OPENPGPKEY(1)

📦
version 3.6 · 3 versions
, in epel 10, epel 9, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable

💖 OPENPGPKEY(1) 💖

okay bestie, this one's from the Internet / DNS corner of the man page world, and it's literally about shoving your PGP keys into DNS. buckle up 🎀

✨ NAME ✨

openpgpkey — Create and verify RFC-TBD OPENPGPKEY DNS records

🌸 SYNTAX 🌸

openpgpkey [--fetch | --verify] [--insecure] [--resolv.conf
/PATH/TO/RESOLV.CONF] user@domain

openpgpkey [--create] [--insecure] [--resolv.conf /PATH/TO/RESOLV.CONF]
[--output {rfc,generic,both}] [--uid <uid>] [--keyid <keyid>]
user@domain

🦋 DESCRIPTION 🦋

so openpgpkey generates RFC-7929 OPENPGPKEY DNS records, no cap. it's giving "my public key, but make it DNS".

here's the tea: if you're dealing with older nameserver implementations that do not yet support the OPENPGPKEY record, you pass --output generic and it'll spit the openpgpkey data out in Generic Record (RFC-3597) format instead. iconic workaround energy 💅

how are the records made? it pulls all keys with the specified email address associated with it straight outta the user's local GnuPG keychain. yes queen, your local keychain.

and verification? verifying OPENPGPKEY records works by comparing the keyid and fingerprint of the OPENPGPKEY obtained from DNS with the version in the local GnuPG keychain. two keys walk into a bar, one of them is a liar 😭

💅 OPTIONS 💅

  • --fetch — Fetch an OPENPGPKEY public key record from DNS. go get it 🫶
  • --create — Create an OPENPGPKEY DNS record. build the thing ✨
  • --verify — Verify a public key from the local GPG keyring with the OPENPGPKEY DNS record. the vibe check 🔍
  • --resolvconf FILE — Specify a custom resolv.conf file (default: /etc/resolv.conf)
  • --output rfc | generic | both — Output format of OPENPGPKEY record. "OPENPGPKEY" for rfc, "TYPE61" for generic (default: generic)
also, sneaky lil note: if neither create or verify is specified, create is used. it just defaults, bestie, no drama 💜
ngl, the synopsis also shows --insecure, --resolv.conf /PATH/TO/RESOLV.CONF, --uid <uid> and --keyid <keyid> — but the OPTIONS list above is all this page describes. i'm just telling you what's on the page, fr fr. 🙈

🌈 REQUIREMENTS 🌈

openpgpkey requires the following python libraries: unbound, gnupg and argparse. it also requires gnupg which provides the gpg command. yes, gnupg gets a double mention. it's the main character here 👑

💀 BUGS 💀

none known 🎉

🍓 EXAMPLES 🍓

typical usage:

openpgpkey --fetch paul@nohats.ca > paul.pubkey

openpgpkey --verify paul@nohats.ca

openpgpkey --create paul@nohats.ca

⭐ SEE ALSO ⭐

👑 AUTHORS 👑

Paul Wouters <pwouters@redhat.com>

Copyright 2014-2022

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License (file COPYING in the distribution) for more details.

okay that's the whole page bestie, every last crumb of it 🫶 written by Paul Wouters, dated December 30, 2013, and living in OPENPGPKEY(1) — stan a DNS key record, periodt 💖✨🌈

📦 where this page comes from