DOC HOME SITE MAP MAN PAGES GNU INFO SEARCH
 

(gnupg1.info.gz) GPG Esoteric Options

Info Catalog (gnupg1.info.gz) OpenPGP Options (gnupg1.info.gz) GPG Options
 
 1.2.6 Doing things one usually doesn't want to do.
 --------------------------------------------------
 
 `-n'
 `--dry-run'
      Don't make any changes (this is not completely implemented).
 
 `--list-only'
      Changes the behaviour of some commands. This is like `--dry-run'
      but different in some cases. The semantic of this command may be
      extended in the future. Currently it only skips the actual
      decryption pass and therefore enables a fast listing of the
      encryption keys.
 
 `-i'
 `--interactive'
      Prompt before overwriting any files.
 
 `--debug FLAGS'
      Set debugging flags. All flags are or-ed and FLAGS may be given in
      C syntax (e.g. 0x0042).
 
 `--debug-all'
      Set all useful debugging flags.
 
 `--debug-ccid-driver'
      Enable debug output from the included CCID driver for smartcards.
      Note that this option is only available on some system.
 
 `--enable-progress-filter'
      Enable certain PROGRESS status outputs. This option allows
      frontends to display a progress indicator while gpg is processing
      larger files.  There is a slight performance overhead using it.
 
 `--status-fd `n''
      Write special status strings to the file descriptor `n'.  See the
      file DETAILS in the documentation for a listing of them.
 
 `--status-file `file''
      Same as `--status-fd', except the status data is written to file
      `file'.
 
 `--logger-fd `n''
      Write log output to file descriptor `n' and not to stderr.
 
 `--logger-file `file''
      Same as `--logger-fd', except the logger data is written to file
      `file'.
 
 `--attribute-fd `n''
      Write attribute subpackets to the file descriptor `n'. This is most
      useful for use with `--status-fd', since the status messages are
      needed to separate out the various subpackets from the stream
      delivered to the file descriptor.
 
 `--attribute-file `file''
      Same as `--attribute-fd', except the attribute data is written to
      file `file'.
 
 `--comment `string''
 `--no-comments'
      Use `string' as a comment string in clear text signatures and ASCII
      armored messages or keys (see `--armor'). The default behavior is
      not to use a comment string. `--comment' may be repeated multiple
      times to get multiple comment strings. `--no-comments' removes all
      comments.  It is a good idea to keep the length of a single comment
      below 60 characters to avoid problems with mail programs wrapping
      such lines.  Note that comment lines, like all other header lines,
      are not protected by the signature.
 
 `--emit-version'
 `--no-emit-version'
      Force inclusion of the version string in ASCII armored output.
      `--no-emit-version' disables this option.
 
 `--sig-notation `name=value''
 `--cert-notation `name=value''
 `-N, --set-notation `name=value''
      Put the name value pair into the signature as notation data.
      `name' must consist only of printable characters or spaces, and
      must contain a '@' character in the form keyname@domain.example.com
      (substituting the appropriate keyname and domain name, of course).
      This is to help prevent pollution of the IETF reserved notation
      namespace. The `--expert' flag overrides the '@' check. `value'
      may be any printable string; it will be encoded in UTF8, so you
      should check that your `--display-charset' is set correctly. If
      you prefix `name' with an exclamation mark (!), the notation data
      will be flagged as critical (rfc2440:5.2.3.15). `--sig-notation'
      sets a notation for data signatures. `--cert-notation' sets a
      notation for key signatures (certifications). `--set-notation'
      sets both.
 
      There are special codes that may be used in notation names. "%k"
      will be expanded into the key ID of the key being signed, "%K"
      into the long key ID of the key being signed, "%f" into the
      fingerprint of the key being signed, "%s" into the key ID of the
      key making the signature, "%S" into the long key ID of the key
      making the signature, "%g" into the fingerprint of the key making
      the signature (which might be a subkey), "%p" into the fingerprint
      of the primary key of the key making the signature, "%c" into the
      signature count from the OpenPGP smartcard, and "%%" results in a
      single "%". %k, %K, and %f are only meaningful when making a key
      signature (certification), and %c is only meaningful when using
      the OpenPGP smartcard.
 
 `--sig-policy-url `string''
 `--cert-policy-url `string''
 `--set-policy-url `string''
      Use `string' as a Policy URL for signatures (rfc2440:5.2.3.19).  If
      you prefix it with an exclamation mark (!), the policy URL packet
      will be flagged as critical. `--sig-policy-url' sets a policy url
      for data signatures. `--cert-policy-url' sets a policy url for key
      signatures (certifications). `--set-policy-url' sets both.
 
      The same %-expandos used for notation data are available here as
      well.
 
 `--sig-keyserver-url `string''
      Use `string' as a preferred keyserver URL for data signatures. If
      you prefix it with an exclamation mark (!), the keyserver URL
      packet will be flagged as critical.
 
      The same %-expandos used for notation data are available here as
      well.
 
 `--set-filename `string''
      Use `string' as the filename which is stored inside messages.
      This overrides the default, which is to use the actual filename of
      the file being encrypted.
 
 `--for-your-eyes-only'
 `--no-for-your-eyes-only'
      Set the `for your eyes only' flag in the message. This causes GnuPG
      to refuse to save the file unless the `--output' option is given,
      and PGP to use the "secure viewer" with a Tempest-resistant font to
      display the message. This option overrides `--set-filename'.
      `--no-for-your-eyes-only' disables this option.
 
 `--use-embedded-filename'
 `--no-use-embedded-filename'
      Try to create a file with a name as embedded in the data. This can
      be a dangerous option as it allows to overwrite files. Defaults to
      no.
 
 `--cipher-algo `name''
      Use `name' as cipher algorithm. Running the program with the
      command `--version' yields a list of supported algorithms. If this
      is not used the cipher algorithm is selected from the preferences
      stored with the key. In general, you do not want to use this
      option as it allows you to violate the OpenPGP standard.
      `--personal-cipher-preferences' is the safe way to accomplish the
      same thing.
 
 `--digest-algo `name''
      Use `name' as the message digest algorithm. Running the program
      with the command `--version' yields a list of supported
      algorithms. In general, you do not want to use this option as it
      allows you to violate the OpenPGP standard.
      `--personal-digest-preferences' is the safe way to accomplish the
      same thing.
 
 `--compress-algo `name''
      Use compression algorithm `name'. "zlib" is RFC-1950 ZLIB
      compression. "zip" is RFC-1951 ZIP compression which is used by
      PGP.  "bzip2" is a more modern compression scheme that can
      compress some things better than zip or zlib, but at the cost of
      more memory used during compression and decompression.
      "uncompressed" or "none" disables compression. If this option is
      not used, the default behavior is to examine the recipient key
      preferences to see which algorithms the recipient supports. If all
      else fails, ZIP is used for maximum compatibility.
 
      ZLIB may give better compression results than ZIP, as the
      compression window size is not limited to 8k. BZIP2 may give even
      better compression results than that, but will use a significantly
      larger amount of memory while compressing and decompressing. This
      may be significant in low memory situations. Note, however, that
      PGP (all versions) only supports ZIP compression. Using any
      algorithm other than ZIP or "none" will make the message
      unreadable with PGP. In general, you do not want to use this
      option as it allows you to violate the OpenPGP standard.
      `--personal-compress-preferences' is the safe way to accomplish
      the same thing.
 
 `--cert-digest-algo `name''
      Use `name' as the message digest algorithm used when signing a
      key. Running the program with the command `--version' yields a
      list of supported algorithms. Be aware that if you choose an
      algorithm that GnuPG supports but other OpenPGP implementations do
      not, then some users will not be able to use the key signatures
      you make, or quite possibly your entire key.
 
 `--disable-cipher-algo `name''
      Never allow the use of `name' as cipher algorithm.  The given name
      will not be checked so that a later loaded algorithm will still
      get disabled.
 
 `--disable-pubkey-algo `name''
      Never allow the use of `name' as public key algorithm.  The given
      name will not be checked so that a later loaded algorithm will
      still get disabled.
 
 `--throw-keyids'
 `--no-throw-keyids'
      Do not put the recipient key IDs into encrypted messages. This
      helps to hide the receivers of the message and is a limited
      countermeasure against traffic analysis. On the receiving side, it
      may slow down the decryption process because all available secret
      keys must be tried.  `--no-throw-keyids' disables this option.
      This option is essentially the same as using `--hidden-recipient'
      for all recipients.
 
 `--not-dash-escaped'
      This option changes the behavior of cleartext signatures so that
      they can be used for patch files. You should not send such an
      armored file via email because all spaces and line endings are
      hashed too. You can not use this option for data which has 5
      dashes at the beginning of a line, patch files don't have this. A
      special armor header line tells GnuPG about this cleartext
      signature option.
 
 `--escape-from-lines'
 `--no-escape-from-lines'
      Because some mailers change lines starting with "From " to ">From
      " it is good to handle such lines in a special way when creating
      cleartext signatures to prevent the mail system from breaking the
      signature. Note that all other PGP versions do it this way too.
      Enabled by default. `--no-escape-from-lines' disables this option.
 
 `--passphrase-repeat `n''
      Specify how many times `gpg' will request a new passphrase be
      repeated.  This is useful for helping memorize a passphrase.
      Defaults to 1 repetition.
 
 `--passphrase-fd `n''
      Read the passphrase from file descriptor `n'. Only the first line
      will be read from file descriptor `n'. If you use 0 for `n', the
      passphrase will be read from stdin. This can only be used if only
      one passphrase is supplied.
 
 `--passphrase-file `file''
      Read the passphrase from file `file'. Only the first line will be
      read from file `file'. This can only be used if only one
      passphrase is supplied. Obviously, a passphrase stored in a file is
      of questionable security if other users can read this file. Don't
      use this option if you can avoid it.
 
 `--passphrase `string''
      Use `string' as the passphrase. This can only be used if only one
      passphrase is supplied. Obviously, this is of very questionable
      security on a multi-user system. Don't use this option if you can
      avoid it.
 
 `--command-fd `n''
      This is a replacement for the deprecated shared-memory IPC mode.
      If this option is enabled, user input on questions is not expected
      from the TTY but from the given file descriptor. It should be used
      together with `--status-fd'. See the file doc/DETAILS in the source
      distribution for details on how to use it.
 
 `--command-file `file''
      Same as `--command-fd', except the commands are read out of file
      `file'
 
 `--allow-non-selfsigned-uid'
 `--no-allow-non-selfsigned-uid'
      Allow the import and use of keys with user IDs which are not
      self-signed. This is not recommended, as a non self-signed user ID
      is trivial to forge. `--no-allow-non-selfsigned-uid' disables.
 
 `--allow-freeform-uid'
      Disable all checks on the form of the user ID while generating a
      new one. This option should only be used in very special
      environments as it does not ensure the de-facto standard format of
      user IDs.
 
 `--ignore-time-conflict'
      GnuPG normally checks that the timestamps associated with keys and
      signatures have plausible values. However, sometimes a signature
      seems to be older than the key due to clock problems. This option
      makes these checks just a warning. See also `--ignore-valid-from'
      for timestamp issues on subkeys.
 
 `--ignore-valid-from'
      GnuPG normally does not select and use subkeys created in the
      future.  This option allows the use of such keys and thus exhibits
      the pre-1.0.7 behaviour. You should not use this option unless you
      there is some clock problem. See also `--ignore-time-conflict' for
      timestamp issues with signatures.
 
 `--ignore-crc-error'
      The ASCII armor used by OpenPGP is protected by a CRC checksum
      against transmission errors. Occasionally the CRC gets mangled
      somewhere on the transmission channel but the actual content
      (which is protected by the OpenPGP protocol anyway) is still okay.
      This option allows GnuPG to ignore CRC errors.
 
 `--ignore-mdc-error'
      This option changes a MDC integrity protection failure into a
      warning.  This can be useful if a message is partially corrupt,
      but it is necessary to get as much data as possible out of the
      corrupt message.  However, be aware that a MDC protection failure
      may also mean that the message was tampered with intentionally by
      an attacker.
 
 `--no-default-keyring'
      Do not add the default keyrings to the list of keyrings. Note that
      GnuPG will not operate without any keyrings, so if you use this
      option and do not provide alternate keyrings via `--keyring' or
      `--secret-keyring', then GnuPG will still use the default public or
      secret keyrings.
 
 `--skip-verify'
      Skip the signature verification step. This may be used to make the
      decryption faster if the signature verification is not needed.
 
 `--with-key-data'
      Print key listings delimited by colons (like `--with-colons') and
      print the public key data.
 
 `--fast-list-mode'
      Changes the output of the list commands to work faster; this is
      achieved by leaving some parts empty. Some applications don't need
      the user ID and the trust information given in the listings. By
      using this options they can get a faster listing. The exact
      behaviour of this option may change in future versions.  If you
      are missing some information, don't use this option.
 
 `--no-literal'
      This is not for normal use. Use the source to see for what it
      might be useful.
 
 `--set-filesize'
      This is not for normal use. Use the source to see for what it
      might be useful.
 
 `--show-session-key'
      Display the session key used for one message. See
      `--override-session-key' for the counterpart of this option.
 
      We think that Key Escrow is a Bad Thing; however the user should
      have the freedom to decide whether to go to prison or to reveal
      the content of one specific message without compromising all
      messages ever encrypted for one secret key. DON'T USE IT UNLESS
      YOU ARE REALLY FORCED TO DO SO.
 
 `--override-session-key `string''
      Don't use the public key but the session key `string'. The format
      of this string is the same as the one printed by
      `--show-session-key'. This option is normally not used but comes
      handy in case someone forces you to reveal the content of an
      encrypted message; using this option you can do this without
      handing out the secret key.
 
 `--ask-sig-expire'
 `--no-ask-sig-expire'
      When making a data signature, prompt for an expiration time. If
      this option is not specified, the expiration time set via
      `--default-sig-expire' is used. `--no-ask-sig-expire' disables
      this option. Note that by default, `--force-v3-sigs' is set which
      also disables this option. If you want signature expiration, you
      must set `--no-force-v3-sigs' as well as turning
      `--ask-sig-expire' on.
 
 `--default-sig-expire'
      The default expiration time to use for signature expiration. Valid
      values are "0" for no expiration, a number followed by the letter d
      (for days), w (for weeks), m (for months), or y (for years) (for
      example "2m" for two months, or "5y" for five years), or an
      absolute date in the form YYYY-MM-DD. Defaults to "0".
 
 `--ask-cert-expire'
 `--no-ask-cert-expire'
      When making a key signature, prompt for an expiration time. If this
      option is not specified, the expiration time set via
      `--default-cert-expire' is used. `--no-ask-cert-expire' disables
      this option.
 
 `--default-cert-expire'
      The default expiration time to use for key signature expiration.
      Valid values are "0" for no expiration, a number followed by the
      letter d (for days), w (for weeks), m (for months), or y (for
      years) (for example "2m" for two months, or "5y" for five years),
      or an absolute date in the form YYYY-MM-DD. Defaults to "0".
 
 `--allow-secret-key-import'
      This is an obsolete option and is not used anywhere.
 
 `--allow-multiple-messages'
 
 `--no-allow-multiple-messages'
      Allow processing of multiple OpenPGP messages contained in a single
      file or stream.  Some programs that call GPG are not prepared to
      deal with multiple messages being processed together, so this
      option defaults to no.  Note that versions of GPG prior to 1.4.7
      always allowed multiple messages.
 
 `--enable-special-filenames'
      This options enables a mode in which filenames of the form `-&n',
      where n is a non-negative decimal number, refer to the file
      descriptor n and not to a file with that name.
 
 `--no-expensive-trust-checks'
      Experimental use only.
 
 `--preserve-permissions'
      Don't change the permissions of a secret keyring back to user
      read/write only. Use this option only if you really know what you
      are doing.
 
 `--default-preference-list `string''
      Set the list of default preferences to `string'. This preference
      list is used for new keys and becomes the default for "setpref" in
      the edit menu.
 
 `--default-keyserver-url `name''
      Set the default keyserver URL to `name'. This keyserver will be
      used as the keyserver URL when writing a new self-signature on a
      key, which includes key generation and changing preferences.
 
 `--list-config'
      Display various internal configuration parameters of GnuPG. This
      option is intended for external programs that call GnuPG to
      perform tasks, and is thus not generally useful. See the file
      `doc/DETAILS' in the source distribution for the details of which
      configuration items may be listed. `--list-config' is only usable
      with `--with-colons' set.
 
 `--gpgconf-list'
      This command is simliar to `--list-config' but in general only
      internally used by the `gpgconf' tool.
 
 `--gpgconf-test'
      This is more or less dummy action.  However it parses the
      configuration file and returns with failure if the configuraion
      file would prevent `gpg' from startup.  Thus it may be used to run
      a syntax check on the configuration file.
 
 
 1.2.7 Deprecated options
 ------------------------
 
 `--load-extension `name''
      Load an extension module. If `name' does not contain a slash it is
      searched for in the directory configured when GnuPG was built
      (generally "/usr/local/lib/gnupg"). Extensions are not generally
      useful anymore, and the use of this option is deprecated.
 
 `--show-photos'
 `--no-show-photos'
      Causes `--list-keys', `--list-sigs', `--list-public-keys',
      `--list-secret-keys', and verifying a signature to also display
      the photo ID attached to the key, if any. See also
      `--photo-viewer'. These options are deprecated. Use
      `--list-options [no-]show-photos' and/or `--verify-options
      [no-]show-photos' instead.
 
 `--show-keyring'
      Display the keyring name at the head of key listings to show which
      keyring a given key resides on. This option is deprecated: use
      `--list-options [no-]show-keyring' instead.
 
 `--ctapi-driver `file''
      Use `file' to access the smartcard reader. The current default is
      `libtowitoko.so'. Note that the use of this interface is
      deprecated; it may be removed in future releases.
 
 `--always-trust'
      Identical to `--trust-model always'. This option is deprecated.
 
 `--show-notation'
 `--no-show-notation'
      Show signature notations in the `--list-sigs' or `--check-sigs'
      listings as well as when verifying a signature with a notation in
      it. These options are deprecated. Use `--list-options
      [no-]show-notation' and/or `--verify-options [no-]show-notation'
      instead.
 
 `--show-policy-url'
 `--no-show-policy-url'
      Show policy URLs in the `--list-sigs' or `--check-sigs' listings
      as well as when verifying a signature with a policy URL in it.
      These options are deprecated. Use `--list-options
      [no-]show-policy-url' and/or `--verify-options
      [no-]show-policy-url' instead.
 
 
Info Catalog (gnupg1.info.gz) OpenPGP Options (gnupg1.info.gz) GPG Options
automatically generated byinfo2html