.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "ids"

label = "Key IDs"

type = "string"

position = 0

multiple = true

sources = ["fig"]

[[commands.subcommand.field]]

id = "keyserver"

label = "Keyserver"

type = "string"

option = ["--keyserver"]

sources = ["fig"]

[[commands.subcommand.task]]

id = "recv"

label = "Fetch"

fields = ["ids", "keyserver"]

required = ["ids"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["ids", "keyserver"]

[[commands.subcommand]]

path = ["--decrypt"]

label = "Decrypt"

description = "Decrypt a file, or stdin when no file is given."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/gpg.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "file"

label = "Encrypted file"

type = "path"

path = { kind = "file", role = "input" }

position = 0

sources = ["fig"]

[[commands.subcommand.field]]

id = "output"

label = "Output file"

description = "Defaults to the terminal."

type = "path"

option = ["--output", "-o"]

path = { kind = "file", role = "output" }

effect = "overwrite"

sources = ["fig"]

[[commands.subcommand.task]]

id = "decrypt"

label = "Decrypt"

fields = ["file", "output"]

required = ["file"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["file", "output"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/gnupg. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps all credential files out. None of them splits pinentry-program for you — that part is Otty’s own sync, or a template you write by hand.