diff --git a/doc/ChangeLog b/doc/ChangeLog index a481732d2..a93a1dbac 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,15 @@ +2001-12-22 David Shaw + + * gpg.sgml: Fixed a few typos. + + * gpg.sgml: Added documentation for --show-photos, + --no-show-photos, --photo-viewer, --nrsign-key, + --default-check-level, --search-keys, --keyserver-options, + --show-notation, --no-show-notation, --show-policy-url, + --no-show-policy-url, --for-your-eyes-only, + --no-for-your-eyes-only, --pgp2, --no-pgp2, + --no-permission-warning, --expert, --no-expert. + 2001-10-31 Werner Koch * gpg.sgml: Add a remark on how to get the long key ID. Suggested diff --git a/doc/gpg.sgml b/doc/gpg.sgml index 8bf03162e..911cdb85e 100644 --- a/doc/gpg.sgml +++ b/doc/gpg.sgml @@ -209,6 +209,35 @@ List all keys from the secret keyrings, or just the ones given on the command line. + +--show-photos + +Causes --list-keys, --list-sigs, --list-public-keys, and +--list-secret-keys to also display the photo ID attached to a key, if +any. +See also --photo-viewer. + + + +--no-show-photos + +Resets the --show-photos flag. + + + +--photo-viewer &ParmString; + +This is the command line that should be run to view a photo ID. "%i" +will be expanded to a filename containing the photo. "%I" does the +same, except the file will not be deleted once the viewer exits. +Other flags are "%k" for the key ID, "%K" for the long key ID, "%f" +for the key fingerprint, and "%%" for an actual percent sign. If +neither %i or %I are present, then the photo will be supplied to the +viewer on standard input. + +The default viewer is "xloadimage -fork -quiet -title 'KeyID 0x%k' +stdin" + --show-keyring @@ -216,7 +245,7 @@ ones given on the command line. Causes --list-keys, --list-public-keys, and --list-secret-keys to display the name of the keyring a given key resides on. This is only useful when you're listing a specific key or set of keys. It has no -effect when listig all keys. +effect when listing all keys. @@ -233,7 +262,6 @@ Same as --list-keys, but the signatures are listed too. Same as --list-sigs, but the signatures are verified. - --fingerprint &OptParmNames; @@ -422,17 +450,47 @@ calculation has failed; probably due to an expired key. --sign-key &ParmName; -Sign a public key with your secret key. This is a shortcut version -of the subcommand "sign" from --edit. +Signs a public key with your secret key. This is a shortcut version of +the subcommand "sign" from --edit. --lsign-key &ParmName; -Sign a public key with your secret key but mark it as non-exportable. -This is a shortcut version of the subcommand "lsign" from --edit. +Signs a public key with your secret key but marks it as +non-exportable. This is a shortcut version of the subcommand "lsign" +from --edit. + +--nrsign-key &ParmName; + +Signs a public key with your secret key but marks it as non-revocable. +This is a shortcut version of the subcommand "nrsign" from --edit. + + + +--default-check-level &ParmN; + +The default to use for the check level when signing a key. + +0 means you make no particular claim as to how carefully you verified +the key. 1 means you believe the key is owned by the person who +claims to own it but you could not, or did not verify the key at all. +This is useful for a "persona" verification, where you sign the key of +a pseudonymous user. 2 means you did casual verification of the key. +For example, this could mean that you verified that the key +fingerprint and checked the user ID on the key against a photo ID. 3 +means you did extensive verification of the key. For example, this +could mean that you verified the key fingerprint and checked the user +ID on the key against a photo ID, and also verified the email address +on the key belongs to the key owner. + +This option defaults to 0. + + + + --trusted-key long key ID @@ -531,25 +589,23 @@ but does only the merging of new signatures, user-IDs and subkeys. --recv-keys &ParmKeyIDs; -Import the keys with the given key IDs from a HKP -keyserver. Option --keyserver must be used to -give the name of this keyserver. +Import the keys with the given key IDs from a keyserver. Option +--keyserver must be used to give the name of this keyserver. - ---recv-keys &ParmKeyIDs; +--search-keys &OptParmNames; -Import the keys with the given key IDs from a HKP -keyserver. Option --keyserver must be used to -give the name of this keyserver. +Search the keyserver for the given names. Multiple names given here +will be joined together to create the search string for the keyserver. +Option --keyserver must be used to give the name of this keyserver. --update-trustdb Do trust DB maintenance. This command goes over all keys and builds -the Web-of-Trust. This is an intercative command because it may has to +the Web-of-Trust. This is an interactive command because it may has to ask for the "ownertrust" values of keys. The user has to give an estimation in how far she trusts the owner of the displayed key to correctly certify (sign) other keys. It does only ask for that value @@ -838,37 +894,97 @@ is bound to the key. --keyserver &ParmName; -Use &ParmName to lookup keys which are not yet in -your keyring. This is only done while verifying -messages with signatures. The option is also -required for the command --send-keys to -specify the keyserver to where the keys should -be send. All keyservers synchronize with each -other - so there is no need to send keys to more -than one server. Using the command -"host -l pgp.net | grep wwwkeys" gives you a -list of keyservers. Because there is load -balancing using round-robin DNS you may notice -that you get different key servers. +Use &ParmName as your keyserver. This is the server that --recv-keys, +--send-keys, and --search-keys will communicate with to receive keys +from, send keys to, and search for keys on. The format of the +&ParmName is a URI: `scheme:[//]keyservername[:port]' The scheme is +the type of keyserver: "hkp" for the Horowitz (or compatible) +keyservers, "ldap" for the NAI LDAP keyserver, or "mailto" for the +Horowitz email keyserver. Note that your particular installation of +GnuPG may have other keyserver types available as well. + +Most keyservers synchronize with each other, so there is generally no +need to send keys to more than one server. Using the command "host -l +pgp.net | grep wwwkeys" gives you a list of HKP keyservers. When +using one of the wwwkeys servers, due to load balancing using +round-robin DNS you may notice that you get a different key server +each time. + +--keyserver-options parameters + +This is a space or comma delimited string that gives options for the +keyserver. Options can be prepended with a `no-' to give the opposite +meaning. While not all options are available for all keyserver +schemes, some common options are: + + + +include-revoked + +When receiving or searching for a key, include keys that are marked on +the keyserver as revoked. + + + +include-disabled + +When receiving or searching for a key, include keys that are marked on +the keyserver as disabled. + + + +use-temp-files + +On most Unix-like platforms, GnuPG communicates with the keyserver +helper program via pipes, which is the most efficient method. This +option forces GnuPG to use temporary files to communicate. On some +platforms (such as Win32 and RISC OS), this option is always enabled. + + + +keep-temp-files + +If using `use-temp-files', do not delete the temp files after using +them. This option is useful to learn the keyserver communication +protocol by reading the temporary files. + + + +verbose + +Tell the keyserver helper program to be more verbose. This option can +be repeated multiple times to increase the verbosity level. + + + +honor-http-proxy + +For keyserver schemes that use HTTP (such as HKP), try to access the +keyserver over the proxy set with the environment variable +"http_proxy". + + + + + +--auto-key-retrieve + +This option enables the automatic retrieving of keys from a keyserver +when verifying signatures made by keys that are not on the local +keyring. + --no-auto-key-retrieve This option disables the automatic retrieving of keys from a keyserver -while verifying signatures. This option allows you to keep a keyserver in -the options file for the --send-keys and --recv-keys commands. +while verifying signatures. This may be of use if --auto-key-retrieve +is enabled from an options file. - ---honor-http-proxy - -Try to access the keyserver over the proxy set with the variable -"http_proxy". - - --keyring &ParmFile; @@ -1050,6 +1166,19 @@ If you prefix &ParmName; with an exclamation mark, the notation data will be flagged as critical (rfc2440:5.2.3.15). + +--show-notation + +Show key signature notations in the --list-sigs or --check-sigs +listings. + + + +--no-show-notation + +Do not show key signature notations in the --list-sigs or --check-sigs +listings. + --set-policy-url &ParmString; @@ -1059,6 +1188,18 @@ If you prefix it with an exclamation mark, the policy URL packet will be flagged as critical. + +--show-policy-url + +Show any policy URLs set in the --list-sigs or --check-sigs listings. + + + +--no-show-policy-url + +Do not show any policy URLs set in the --list-sigs or --check-sigs +listings. + --set-filename &ParmString; @@ -1067,6 +1208,21 @@ Use &ParmString; as the name of file which is stored in messages. + +--for-your-eyes-only + +Set the `for your eyes only' flag in the message. This causes GnuPG +to refuse to save the file unless the --output option is given, and +PGP to use the "secure viewer" with a Tempest-resistant font to +display the message. This option overrides --set-filename. + +--no-for-your-eyes-only + +Resets the --for-your-eyes-only flag. + --use-embedded-filename @@ -1155,14 +1311,13 @@ for conventional encryption. --compress-algo &ParmN; -Use compress algorithm &ParmN;. Default is 2 which is -RFC1950 compression. You may use 1 to use the old zlib -version (RFC1951) which is used by PGP. The default algorithm may -give better results because the window size is not limited -to 8K. If this is not used the OpenPGP behavior is used, -i.e. the compression algorithm is selected from the -preferences; note, that this can't be done if you do -not encrypt the data. +Use compression algorithm &ParmN;. Default is 2 which is RFC1950 +compression. You may use 1 to use the old zlib version (RFC1951) which +is used by PGP. 0 disables compression. The default algorithm may give +better results because the window size is not limited to 8K. If this +is not used the OpenPGP behavior is used, i.e. the compression +algorithm is selected from the preferences; note, that this can't be +done if you do not encrypt the data. @@ -1282,6 +1437,23 @@ agent before it asks for a passphrase. Try to be more RFC1991 (PGP 2.x) compliant. + +--pgp2 + +Set up all options to be as PGP 2.x compliant as possible, and warn if +an action is taken (e.g. encrypting to a non-RSA key) that will create +a message that PGP 2.x will not be able to handle. + +This option implies `--rfc1991 --no-openpgp --no-force-v4-certs +--no-comment --escape-from --no-force-v3-sigs --cipher-algo IDEA +--digest-algo MD5 --compress-algo 1' + + + +--no-pgp2 + +Resets the --pgp2 option. + --openpgp @@ -1313,12 +1485,12 @@ Reset the --force-v3-sigs option. --force-v4-certs -Always use v4 key signatures even on v3 keys. This option does also -change the default hash algorithm for v3 RSA keys from MD5 to SHA-1. +Always use v4 key signatures even on v3 keys. This option also +changes the default hash algorithm for v3 RSA keys from MD5 to SHA-1. ---no-force-v3-certs +--no-force-v4-certs Reset the --force-v4-certs option. @@ -1339,7 +1511,7 @@ This option might not be implemented yet. Allow the import of keys with user IDs which are not self-signed, but have at least one signature. This only allows the import - key validation will fail and you -have to check the validity of the key my other means. This hack is +have to check the validity of the key by other means. This hack is needed for some German keys generated with pgp 2.6.3in. You should really avoid using it, because OpenPGP has better mechanics to do separate signing and encryption keys. @@ -1441,6 +1613,12 @@ enter batch mode. Suppress the warning about "using insecure memory". + +--no-permission-warning + +Suppress the warning about unsafe file permissions. + + --no-armor @@ -1557,6 +1735,21 @@ content of an encrypted message; using this option you can do this without handing out the secret key. + +--expert + +Enable certain options, such as prompting for a signature expiration +date, that are not frequently used by regular users. Also permits the +user to do certain "silly" things like signing an expired or revoked +key. + +--no-expert + +Resets the --expert option. + --merge-only