Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2025-01-14 00:39:40 -05:00
Code Issues Packages Projects Releases Wiki Activity

UserDoc/SplitGpg changed

Browse Source 
Actually we do provide the script as part of the rpm.
This commit is contained in:
Joanna Rutkowska 2014-07-29 22:00:43 +00:00
parent 86c660e1b2
commit 909c2d7fab
1 changed files with 7 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
UserDoc/SplitGpg.md
View File

@ -76,18 +76,16 @@ ssb 4096R/30498E2A 2012-11-15
Note that running normal `gpg -K` in the demo above shows no private keys stored in this AppVM.
However, when using Thunderbird with Enigmail extension it is not enough, because Thunderbird doesn't preserve the environment variables. Instead it is recommended to create a short script e.g. in the user home directory (name it e.g. `.qubes_gpg.sh` and make it executable):
``` {.wiki}
#!/bin/bash
export QUBES_GPG_DOMAIN=work-gpg
exec qubes-gpg-client "$@"
```
... and then point Enigmail to use this script instead of the standard GnuPG binary:
However, when using Thunderbird with Enigmail extension it is not enough, because Thunderbird doesn't preserve the environment variables. Instead it is recommended to use a simple script provided by `/usr/bin/qubes-gpg-client-wrapper` file by pointing Enigmail to use this script instead of the standard GnuPG binary:
[![No image "tb-enigmail-split-gpg-settings.png" attached to UserDoc/SplitGpg](/chrome/common/attachment.png "No image "tb-enigmail-split-gpg-settings.png" attached to UserDoc/SplitGpg")](/attachment/wiki/UserDoc/SplitGpg/tb-enigmail-split-gpg-settings.png)
The script also sets the QUBES\_GPG\_DOMAIN variable automatically based on the content of the file `/rw/config/gpg-split-domain`, which should be set to the name of the GPG backend VM. This file survives the AppVM reboot, of course.
``` {.wiki}
echo "work-gpg" > /rw/config/gpg-split-domain
```
### Importing public keys
Use `qubes-gpg-import-key` in the client AppVM to import the key into the GPG backend VM. Of course a (safe, unspoofable) user consent dialog box is displayed to accept this.