SCUTE(7)

okay bestie, pull up a chair 💖 this is scute, manual section 7, and honestly? she's a lil niche but she serves. no cap.

---

✨ SYNOPSIS ✨

scute.so

that's it. that's the whole synopsis. she's a shared library, she doesn't take your orders from a command line. 🎀

---

🌸 DESCRIPTION 🌸

So Scute is a PKCS#11 implementation for the GnuPG Agent that rides on the GnuPG Smart Card Daemon. As of right now, OpenPGP and PIV cards are supported — those are the two girls in the group chat. 💅

What she actually does: she enables the use of an OpenPGP smart card or a PIV smart card inside applications that support PKCS#11 compliant security tokens. The main application doing this at the moment is client authentication in Mozilla-based web browsers. In the future? other applications will be supported. manifesting it fr fr ✨

To prep your application for use with Scute, you have to load the Scute module as a PKCS#11 module into the application. Keep scrolling for the notes on how to do that with Firefox, bestie 😌

---

🎀 OPTIONS 🎀

Okay so, as a shared library, scute has no command line options — she's not taking flags. But her behaviour can be modified by using a global configuration file or with an environment variable (more on that below 👇).

The global configuration file is expected at /etc/gnupg/scute.conf. It's made of keywords and values, plus some meta commands.

Right now there's only one useful option for general use — the rest are for debugging, iykyk. Scute uses the same parser as GnuPG does, so for the meta commands pls consult the GnuPG description, ty 🫶

Here's the short list of supported keywords:

• only-marked — Scute considers only keys that have the Use-for-p11 as part of their meta data.
• user name — If Scute is running with root permission and this option is used, it runs the GnuPG components in the context of name. name may either be a name or a numerical UID. This lets you use the GnuPG setup of a certain user instead of running it under the root account. It's needed to make Scute work smoothly as a PKCS#11 provider for OpenVPN. If the current user is not root, this option has no effect. periodt.
• debug flag — Useful values for flag are 1 and 3. 👀
• log-file file — This currently has no effect, but in a future version it will write the log to file. Writing to a socket will be possible by prefixing the file with the string socket://.
• assume-single-threaded — This is a hack to ignore a request to use native threads instead of user provided callbacks. Should only be used with caution if there's no easy way to fix the caller, or until we have fixed Scute. no biggie, just be careful bestie 😭
• no-chain — By default, when Scute is asked for a certificate, it returns the requested certificate along with the chain of signing certificates. This option makes Scute return only the leaf certificate. 🌿

In addition to the config file above, Scute also reads GnuPG's common.conf in the same way GnuPG does. That's how the no-autostart option gets detected — and then Scute will not try to launch gpg-agent, which it usually does. The important use-case here is running Scute on a server with the gpg-agent living on a desktop box. iconic split setup tbh 🖥️✨

---

🔥 NOTES (FIREFOX) 🔥

To use Scute with Firefox or Thunderbird, follow these instructions, step by step, no skipping 💅

From the menu choose Edit->Preferences. In the preferences configuration dialog you then select the Advanced configuration section, then the Security tab, and then select Security Devices in the category Certificates.

In the devices manager dialog, you can select Load to load a new PKCS#11 device. In the pop-up dialog that follows, you can give a module name (e.g. Scute) and a module filename. That filename should correspond to the full file name of the installed Scute module file scute.so.

The default installation path is /usr/local/lib, which would mean that you have to provide the file name /usr/local/lib/scute.so. If you — or your system administrator — installed Scute somewhere else, you have to adjust the file name correspondingly. 🦋

After confirming installation of the security device, a pop-up window should confirm that the module was successfully loaded, and an entry for the security device should appear in the device manager list of

---

🌈 ENVIRONMENT 🌈

The environment variable SCUTE_DEBUG gives the same debug flags as described above. This numerically value may be followed by a colon and the name for the log file. The global options will override these values once they have been parsed. 👑

bestie note: global options win the argument. always. 💅

---

💜 SEE ALSO 💜

• scdaemon(1)
• gpgsm(1)

---

and that's the whole page, mwah 💋 tysm for reading, this was Scute 1.7.1-unknown, dated 2026-01-29, tagging along with SCUTE(7) 🎀✨🫶