Signing and encrypting with GPG

Signing or decrypting with GPG keys protected by Code Sign Manager should behave as it would when using GPG with a local key, except that you cannot export the private key.

To sign git commits and tags, see Signing git commits with GPG.

Specifying a key

When signing with GPG, you must specify the key to use for the operation. This is done by specifying either the uid (user ID) or the fingerprint of the key.

GPG attempts to make this as easy as possible by allowing a partial uid. It will use the first key with a uid that contains the value you specify. This means that, in most cases, you can use the email address or the real name from the uid.

Exporting and importing a public key

Verifying something such as a document, package, or container that has been signed with GPG and Code Sign Manager requires having the matching public key in your keychain. If you are the one performing the signing then it will already be present and trusted after running gpgconfig sync, but other users who need to verify things that you sign will need to have it in their keychain as well.

Your public key can be exported using this command:

This resulting file can be imported on another machine:

Once imported the trust level can be set:

A public key exported in this manner must be provided to users in a way that they can trust. This is usually done by providing a web page. As an example, RedHat makes theirs available here:

https://access.redhat.com/security/team/key/

To let GPG clients find your key automatically, or to have GitLab verify your commits, see Working with GPG.

Simple Signing Example

The most basic operation that can be done with GPG and Code Sign Manager is to sign an arbitrary document.

1. Sign a file.

   This command creates a hash of the contents of example.txt, creates a signature using Code Sign Manager, and then writes the result to example.txt.gpg:

   $ gpg --sign --default-key jake@example.com example.txt

2. Verify a signed file

   Anyone can verify a signature that you have created if they have your public key in their key chain:

   $ gpg --verify example.txt.gpg

   This will print a verification message similar to the following:

   gpg: Signature made Thu Jun 11 13:35:58 2020 MDT

   gpg: using RSA key 058CF99A22C4A330AB399E5BD06372BC27CCCD13

   gpg: issuer "jake@example.com"

   gpg: Good signature from "Jake Smith <jake@example.com>" [ultimate]

Simple Encryption Example

Anyone can encrypt a document intended for you if they have your public key in their keychain. The encrypted document will be saved with a .gpg extension appended to the original filename:

Only people with access to the matching private key will be able to decrypt it:

Signing an RPM

Ensure that you have the rpm-sign package installed

Export the public key that will be used for signing RPMs, and import it into the RPM keyring:

List the keys in the rpm keyring to verify it:

Configure rpm to use your key by setting the following values in your ~/.rpmmacros file:

Sign your RPM while building: (The 'echo ""' and 'setsid' commands are used to avoid prompting for a passphrase, which we do not use.)

Verify the signature on any machine with your public key in the keyring: