Security

GPG in Practice

January 1, 2026·2 min read

GPG (GNU Privacy Guard) is the OpenPGP implementation that every Linux distribution ships. It encrypts files, signs commits, signs releases, and verifies package signatures. The interface is famously gnarly; the use cases are not. Three workflows cover 95% of what you'll ever do.

Generating a key

gpg --full-generate-key

# Choose:
#   (1) RSA and RSA — fine
#   or (9) ECC and ECC, then curve 25519 — modern, smaller, faster
# Key size: 4096 if RSA
# Expiration: 2y is reasonable (you can extend later)
# Identity: real name + email you control

The revocation certificate (do this NOW)

If you lose the key or it's compromised, you publish the revocation cert so others stop trusting it. Generate it the day you make the key.

gpg --output ~/key-revocation.asc --gen-revoke 
# Pick reason 0 ("No reason specified"), save it offline

Sharing your public key

# Export
gpg --armor --export your@email > public.key

# Or publish to a keyserver
gpg --keyserver keys.openpgp.org --send-keys 

# Verify your own key fingerprint:
gpg --fingerprint your@email

Workflow 1: encrypt a file for someone

# Import their public key
gpg --import their-public.key

# Encrypt
gpg --encrypt --armor --recipient them@example.com secret.txt
# produces secret.txt.asc — send that

# They decrypt
gpg --decrypt secret.txt.asc > secret.txt

Workflow 2: sign a file

gpg --detach-sign --armor release.tar.gz
# produces release.tar.gz.asc

# Anyone with your public key can verify:
gpg --verify release.tar.gz.asc release.tar.gz

Workflow 3: sign git commits

git config --global user.signingkey 
git config --global commit.gpgsign true

# Per-commit:
git commit -S -m "Signed commit"

# Verify:
git log --show-signature

Upload your public key to GitHub/GitLab/Gitea so they show a "Verified" badge on signed commits.

The agent

gpg-agent caches your passphrase so you don't retype it for every operation. It runs automatically; tune the cache TTL in ~/.gnupg/gpg-agent.conf:

default-cache-ttl 3600
max-cache-ttl 7200
pinentry-program /usr/bin/pinentry-curses

Subkeys (the right way)

Best practice: your primary key only certifies other keys. You add subkeys for signing and encryption, kept on your laptop. Compromise of a laptop doesn't compromise your identity — you can revoke the subkey and issue a new one with the primary, which lives offline on a hardware token or in a safe.

gpg --edit-key 
  > addkey         # add subkey, choose S (sign-only) or E (encrypt-only)
  > save

Common mistakes

Letting keys expire silently. Set a calendar reminder a month before expiration; extend with gpg --edit-key, expire.
Trusting a key without verifying the fingerprint out-of-band. Email is not out-of-band. Phone, in person, or a previously-trusted channel.
Not exporting the primary key offline. If your only copy is on a stolen laptop, you've lost it forever.