1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00
gnupg/README

280 lines
11 KiB
Plaintext
Raw Normal View History

The GNU Privacy Guard
=======================
2023-05-10 10:23:59 +02:00
Version 2.5 (devel)
2002-06-29 14:15:02 +00:00
Copyright 1997-2019 Werner Koch
Copyright 1998-2021 Free Software Foundation, Inc.
Copyright 2003-2023 g10 Code GmbH
2010-10-26 12:25:47 +00:00
2006-11-11 14:17:09 +00:00
* INTRODUCTION
2006-11-11 14:17:09 +00:00
GnuPG is a complete and free implementation of the OpenPGP standard
as defined by RFC4880 (also known as PGP). GnuPG enables encryption
and signing of data and communication, and features a versatile key
management system as well as access modules for public key
directories.
GnuPG, also known as GPG, is a command line tool with features for
easy integration with other applications. A wealth of frontend
applications and libraries are available that make use of GnuPG.
Starting with version 2 GnuPG provides support for S/MIME and Secure
Shell in addition to OpenPGP.
GnuPG is Free Software (meaning that it respects your freedom). It
can be freely used, modified and distributed under the terms of the
GNU General Public License.
* BUILD INSTRUCTIONS
2004-01-29 20:16:59 +00:00
2022-12-16 11:00:16 +01:00
GnuPG 2.4 depends on the following GnuPG related packages:
2004-01-29 20:16:59 +00:00
2017-11-20 12:39:16 +01:00
npth (https://gnupg.org/ftp/gcrypt/npth/)
libgpg-error (https://gnupg.org/ftp/gcrypt/libgpg-error/)
libgcrypt (https://gnupg.org/ftp/gcrypt/libgcrypt/)
libksba (https://gnupg.org/ftp/gcrypt/libksba/)
libassuan (https://gnupg.org/ftp/gcrypt/libassuan/)
You should get the latest versions of course, the GnuPG configure
script complains if a version is not sufficient.
2004-01-29 20:16:59 +00:00
Several other standard libraries are also required. The configure
script prints diagnostic messages if one of these libraries is not
available and a feature will not be available..
You also need the Pinentry package for most functions of GnuPG;
however it is not a build requirement. Pinentry is available at
2017-11-20 12:39:16 +01:00
https://gnupg.org/ftp/gcrypt/pinentry/ .
Implement unattended OpenPGP secret key import. * agent/command.c (cmd_import_key): Add option --unattended. * agent/cvt-openpgp.c (convert_transfer_key): New. (do_unprotect): Factor some code out to ... (prepare_unprotect): new function. (convert_from_openpgp): Factor all code out to ... (convert_from_openpgp_main): this. Add arg 'passphrase'. Implement openpgp-native protection modes. (convert_from_openpgp_native): New. * agent/t-protect.c (convert_from_openpgp_native): New dummy fucntion * agent/protect-tool.c (convert_from_openpgp_native): Ditto. * agent/protect.c (agent_unprotect): Add arg CTRL. Adjust all callers. Support openpgp-native protection. * g10/call-agent.c (agent_import_key): Add arg 'unattended'. * g10/import.c (transfer_secret_keys): Use unattended in batch mode. -- With the gpg-agent taking care of the secret keys, the user needs to migrate existing keys from secring.gpg to the agent. This and also the standard import of secret keys required the user to unprotect the secret keys first, so that gpg-agent was able to re-protected them using its own scheme. With many secret keys this is quite some usability hurdle. In particular if a passphrase is not instantly available. To make this migration smoother, this patch implements an unattended key import/migration which delays the conversion to the gpg-agent format until the key is actually used. For example: gpg2 --batch --import mysecretkey.gpg works without any user interaction due to the use of --batch. Now if a key is used (e.g. "gpg2 -su USERID_FROM_MYSECRETKEY foo"), gpg-agent has to ask for the passphrase anyway, converts the key from the openpgp format to the internal format, signs, re-encrypts the key and tries to store it in the gpg-agent format to the disk. The next time, the internal format of the key is used. This patch has only been tested with the old demo keys, more tests with other protection formats and no protection are needed. Signed-off-by: Werner Koch <wk@gnupg.org>
2013-05-22 09:50:12 +01:00
After building and installing the above packages in the order as
given above, you may continue with GnuPG installation (you may also
just try to build GnuPG to see whether your already installed
versions are sufficient).
2004-01-29 20:16:59 +00:00
As with all packages, you just have to do
mkdir build
cd build
../configure
make
make check
make install
2002-06-29 14:15:02 +00:00
The "make check" is optional but highly recommended. To run even
more tests you may add "--enable-all-tests" to the configure run.
Before running the "make install" you might need to become root.
2002-06-29 14:15:02 +00:00
If everything succeeds, you have a working GnuPG with support for
OpenPGP, S/MIME, ssh-agent, and smartcards.
2004-01-29 20:16:59 +00:00
In case of problem please ask on the gnupg-users@gnupg.org mailing
list for advise.
2004-01-29 20:16:59 +00:00
Instruction on how to build for Windows can be found in the file
doc/HACKING in the section "How to build an installer for Windows".
This requires some experience as developer.
You may run
2010-10-26 12:25:47 +00:00
2022-12-16 11:00:16 +01:00
gpgconf -L
2010-10-26 12:25:47 +00:00
to view the directories used by GnuPG.
2010-10-26 12:25:47 +00:00
To quickly build all required software without installing it, the
Speedo method may be used:
2014-09-18 16:00:34 +02:00
cd build
make -f ../build-aux/speedo.mk native
2014-09-18 16:00:34 +02:00
This method downloads all required libraries and does a native build
of GnuPG to PLAY/inst/. GNU make is required and you need to set
LD_LIBRARY_PATH to $(pwd)/PLAY/inst/lib to test the binaries.
2014-09-18 16:00:34 +02:00
** Specific build problems on some machines:
2010-10-26 12:25:47 +00:00
*** Apple OSX 10.x using XCode
2010-10-26 12:25:47 +00:00
On some versions the correct location of a header file can't be
detected by configure. To fix that you should run configure like
this
2010-10-26 12:25:47 +00:00
./configure gl_cv_absolute_stdint_h=/usr/include/stdint.h
2010-10-26 12:25:47 +00:00
Add other options as needed.
2010-10-26 12:25:47 +00:00
*** Systems without a full C99 compiler
If you run into problems with your compiler complaining about dns.c
you may use
./configure --disable-libdns
Add other options as needed.
2017-08-28 11:18:26 +02:00
* RECOMMENDATIONS
2022-12-16 11:00:16 +01:00
** Key database daemon
Since version 2.3.0 it is possible to store the keys in an SQLite
database instead of the keyring.kbx file. This is in particular
useful for large keyrings or if many instances of gpg and gpgsm may
run concurrently. This is implemented using another daemon process,
the "keyboxd". To enable the use of the keyboxd put the option
"use-keyboxd" into the configuration file ~/.gnupg/common.conf or the
global /etc/gnupg/common.conf. See also doc/examples/common.conf.
Only public keys and X.509 certificates are managed by the keyboxd;
private keys are still stored as separate files.
Since version 2.4.1 the keyboxd will be used by default for a fresh
install; i.e. if a ~/.gnupg directory did not yet exist.
2022-12-16 11:00:16 +01:00
Note that there is no automatic migration; if the use-keyboxd option
is enabled keys are not taken from pubring.kbx. To migrate existing
keys to the keyboxd do this:
1. Disable the keyboxd (remove use-keyboxd from common.conf)
2. Export all public keys
gpg --export --export-options backup > allkeys.gpg
gpgsm --export --armor > allcerts.gpg
3. Enable the keyboxd (add use-keyboxd to common.conf)
4. Import all public keys
gpg --import --import-options restore < allkeys.gpg
gpgsm --import < allcerts.crt
In case the keyboxd is not able to startup due to a stale lockfile
created by another host, the command
gpgconf --unlock pubring.db
can be used to remove the lock file.
** Socket directory
GnuPG uses Unix domain sockets to connect its components (on Windows
an emulation of these sockets is used). Depending on the type of
the file system, it is sometimes not possible to use the GnuPG home
directory (i.e. ~/.gnupg) as the location for the sockets. To solve
this problem GnuPG prefers the use of a per-user directory below the
2021-04-07 19:04:46 +02:00
the /run (or /var/run) hierarchy for the sockets. It is thus
suggested to create per-user directories on system or session
2021-04-07 19:04:46 +02:00
startup. For example, the following snippet can be used in
/etc/rc.local to create these directories:
[ ! -d /run/user ] && mkdir /run/user
awk -F: </etc/passwd '$3 >= 1000 && $3 < 65000 {print $3}' \
| ( while read uid rest; do
if [ ! -d "/run/user/$uid" ]; then
mkdir /run/user/$uid
chown $uid /run/user/$uid
chmod 700 /run/user/$uid
fi
done )
** Conflicts with systemd socket activation
Some Linux distribution use the meanwhile deprecated --supervised
option with gpg-agent, dirmngr, and keyboxd. The idea is that the
systemd process launches the daemons as soon as gpg or gpgsm try to
access them. However, this creates a race condition with GnuPG's
own on-demand launching of these daemon. It also conflicts with the
remote use gpg-agent because the no-autostart feature on the remote
site will not work as expected.
Thus the recommendation is not to use the --supervised option. All
GnuPG components handle the startup of their daemons on their own.
The only problem is that for using GnuPG's ssh-agent protocol
support, the gpg-agent must have been started before ssh. This can
either be done with an ssh wrapper running
gpg-connect-agent updatestartuptty /bye
for each new tty or by using that command directly after login when
the anyway required SSH_AUTH_SOCK envvar is set (see the example in
the gpg-agent man page).
2006-11-11 14:17:09 +00:00
* DOCUMENTATION
2006-11-11 14:17:09 +00:00
The complete documentation is in the texinfo manual named
`gnupg.info'. Run "info gnupg" to read it. If you want a
printable copy of the manual, change to the "doc" directory and
enter "make pdf" For a HTML version enter "make html" and point your
browser to gnupg.html/index.html. Standard man pages for all
components are provided as well. An online version of the manual is
available at [[https://gnupg.org/documentation/manuals/gnupg/]] . A
version of the manual pertaining to the current development snapshot
is at [[https://gnupg.org/documentation/manuals/gnupg-devel/]] .
2006-11-11 14:17:09 +00:00
2021-04-07 19:04:46 +02:00
* Using the legacy version GnuPG 1.4
The 1.4 version of GnuPG is only intended to allow decryption of old
data material using legacy keys which are not anymore supported by
GnuPG 2.x. To install both versions alongside, it is suggested to
rename the 1.4 version of "gpg" to "gpg1" as well as the
corresponding man page. Newer releases of the 1.4 branch will
likely do this by default.
2006-11-11 14:17:09 +00:00
* HOW TO GET MORE INFORMATION
2006-11-11 14:17:09 +00:00
2017-08-28 11:18:26 +02:00
A description of new features and changes since version 2.1 can be
found in the file "doc/whats-new-in-2.1.txt" and online at
"https://gnupg.org/faq/whats-new-in-2.1.html" .
2017-08-28 11:18:26 +02:00
The primary WWW page is "https://gnupg.org"
The primary FTP site is "https://gnupg.org/ftp/gcrypt/"
2006-11-11 14:17:09 +00:00
See [[https://gnupg.org/download/mirrors.html]] for a list of
mirrors and use them if possible. You may also find GnuPG mirrored
on some of the regular GNU mirrors.
2006-11-11 14:17:09 +00:00
We have some mailing lists dedicated to GnuPG:
2006-11-11 14:17:09 +00:00
gnupg-announce@gnupg.org For important announcements like new
versions and such stuff. This is a
moderated list and has very low traffic.
Do not post to this list.
2006-11-11 14:17:09 +00:00
gnupg-users@gnupg.org For general user discussion and
2021-08-24 18:31:38 +02:00
help.
gnupg-devel@gnupg.org GnuPG developers main forum.
You subscribe to one of the list by sending mail with a subject of
"subscribe" to x-request@gnupg.org, where x is the name of the
mailing list (gnupg-announce, gnupg-users, etc.). See
2017-11-20 12:39:16 +01:00
https://gnupg.org/documentation/mailing-lists.html for archives
of the mailing lists.
2017-08-28 11:18:26 +02:00
Please direct bug reports to [[https://bugs.gnupg.org]] or post them
direct to the mailing list <gnupg-devel@gnupg.org>.
Please direct questions about GnuPG to the users mailing list or one
of the PGP newsgroups; please do not direct questions to one of the
authors directly as we are busy working on improvements and bug
2022-10-13 15:53:27 +02:00
fixes. The mailing lists are watched by the authors and we try to
answer questions as time allows us.
Commercial grade support for GnuPG is available; for a listing of
2017-11-20 12:39:16 +01:00
offers see https://gnupg.org/service.html . Maintaining and
improving GnuPG requires a lot of time. Since 2001, g10 Code GmbH,
a German company owned and headed by GnuPG's principal author Werner
2022-12-16 11:00:16 +01:00
Koch, is bearing the majority of these costs.
# This file is Free Software; as a special exception the authors gives
# unlimited permission to copy and/or distribute it, with or without
# modifications, as long as this notice is preserved. For conditions
# of the whole package, please see the file COPYING. This file is
# distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY, to the extent permitted by law; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
#
# Local Variables:
# mode:org
# End: