YAGNI
You are(n't)? gonna need it…

Integrate GNU Privacy Guard (GPG) with other tools

About

This post will show different ways to integrate GPG with external tools to encrypt and/or sign different types of data.

The following sections assume that the reader owns a personal GPG key.

Keeping passwords secure using Emacs

The Emacs manual explains that the auth-source library is used to keep password information persistent for providing it to services that might require it, this information is kept secure in the ~/.authinfo.gpg file.

The reason why this file is secure by default is because Emacs treats files with extension gpg as encrypted files; this means that when a file with this extension is opened inside Emacs, it'll prompt users for their "gpg" passphrase (required for decrypting); similarly when the user saves such files they're stored encrypted.

Of course the decryption only works if the user opening the file is the actual recipient of the encrypted file.

The Pinentry

The Pinentry is a component of GPG that securely prompts users for passphrases. Some systems use by default Pinentry components that don't integrate well with Emacs, i.e. the curses based Pinentry.

The "loopback" Pinentry allows Emacs to smoothly integrate with GPG. To set this Pinentry as the default, add the following line to the ~/.gnupg/gpg.conf file:

pinentry-mode loopback

Also configure the epg package to control the behavior of the Pinentry invocation:

(setq epg-pinentry-mode 'loopback)

Signing Git commits

Git supports signing commits using GPG. To achieve this, configure the commit.gpgsign setting as in:

git config --global commit.gpgsign true

This setting will sign the commits using the user's default key, but in order to be specific about which key to use then configure the user.signingkey using the key's identifier:

git config --global user.signingkey me@email.com

With these settings in place, new commits will be GPG signed.

It's also possible to share the public keys with services such as Github so they can verify the signatures of the pushed commits.