Setting up GPG clients

Using Code Sign Manager, GPG keys can be stored and protected in the Trust Protection Foundation secret store or on a connected HSM. Code Sign Manager presents those keys to code signing workstations as if they were on an HSM or Smart Card connected to the code signing workstation itself. Code Sign Manager accomplishes this by implementing the GnuPG SCDaemon protocol to emulate a Smart Card.

Any individual code signing workstation can have many GPG keys synced to it. All of the synced keys are available for GPG operations, and Code Sign Manager seamlessly switches between them based on the key used in the operation. If new keys are made available to the user in Code Sign Manager, they can be synced to the workstation. If keys are deleted or expired, they can no longer be used for GPG operations.

The private GPG keys themselves never leave the Trust Protection Foundation. When the keys are synced to the code signing workstations, Code Sign Manager exports the public key with a signature that gets inserted into the GPG keychain, along with a stub for the private key that identifies which emulated Smart Card to use when using the private key.

The GPG architecture requires three separate keys: a signing key, an encryption key, and an authentication key. A Code Sign Manager GPG environment provides all three, and they are all fully functional.

Before you configure a GPG client, a Code Signing Administrator and a Project Owner must set up the GPG Environment that provides the keys. For the complete setup workflow, including who does each step, see Working with GPG.