-s, --sign | make a signature | help |
-b, --detach-sign | make a detached signature | help |
-e, --encrypt | encrypt data | help |
-d, --decrypt | decrypt data (default) | help |
--verify | verify a signature | help |
-k, --list-keys | list keys | help |
--list-external-keys | list external keys | help |
-K, --list-secret-keys | list secret keys | help |
--list-chain | list certificate chain | help |
--fingerprint | list keys and fingerprints | help |
--generate-key | generate a new key pair | help |
--delete-keys | remove keys from the public keyring | help |
--import | import certificates | help |
--export | export certificates | help |
--learn-card | register a smartcard | help |
--server | run in server mode | help |
--call-dirmngr | pass a command to the dirmngr | help |
--call-protect-tool | invoke gpg-protect-tool | help |
--change-passphrase | change a passphrase | help |
-v, --verbose | Outputs additional information while running. | help + man + man |
-q, --quiet | be somewhat more quiet | help |
--no-tty | don't use the terminal at all | help |
--debug-level LEVEL | Select the debug level for investigating problems. | help + man |
--log-file FILE | When running in server mode, append all logging output to file. | help + man |
--include-certs N | Using n of -2 includes all certificate except for the root cert, -1 includes all certs, 0 does not include any certs, 1 includes only the signers cert and all other positive values include up to n… | help + man |
--policy-file FILE | Change the default name of the policy file to filename. | help + man |
--assume-armor | Assume the input data is PEM encoded. | help + man |
--assume-base64 | Assume the input data is plain base-64 encoded. | help + man |
--assume-binary | Assume the input data is binary encoded. | help + man |
-a, --armor | create ascii armored output | help + man + man |
--base64 | Create Base-64 encoded output; | help + man |
-o, --output FILE | Write output to file. | help + man + man |
-r, --recipient USER-ID | Encrypt to the user id name. | help + man + man |
-u, --local-user USER-ID | Set the user(s) to be used for signing. | help + man + man |
--default-key USER-ID | Use user_id as the standard key for signing. | help + man |
--encrypt-to NAME | encrypt to user ID NAME as well | help |
--keyring FILE | add keyring to the list of keyrings | help |
--disable-dirmngr | Entirely disable the use of the Dirmngr. | help + man |
--auto-issuer-key-retrieve | If a required certificate is missing while validating the chain of certificates, try to load that certificate from an external location. | help + man |
--p12-charset NAME | gpgsm uses the UTF-8 encoding when encoding passphrases for PKCS#12 files. | help + man |
--disable-crl-checks | By default the CRL checks are enabled and the DirMngr is used to check for revoked certificates. | help + man |
--disable-trusted-cert-crl-check | By default the CRL for trusted root certificates are checked like for any other certificates. | help + man |
--enable-ocsp | check validity using OCSP | help + man |
--disable-policy-checks | By default policy checks are enabled. | help + man |
--cipher-algo NAME | Use the cipher algorithm with the ASN.1 object identifier oid for encryption. | help + man |
--digest-algo NAME | Use name as the message digest algorithm. | help + man |
--batch | batch mode: never ask | help |
--yes | assume yes on most questions | help |
--no | assume no on most questions | help |
--status-fd FD | write status info to this FD | help |
--options FILE | Reads configuration from file instead of from the default per-user configuration file. | help + man |
-n, --dry-run | do not make any changes | help |
--audit-log FILE | write an audit log to FILE | help |
--homedir dir | Set the name of the home directory to dir. (in the manual page but not in --help) | man |
--keyserver string | This is a deprecated option. (in the manual page but not in --help) | man |
--agent-program file | Specify an agent program to be used for secret key operations. (in the manual page but not in --help) | man |
--dirmngr-program file | Specify a dirmngr program to be used for CRL checks. (in the manual page but not in --help) | man |
--prefer-system-dirmngr | This option is obsolete and ignored. (in the manual page but not in --help) | man |
--no-autostart | Do not start the gpg-agent or the dirmngr if it has not yet been started and its service is required. (in the manual page but not in --help) | man |
--no-secmem-warning | Do not print a warning when the so called "secure memory" cannot be used. (in the manual page but not in --help) | man |
--log-time | Prefix all log output with a timestamp even if no log file is used. (in the manual page but not in --help) | man |
--enable-policy-checks | (in the manual page but not in --help) | man |
--enable-crl-checks | (in the manual page but not in --help) | man |
--enable-trusted-cert-crl-check | (in the manual page but not in --help) | man |
--force-crl-refresh | Tell the dirmngr to reload the CRL for each request. (in the manual page but not in --help) | man |
--enable-issuer-based-crl-check | Run a CRL check even for certificates which do not have any CRL distribution point. (in the manual page but not in --help) | man |
--disable-ocsp | By default OCSP checks are disabled. (in the manual page but not in --help) | man |
--validation-model name | This option changes the default validation model. (in the manual page but not in --help) | man |
--ignore-cert-extension oid | Add oid to the list of ignored certificate extensions. (in the manual page but not in --help) | man |
--input-size-hint n | This option can be used to tell GPGSM the size of the input data in bytes. (in the manual page but not in --help) | man |
--with-key-data | Displays extra information with the --list-keys commands. (in the manual page but not in --help) | man |
--with-validation | When doing a key listing, do a full validation check for each key and print the result. (in the manual page but not in --help) | man |
--with-md5-fingerprint | For standard key listings, also print the MD5 fingerprint of the certificate. (in the manual page but not in --help) | man |
--with-keygrip | Include the keygrip in standard key listings. (in the manual page but not in --help) | man |
--with-secret | Include info about the presence of a secret key in public key listings done with --with-colons. (in the manual page but not in --help) | man |
--no-pretty-dn | By default gpgsm prints distinguished names (DNs) like the Issuer or Subject in a more readable format (e.g. using a well defined order of the parts). (in the manual page but not in --help) | man |
--chuid uid | Change the current user to uid which may either be a number or a name. (in the manual page but not in --help) | man |
--extra-digest-algo name | Sometimes signatures are broken in that they announce a different digest algorithm than actually used. (in the manual page but not in --help) | man |
--compliance string | Set the compliance mode. (in the manual page but not in --help) | man |
--min-rsa-length n | This option adjusts the compliance mode "de-vs" for stricter key size requirements. (in the manual page but not in --help) | man |
--require-compliance | To check that data has been encrypted according to the rules of the current compliance mode, a gpgsm user needs to evaluate the status lines. (in the manual page but not in --help) | man |
--assert-signer fpr_or_file | This option checks whether at least one valid signature on a file has been made with the specified key. (in the manual page but not in --help) | man |
--always-trust | Force encryption to the specified certificates without any validation of the certificate chain. (in the manual page but not in --help) | man |
--ignore-cert-with-oid oid | Add oid to the list of OIDs to be checked while reading certificates from smartcards. (in the manual page but not in --help) | man |
--faked-system-time epoch | This option is only useful for testing; (in the manual page but not in --help) | man |
--with-ephemeral-keys | Include ephemeral flagged keys in the output of key listings. (in the manual page but not in --help) | man |
--compatibility-flags flags | Set compatibility flags to work around problems due to non-compliant certificates or data. (in the manual page but not in --help) | man |
--debug flags | Set debug flags. (in the manual page but not in --help) | man |
--debug-all | Same as --debug=0xffffffff (in the manual page but not in --help) | man |
--debug-allow-core-dump | Usually gpgsm tries to avoid dumping core by well written code and by disabling core dumps for security reasons. (in the manual page but not in --help) | man |
--debug-no-chain-validation | This is actually not a debugging option but only useful as such. (in the manual page but not in --help) | man |
--debug-ignore-expiration | This is actually not a debugging option but only useful as such. (in the manual page but not in --help) | man |
--passphrase-fd n | Read the passphrase from file descriptor n. (in the manual page but not in --help) | man |
--pinentry-mode mode | Set the pinentry mode to mode. (in the manual page but not in --help) | man |
--request-origin origin | Tell gpgsm to assume that the operation ultimately originated at origin. (in the manual page but not in --help) | man |
--no-common-certs-import | Suppress the import of common certificates on keybox creation. (in the manual page but not in --help) | man |