diff --git a/UserDoc/SplitGpg.md b/UserDoc/SplitGpg.md index 6d88dff3..600125ab 100644 --- a/UserDoc/SplitGpg.md +++ b/UserDoc/SplitGpg.md @@ -76,18 +76,16 @@ ssb 4096R/30498E2A 2012-11-15 Note that running normal `gpg -K` in the demo above shows no private keys stored in this AppVM. -However, when using Thunderbird with Enigmail extension it is not enough, because Thunderbird doesn't preserve the environment variables. Instead it is recommended to create a short script e.g. in the user home directory (name it e.g. `.qubes_gpg.sh` and make it executable): - -``` {.wiki} -#!/bin/bash -export QUBES_GPG_DOMAIN=work-gpg -exec qubes-gpg-client "$@" -``` - -... and then point Enigmail to use this script instead of the standard GnuPG binary: +However, when using Thunderbird with Enigmail extension it is not enough, because Thunderbird doesn't preserve the environment variables. Instead it is recommended to use a simple script provided by `/usr/bin/qubes-gpg-client-wrapper` file by pointing Enigmail to use this script instead of the standard GnuPG binary: [![No image "tb-enigmail-split-gpg-settings.png" attached to UserDoc/SplitGpg](/chrome/common/attachment.png "No image "tb-enigmail-split-gpg-settings.png" attached to UserDoc/SplitGpg")](/attachment/wiki/UserDoc/SplitGpg/tb-enigmail-split-gpg-settings.png) +The script also sets the QUBES\_GPG\_DOMAIN variable automatically based on the content of the file `/rw/config/gpg-split-domain`, which should be set to the name of the GPG backend VM. This file survives the AppVM reboot, of course. + +``` {.wiki} +echo "work-gpg" > /rw/config/gpg-split-domain +``` + ### Importing public keys Use `qubes-gpg-import-key` in the client AppVM to import the key into the GPG backend VM. Of course a (safe, unspoofable) user consent dialog box is displayed to accept this.