gpg-sq(1)

NAME
gpg-sq - OpenPGP encryption and signing tool like gpg

SYNOPSIS
gpg-sq [-s|--sign] [--clear-sign] [-b|--detach-sign] [-e|--encrypt] [-c|--symmetric] [-d|--decrypt] [--verify] [-k|--list-keys] [--list-signatures] [--check-signatures] [--fingerprint] [-K|--list-secret-keys] [--generate-key] [--quick-generate-key] [--quick-add-uid] [--quick-revoke-uid] [--quick-set-expire] [--full-generate-key] [--generate-revocation] [--delete-keys] [--delete-secret-keys] [--quick-sign-key] [--quick-lsign-key] [--quick-revoke-sig] [--sign-key] [--lsign-key] [--edit-key] [--change-passphrase] [--export] [--send-keys] [--receive-keys] [--search-keys] [--refresh-keys] [--import] [--update-trustdb] [--print-md] [--server] [--tofu-policy] [--x-sequoia-parcimonie] [-v|--verbose] [-q|--quiet] [--options] [--log-file] [--default-key] [--encrypt-to] [--group] [--openpgp] [-n|--dry-run] [-i|--interactive] [-a|--armor] [-o|--output] [--textmode] [-z ] [--auto-key-locate] [--auto-key-import] [--include-key-block] [--disable-dirmngr] [-r|--recipient] [-u|--local-user] [--x-sequoia-autostart-parcimonie] [-h|--help] [-V|--version] [ARGS]

DESCRIPTION
This is a re-implementation and drop-in replacement of gpg using the Sequoia OpenPGP implementation.

gpg-sq is not feature-complete. It currently implements a commonly used subset of the signature creation and verification commands, the encryption and decryption commands, the key listing commands, and some miscellaneous commands.

Support for trust models is limited. Currently, the Web-of-Trust ("pgp") and always trust ("always") are implemented.

OPTIONS

-h, --help
    Print help (see a summary with '-h')

-V, --version
    Print version

[ARGS]
    Additional arguments. The semantics of the additional arguments, and if there are any, and how many, is dependent on the selected command.

COMMANDS:

-s, --sign
    make a signature

--clear-sign
    make a clear text signature

-b, --detach-sign
    make a detached signature

-e, --encrypt
    encrypt data

-c, --symmetric
    encryption only with symmetric cipher

-d, --decrypt
    decrypt data (default)

--verify
    verify a signature

-k, --list-keys
    list keys

--list-signatures
    list keys and signatures

--check-signatures
    list and check key signatures

--fingerprint
    list keys and fingerprints

-K, --list-secret-keys
    list secret keys

--generate-key
    generate a new key pair

--quick-generate-key
    quickly generate a new key pair

--quick-add-uid
    quickly add a new user-id

--quick-revoke-uid
    quickly revoke a user-id

--quick-set-expire
    quickly set a new expiration date

--full-generate-key
    full featured key pair generation

--generate-revocation
    generate a revocation certificate

--delete-keys
    remove keys from the public keyring

--delete-secret-keys
    remove keys from the secret keyring

--quick-sign-key
    quickly sign a key

--quick-lsign-key
    quickly sign a key locally

--quick-revoke-sig
    quickly revoke a key signature

--sign-key
    sign a key

--lsign-key
    sign a key locally

--edit-key
    sign or edit a key

--change-passphrase
    change a passphrase

--export
    export keys

--send-keys
    export keys to a keyserver

--receive-keys
    import keys from a keyserver

--search-keys
    search for keys on a keyserver

--refresh-keys
    update all keys from a keyserver

--import
    import/merge keys

--update-trustdb
    update the trust database

--print-md
    print message digests

--server
    run in server mode

--tofu-policy <VALUE>
    set the TOFU policy for a key

SEQUOIA-SPECIFIC EXTENSIONS:

--x-sequoia-parcimonie
    continuously update certificates

--x-sequoia-autostart-parcimonie
    automatically start daemon to update certs

OPTIONS CONTROLLING THE DIAGNOSTIC OUTPUT

-v, --verbose
    verbose

-q, --quiet
    be somewhat more quiet

--options <FILE>
    read options from FILE

--log-file <FILE>
    write server mode logs to FILE

OPTIONS CONTROLLING THE CONFIGURATION

--default-key <NAME>
    use NAME as default secret key

--encrypt-to <NAME>
    encrypt to user ID NAME as well

--group <SPEC>
    set up email aliases

--openpgp
    use strict OpenPGP behavior

-n, --dry-run
    do not make any changes

-i, --interactive
    prompt before overwriting

OPTIONS CONTROLLING THE OUTPUT

-a, --armor
    create ascii armored output

-o, --output <FILE>
    write output to FILE

--textmode
    use canonical text mode

-z <N>
    set compress level to N (0 disables)

OPTIONS CONTROLLING KEY IMPORT AND EXPORT

--auto-key-locate <MECHANISMS>
    use MECHANISMS to locate keys by mail address

--auto-key-import
    import missing key from a signature

--include-key-block
    include the public key in signatures

--disable-dirmngr
    disable all access to the dirmngr

OPTIONS TO SPECIFY KEYS

-r, --recipient <USER-ID>
    encrypt for USER-ID

-u, --local-user <USER-ID>
    use USER-ID to sign or decrypt

ENVIRONMENT

GNUPGHOME
    If set, must contain an absolute path to a directory containing the GnuPG state, i.e. the configuration files, the cert rings, the secret keys, and the trust database. Can be overridden using the the option `--gnupghome`. If unset, and the option `--gnupghome` is not given, defaults to `$HOME/.gnupg`. In the FILES section below, `$GNUPGHOME` is the location of the GnuPG state directory, independently on how it is set (i.e. unset, set via `--gnupghome`, or set via `$GNUPGHOME).

SEQUOIA_CRYPTO_POLICY
    If set, must contain an absolute path to a configuration file that changes which cryptographic algorithms are acceptable. By default, /etc/crypto-policies/back-ends/sequoia.config is read, which on Fedora contains a reasonable policy set by the distribution. See https://docs.rs/sequoia-policy-config/latest/sequoia_policy_config/#format for a description of the file format.

FILES

$GNUPGHOME/gpg.conf
    GnuPG's main configuration file.

$GNUPGHOME/dirmngr.conf
    GnuPG's network configuration file. gpg-sq reads this and honors a subset of the options given.

$XDG_DATA_HOME/pgp.cert.d
    Default certificate store on POSIX systems if the default `GNUPGHOME` is used. This location is read and written to.

$HOME/Library/Application Support/pgp.cert.d
    Default certificate store on macOS if the default `GNUPGHOME` is used. This location is read and written to.

{FOLDERID_RoamingAppData}/pgp.cert.d
    Default certificate store on Windows if the default `GNUPGHOME` is used. This location is read and written to.

$GNUPGHOME/pubring.cert.d
    Certificate store if a non-default `GNUPGHOME` is used. This location is read and written to.

$GNUPGHOME/pubring.kbx
    GnuPG's default certificate store. This file is read and monitored for changes, but never changed.

$GNUPGHOME/pubring.gpg
    GnuPG's legacy certificate store. This file is read and monitored for changes, but never changed.

$GNUPGHOME/public-keys.d/pubring.db
    GnuPG 2.4.x's certificate store. This file is read and monitored for changes, but never changed.

$GNUPGHOME/secring.gpg
    GnuPG's legacy secret key store. gpg-sq does not use this file, except for doing a migration from pre-2.1 state directories.

$GNUPGHOME/.gpg-v21-migrated
    Indicates that the state directory has been migrated from a pre-2.1 release.

$GNUPGHOME/trustdb.gpg
    GnuPG's trust database. This file is read and monitored for changes, but never modified.

/etc/crypto-policies/back-ends/sequoia.config
    Default cryptographic policy. On Fedora, this contains a reasonable policy set by the distribution. Can be overridden using the SEQUOIA_POLICY_CONFIG environment variable. See https://docs.rs/sequoia-policy-config/latest/sequoia_policy_config/#format for a description of the file format.

VERSION
v0.13.1