gpg
EncryptionPackage: gpg
Encrypts, signs and verifies files with public keys. Here it encrypts backups before they leave the machine and checks package signatures — two uses where the private key must be backed up elsewhere, or the encrypted backup is worth nothing.
What its options do in the lessons
From the same glossary the lessons render under their commands, so the two cannot disagree.
gpg --quick-generate-key- Creates a key pair without asking anything: identity, algorithm, usage and expiry are passed as arguments.
default default nevertakes GnuPG's own defaults and a key that never expires. gpg --armor- Writes printable text instead of binary. It is the form that survives being pasted into a ticket or a password manager.
gpg --export- Writes the public key to standard output. The private half only leaves through
--export-secret-keys, which has no business on a server. gpg --show-keys- Prints what a key file contains — fingerprint, identities, subkeys — without adding anything to the keyring. Read it before
--import, not after. gpg --import- Adds the keys the file contains to the keyring. Importing is not trusting: the key stays unusable for encryption until its trust is set.
gpg --list-secret-keys- Lists the private keys in the keyring. On a machine that produces encrypted backups, this output should stay empty.
gpg --list-keys- Lists the public keys, with their fingerprint and the trust level in brackets:
[ unknown]until it is set,[ultimate]afterwards. gpg --import-ownertrust- Reads
<fingerprint>:<level>:lines and sets the trust given to those keys. Level6is ultimate trust, which makes a key usable for encryption with no extra flag. gpg --trust-model- Chooses how GnuPG decides a key is valid.
alwaysskips validation: encryption then goes to whichever key is in the keyring, including one nobody checked. gpg --lsign-key- Signs a key locally, without publishing the signature. It needs a private key on the machine to sign with — which is exactly what a backup source does not have.
gpg --encrypt- Encrypts to one or more public keys. With no file argument the input is read from standard input, which is what lets a dump be encrypted inside a pipeline.
gpg --recipient- The key to encrypt to. Give the full fingerprint rather than an address: no lookup by name, and no ambiguity the day two keys carry the same address.
gpg --output- The output file. Without it, the result goes to standard output or to a name derived from the input.
gpg --batch- Non-interactive mode: GnuPG asks nothing and fails where it would have asked for confirmation. It is what turns a trust question into a clean refusal, visible in the journal.
gpg --yes- Answers "yes" to the remaining questions, chiefly overwriting an output file that already exists.
gpg --list-packets- Details the structure of an OpenPGP file, including the id of the key the archive is addressed to. Use it to confirm an archive really is encrypted to the intended key.
gpg --decrypt- Decrypts a file with the matching private key. On a machine that does not hold it, the command stops on
No secret key. gpg --symmetric- Encrypts with a passphrase instead of a public key. Decrypting needs the same passphrase, so a script that encrypts this way holds everything needed to reopen everything.
gpg --passphrase-file- Reads the passphrase from a file instead of asking for it. It is what makes symmetric encryption possible unattended — and what puts the passphrase on the machine you are protecting.