Wikimedia Release Engineering Team/Onboarding/PGP and GPG
- Follow instructions at https://alexcabal.com/creating-the-perfect-gpg-keypair
- Store key at encrypted USB stick.
- For added security, do not store the password in keychain.
$ brew install gnupg # install gpg $ gpg --version # check if it's installed $ export GNUPGHOME=/Volumes/(VOLUME/FOLDER) # point gpg to the folder with key $ gpg -K # show key $ gpg --list-keys # list keys
$ gpg --recv-key "(KEY)" # keyserver needs to be configured (not sure how) $ gpg --import (FILE) # import key from file
$ gpg --edit-key (KEY) # edit key gpg> help # help gpg> sign # sign gpg> save # save
To verify that the email address on the key works, export the signed key, encrypt the exported key, and then send the encrypted key to its owner. The owner, if they get email to the address in the key, can decrypt the encrypted key, import the key, and send the signature to the keyservers themselves.
$ gpg --export --armor "(KEY)" > (FILE) # export $ gpg --encrypt -r "(KEY)" (FILE)
Yto the warning message:
gpg: no ultimately trusted keys found ... Use this key anyway? (y/N)
- E-mail the file with
.gpgextension to the e-mail in the key.