OpenPGP gnuGPG Token2

readme.txt

Token2 OpenPGP GNU-GPG


https://www.token2.com/site/page/openpgp-setup-guide-for-usb-keys-and-cards

https://github.com/YubicoLabs/sign-git-commits-yubikey

https://www.spletzer.com/2026/04/a-no-nonsense-guide-to-gpg-commit-signing-with-a-yubikey/

https://developers.yubico.com/PGP/Git_signing.html

For PIN entry:

~/.zshrc
GPG_TTY=$(tty)
export GPG_TTY

—————————————— ALL:

gpg --card-status

gpg --card-edit
admin
passwd
change PIN - 123456
change Admin PIN - 12345678
quit

gpg --card-edit
admin
key-attr
RSA
4096
quit

gpg --list-keys

gpg --list-secret-keys

—————————————— MASTER USB token:

gpg --card-edit
generate
# 5 years
quit

gpg --edit-key daniel.weck@gmail.com
key 1
# usage: A (auth)
delkey
key 1
# usage: E (enc)
delkey
# usage: SC (Cert for subkeys and sign pub keys)

/Users/danielweck/.gnupg/openpgp-revocs.d/

—————————————— 

gpg --keyserver keys.openpgp.org --send-keys xxxx

https://keys.openpgp.org/search?q=daniel.weck%40gmail.com

—————————————— SUB USB token:

gpg --edit-key daniel.weck@gmail.com
addcardkey
# 2 years
(insert master USB token, PINs, etc.)
save

—————————————— 

multiple public signing (sub)keys export:
gpg --export --armor daniel.weck@gmail.com > ~/Desktop/danielweckgmail.asc

gpg --gen-revoke daniel.weck@gmail.com > ~/Desktop/revocation-certificate.asc

gpg --export-secret-subkeys --armor daniel.weck@gmail.com > ~/Desktop/master-secret-subkeys.asc
gpg --export-secret-keys --armor daniel.weck@gmail.com > ~/Desktop/master-secret-key.asc

—————————————— 

gpg --list-secret-keys --keyid-format LONG daniel.weck@gmail.com
S (sign): xxxxx
git config --global user.signingKey xxxxx
git config --global commit.gpgsign true
git config --global gpg.program gpg

git config --global --list
user.name=Daniel Weck
user.email=daniel.weck@gmail.com
user.signingkey=xxxxx
commit.gpgsign=true
gpg.program=gpg

git commit -S -a -m “up”
(-S === --gpg-sign)
git cat-file -p HEAD
git show HEAD --show-signature
git log --show-signature
git log --show-signature -1
git verify-commit HEAD

git tag v1.0.0 -s -m “Release 1.0.0”
git show v1.0.0
git cat-file -p v1.0.0
git verify-tag v1.0.0
git tag -v v1.0.0

git merge --verify-signatures master
git merge -S master (to sign the merge commit)

git push --signed

——————————————