(gnupg1.info.gz) GPG Esoteric Options
Info Catalog
(gnupg1.info.gz) OpenPGP Options
(gnupg1.info.gz) GPG Options
1.2.6 Doing things one usually doesn't want to do.
--------------------------------------------------
`-n'
`--dry-run'
Don't make any changes (this is not completely implemented).
`--list-only'
Changes the behaviour of some commands. This is like `--dry-run'
but different in some cases. The semantic of this command may be
extended in the future. Currently it only skips the actual
decryption pass and therefore enables a fast listing of the
encryption keys.
`-i'
`--interactive'
Prompt before overwriting any files.
`--debug FLAGS'
Set debugging flags. All flags are or-ed and FLAGS may be given in
C syntax (e.g. 0x0042).
`--debug-all'
Set all useful debugging flags.
`--debug-ccid-driver'
Enable debug output from the included CCID driver for smartcards.
Note that this option is only available on some system.
`--enable-progress-filter'
Enable certain PROGRESS status outputs. This option allows
frontends to display a progress indicator while gpg is processing
larger files. There is a slight performance overhead using it.
`--status-fd `n''
Write special status strings to the file descriptor `n'. See the
file DETAILS in the documentation for a listing of them.
`--status-file `file''
Same as `--status-fd', except the status data is written to file
`file'.
`--logger-fd `n''
Write log output to file descriptor `n' and not to stderr.
`--logger-file `file''
Same as `--logger-fd', except the logger data is written to file
`file'.
`--attribute-fd `n''
Write attribute subpackets to the file descriptor `n'. This is most
useful for use with `--status-fd', since the status messages are
needed to separate out the various subpackets from the stream
delivered to the file descriptor.
`--attribute-file `file''
Same as `--attribute-fd', except the attribute data is written to
file `file'.
`--comment `string''
`--no-comments'
Use `string' as a comment string in clear text signatures and ASCII
armored messages or keys (see `--armor'). The default behavior is
not to use a comment string. `--comment' may be repeated multiple
times to get multiple comment strings. `--no-comments' removes all
comments. It is a good idea to keep the length of a single comment
below 60 characters to avoid problems with mail programs wrapping
such lines. Note that comment lines, like all other header lines,
are not protected by the signature.
`--emit-version'
`--no-emit-version'
Force inclusion of the version string in ASCII armored output.
`--no-emit-version' disables this option.
`--sig-notation `name=value''
`--cert-notation `name=value''
`-N, --set-notation `name=value''
Put the name value pair into the signature as notation data.
`name' must consist only of printable characters or spaces, and
must contain a '@' character in the form keyname@domain.example.com
(substituting the appropriate keyname and domain name, of course).
This is to help prevent pollution of the IETF reserved notation
namespace. The `--expert' flag overrides the '@' check. `value'
may be any printable string; it will be encoded in UTF8, so you
should check that your `--display-charset' is set correctly. If
you prefix `name' with an exclamation mark (!), the notation data
will be flagged as critical (rfc2440:5.2.3.15). `--sig-notation'
sets a notation for data signatures. `--cert-notation' sets a
notation for key signatures (certifications). `--set-notation'
sets both.
There are special codes that may be used in notation names. "%k"
will be expanded into the key ID of the key being signed, "%K"
into the long key ID of the key being signed, "%f" into the
fingerprint of the key being signed, "%s" into the key ID of the
key making the signature, "%S" into the long key ID of the key
making the signature, "%g" into the fingerprint of the key making
the signature (which might be a subkey), "%p" into the fingerprint
of the primary key of the key making the signature, "%c" into the
signature count from the OpenPGP smartcard, and "%%" results in a
single "%". %k, %K, and %f are only meaningful when making a key
signature (certification), and %c is only meaningful when using
the OpenPGP smartcard.
`--sig-policy-url `string''
`--cert-policy-url `string''
`--set-policy-url `string''
Use `string' as a Policy URL for signatures (rfc2440:5.2.3.19). If
you prefix it with an exclamation mark (!), the policy URL packet
will be flagged as critical. `--sig-policy-url' sets a policy url
for data signatures. `--cert-policy-url' sets a policy url for key
signatures (certifications). `--set-policy-url' sets both.
The same %-expandos used for notation data are available here as
well.
`--sig-keyserver-url `string''
Use `string' as a preferred keyserver URL for data signatures. If
you prefix it with an exclamation mark (!), the keyserver URL
packet will be flagged as critical.
The same %-expandos used for notation data are available here as
well.
`--set-filename `string''
Use `string' as the filename which is stored inside messages.
This overrides the default, which is to use the actual filename of
the file being encrypted.
`--for-your-eyes-only'
`--no-for-your-eyes-only'
Set the `for your eyes only' flag in the message. This causes GnuPG
to refuse to save the file unless the `--output' option is given,
and PGP to use the "secure viewer" with a Tempest-resistant font to
display the message. This option overrides `--set-filename'.
`--no-for-your-eyes-only' disables this option.
`--use-embedded-filename'
`--no-use-embedded-filename'
Try to create a file with a name as embedded in the data. This can
be a dangerous option as it allows to overwrite files. Defaults to
no.
`--cipher-algo `name''
Use `name' as cipher algorithm. Running the program with the
command `--version' yields a list of supported algorithms. If this
is not used the cipher algorithm is selected from the preferences
stored with the key. In general, you do not want to use this
option as it allows you to violate the OpenPGP standard.
`--personal-cipher-preferences' is the safe way to accomplish the
same thing.
`--digest-algo `name''
Use `name' as the message digest algorithm. Running the program
with the command `--version' yields a list of supported
algorithms. In general, you do not want to use this option as it
allows you to violate the OpenPGP standard.
`--personal-digest-preferences' is the safe way to accomplish the
same thing.
`--compress-algo `name''
Use compression algorithm `name'. "zlib" is RFC-1950 ZLIB
compression. "zip" is RFC-1951 ZIP compression which is used by
PGP. "bzip2" is a more modern compression scheme that can
compress some things better than zip or zlib, but at the cost of
more memory used during compression and decompression.
"uncompressed" or "none" disables compression. If this option is
not used, the default behavior is to examine the recipient key
preferences to see which algorithms the recipient supports. If all
else fails, ZIP is used for maximum compatibility.
ZLIB may give better compression results than ZIP, as the
compression window size is not limited to 8k. BZIP2 may give even
better compression results than that, but will use a significantly
larger amount of memory while compressing and decompressing. This
may be significant in low memory situations. Note, however, that
PGP (all versions) only supports ZIP compression. Using any
algorithm other than ZIP or "none" will make the message
unreadable with PGP. In general, you do not want to use this
option as it allows you to violate the OpenPGP standard.
`--personal-compress-preferences' is the safe way to accomplish
the same thing.
`--cert-digest-algo `name''
Use `name' as the message digest algorithm used when signing a
key. Running the program with the command `--version' yields a
list of supported algorithms. Be aware that if you choose an
algorithm that GnuPG supports but other OpenPGP implementations do
not, then some users will not be able to use the key signatures
you make, or quite possibly your entire key.
`--disable-cipher-algo `name''
Never allow the use of `name' as cipher algorithm. The given name
will not be checked so that a later loaded algorithm will still
get disabled.
`--disable-pubkey-algo `name''
Never allow the use of `name' as public key algorithm. The given
name will not be checked so that a later loaded algorithm will
still get disabled.
`--throw-keyids'
`--no-throw-keyids'
Do not put the recipient key IDs into encrypted messages. This
helps to hide the receivers of the message and is a limited
countermeasure against traffic analysis. On the receiving side, it
may slow down the decryption process because all available secret
keys must be tried. `--no-throw-keyids' disables this option.
This option is essentially the same as using `--hidden-recipient'
for all recipients.
`--not-dash-escaped'
This option changes the behavior of cleartext signatures so that
they can be used for patch files. You should not send such an
armored file via email because all spaces and line endings are
hashed too. You can not use this option for data which has 5
dashes at the beginning of a line, patch files don't have this. A
special armor header line tells GnuPG about this cleartext
signature option.
`--escape-from-lines'
`--no-escape-from-lines'
Because some mailers change lines starting with "From " to ">From
" it is good to handle such lines in a special way when creating
cleartext signatures to prevent the mail system from breaking the
signature. Note that all other PGP versions do it this way too.
Enabled by default. `--no-escape-from-lines' disables this option.
`--passphrase-repeat `n''
Specify how many times `gpg' will request a new passphrase be
repeated. This is useful for helping memorize a passphrase.
Defaults to 1 repetition.
`--passphrase-fd `n''
Read the passphrase from file descriptor `n'. Only the first line
will be read from file descriptor `n'. If you use 0 for `n', the
passphrase will be read from stdin. This can only be used if only
one passphrase is supplied.
`--passphrase-file `file''
Read the passphrase from file `file'. Only the first line will be
read from file `file'. This can only be used if only one
passphrase is supplied. Obviously, a passphrase stored in a file is
of questionable security if other users can read this file. Don't
use this option if you can avoid it.
`--passphrase `string''
Use `string' as the passphrase. This can only be used if only one
passphrase is supplied. Obviously, this is of very questionable
security on a multi-user system. Don't use this option if you can
avoid it.
`--command-fd `n''
This is a replacement for the deprecated shared-memory IPC mode.
If this option is enabled, user input on questions is not expected
from the TTY but from the given file descriptor. It should be used
together with `--status-fd'. See the file doc/DETAILS in the source
distribution for details on how to use it.
`--command-file `file''
Same as `--command-fd', except the commands are read out of file
`file'
`--allow-non-selfsigned-uid'
`--no-allow-non-selfsigned-uid'
Allow the import and use of keys with user IDs which are not
self-signed. This is not recommended, as a non self-signed user ID
is trivial to forge. `--no-allow-non-selfsigned-uid' disables.
`--allow-freeform-uid'
Disable all checks on the form of the user ID while generating a
new one. This option should only be used in very special
environments as it does not ensure the de-facto standard format of
user IDs.
`--ignore-time-conflict'
GnuPG normally checks that the timestamps associated with keys and
signatures have plausible values. However, sometimes a signature
seems to be older than the key due to clock problems. This option
makes these checks just a warning. See also `--ignore-valid-from'
for timestamp issues on subkeys.
`--ignore-valid-from'
GnuPG normally does not select and use subkeys created in the
future. This option allows the use of such keys and thus exhibits
the pre-1.0.7 behaviour. You should not use this option unless you
there is some clock problem. See also `--ignore-time-conflict' for
timestamp issues with signatures.
`--ignore-crc-error'
The ASCII armor used by OpenPGP is protected by a CRC checksum
against transmission errors. Occasionally the CRC gets mangled
somewhere on the transmission channel but the actual content
(which is protected by the OpenPGP protocol anyway) is still okay.
This option allows GnuPG to ignore CRC errors.
`--ignore-mdc-error'
This option changes a MDC integrity protection failure into a
warning. This can be useful if a message is partially corrupt,
but it is necessary to get as much data as possible out of the
corrupt message. However, be aware that a MDC protection failure
may also mean that the message was tampered with intentionally by
an attacker.
`--no-default-keyring'
Do not add the default keyrings to the list of keyrings. Note that
GnuPG will not operate without any keyrings, so if you use this
option and do not provide alternate keyrings via `--keyring' or
`--secret-keyring', then GnuPG will still use the default public or
secret keyrings.
`--skip-verify'
Skip the signature verification step. This may be used to make the
decryption faster if the signature verification is not needed.
`--with-key-data'
Print key listings delimited by colons (like `--with-colons') and
print the public key data.
`--fast-list-mode'
Changes the output of the list commands to work faster; this is
achieved by leaving some parts empty. Some applications don't need
the user ID and the trust information given in the listings. By
using this options they can get a faster listing. The exact
behaviour of this option may change in future versions. If you
are missing some information, don't use this option.
`--no-literal'
This is not for normal use. Use the source to see for what it
might be useful.
`--set-filesize'
This is not for normal use. Use the source to see for what it
might be useful.
`--show-session-key'
Display the session key used for one message. See
`--override-session-key' for the counterpart of this option.
We think that Key Escrow is a Bad Thing; however the user should
have the freedom to decide whether to go to prison or to reveal
the content of one specific message without compromising all
messages ever encrypted for one secret key. DON'T USE IT UNLESS
YOU ARE REALLY FORCED TO DO SO.
`--override-session-key `string''
Don't use the public key but the session key `string'. The format
of this string is the same as the one printed by
`--show-session-key'. This option is normally not used but comes
handy in case someone forces you to reveal the content of an
encrypted message; using this option you can do this without
handing out the secret key.
`--ask-sig-expire'
`--no-ask-sig-expire'
When making a data signature, prompt for an expiration time. If
this option is not specified, the expiration time set via
`--default-sig-expire' is used. `--no-ask-sig-expire' disables
this option. Note that by default, `--force-v3-sigs' is set which
also disables this option. If you want signature expiration, you
must set `--no-force-v3-sigs' as well as turning
`--ask-sig-expire' on.
`--default-sig-expire'
The default expiration time to use for signature expiration. Valid
values are "0" for no expiration, a number followed by the letter d
(for days), w (for weeks), m (for months), or y (for years) (for
example "2m" for two months, or "5y" for five years), or an
absolute date in the form YYYY-MM-DD. Defaults to "0".
`--ask-cert-expire'
`--no-ask-cert-expire'
When making a key signature, prompt for an expiration time. If this
option is not specified, the expiration time set via
`--default-cert-expire' is used. `--no-ask-cert-expire' disables
this option.
`--default-cert-expire'
The default expiration time to use for key signature expiration.
Valid values are "0" for no expiration, a number followed by the
letter d (for days), w (for weeks), m (for months), or y (for
years) (for example "2m" for two months, or "5y" for five years),
or an absolute date in the form YYYY-MM-DD. Defaults to "0".
`--allow-secret-key-import'
This is an obsolete option and is not used anywhere.
`--allow-multiple-messages'
`--no-allow-multiple-messages'
Allow processing of multiple OpenPGP messages contained in a single
file or stream. Some programs that call GPG are not prepared to
deal with multiple messages being processed together, so this
option defaults to no. Note that versions of GPG prior to 1.4.7
always allowed multiple messages.
`--enable-special-filenames'
This options enables a mode in which filenames of the form `-&n',
where n is a non-negative decimal number, refer to the file
descriptor n and not to a file with that name.
`--no-expensive-trust-checks'
Experimental use only.
`--preserve-permissions'
Don't change the permissions of a secret keyring back to user
read/write only. Use this option only if you really know what you
are doing.
`--default-preference-list `string''
Set the list of default preferences to `string'. This preference
list is used for new keys and becomes the default for "setpref" in
the edit menu.
`--default-keyserver-url `name''
Set the default keyserver URL to `name'. This keyserver will be
used as the keyserver URL when writing a new self-signature on a
key, which includes key generation and changing preferences.
`--list-config'
Display various internal configuration parameters of GnuPG. This
option is intended for external programs that call GnuPG to
perform tasks, and is thus not generally useful. See the file
`doc/DETAILS' in the source distribution for the details of which
configuration items may be listed. `--list-config' is only usable
with `--with-colons' set.
`--gpgconf-list'
This command is simliar to `--list-config' but in general only
internally used by the `gpgconf' tool.
`--gpgconf-test'
This is more or less dummy action. However it parses the
configuration file and returns with failure if the configuraion
file would prevent `gpg' from startup. Thus it may be used to run
a syntax check on the configuration file.
1.2.7 Deprecated options
------------------------
`--load-extension `name''
Load an extension module. If `name' does not contain a slash it is
searched for in the directory configured when GnuPG was built
(generally "/usr/local/lib/gnupg"). Extensions are not generally
useful anymore, and the use of this option is deprecated.
`--show-photos'
`--no-show-photos'
Causes `--list-keys', `--list-sigs', `--list-public-keys',
`--list-secret-keys', and verifying a signature to also display
the photo ID attached to the key, if any. See also
`--photo-viewer'. These options are deprecated. Use
`--list-options [no-]show-photos' and/or `--verify-options
[no-]show-photos' instead.
`--show-keyring'
Display the keyring name at the head of key listings to show which
keyring a given key resides on. This option is deprecated: use
`--list-options [no-]show-keyring' instead.
`--ctapi-driver `file''
Use `file' to access the smartcard reader. The current default is
`libtowitoko.so'. Note that the use of this interface is
deprecated; it may be removed in future releases.
`--always-trust'
Identical to `--trust-model always'. This option is deprecated.
`--show-notation'
`--no-show-notation'
Show signature notations in the `--list-sigs' or `--check-sigs'
listings as well as when verifying a signature with a notation in
it. These options are deprecated. Use `--list-options
[no-]show-notation' and/or `--verify-options [no-]show-notation'
instead.
`--show-policy-url'
`--no-show-policy-url'
Show policy URLs in the `--list-sigs' or `--check-sigs' listings
as well as when verifying a signature with a policy URL in it.
These options are deprecated. Use `--list-options
[no-]show-policy-url' and/or `--verify-options
[no-]show-policy-url' instead.
Info Catalog
(gnupg1.info.gz) OpenPGP Options
(gnupg1.info.gz) GPG Options
automatically generated byinfo2html