Questions[pgp](server)

I regularly receive data using pgp encryption. Typically if I run a gpg --list-packets on a file I see the file as a "pubkey enc packet" then an item about my private key. At that point I move the files to another location for decryption and processing.

Recently one of the people I received files from in the past sent a file I could not decrypt. When I run a list-packets on those files I get:

:compressed packet: algo=1
:literal data packet:
     mode t (74),created 1699482604, name="A*****",
     raw data: unknown length

I also tried --decrypt but was not able to access the original data/message. From what I can tell this maybe a file processed with the equivalent of a gpg --store command. I haven't found guidance on how I can attempt to access the data in these files. Preferably using GnuPG. I am using:

gpg --version
gpg (GnuPG) 2.0.22
libcrypt 1.5.3

Does anyone know how I could work with this file type? Decrypt, confirm signatures, access encrypted data.

I would like to create such mailing list where every contributor must sign his/her messages with PGP/GPG, otherwise mailing list software would block unsigned message.

All PGP/GPG public keys of users allowed to post should be stored somewhere on mailing list server.

All other users are allowed to read mailing list in read-only access at the same time.

To what open-source mailing list software this feature can be easily added?

We would like to use gpg signatures to verify some aspects of our system configuration management tools. Additionally, we would like to use a "trust" model where individual sysadmin keys are signed with a master signing key, and then our systems trust that master key (and use the "web of trust" to validate signatures by our sysadmins).

This gives us a lot of flexibility, such as the ability to easily revoke the trust on a key when someone leaves, but we've run into a problem. While the gpg command will tell you if a key is untrusted, it doesn't appear to return an exit code indicating this fact. For example:

# gpg -v < foo.asc
Version: GnuPG v1.4.11 (GNU/Linux)
gpg: armor header: 
gpg: original file name=''
this is a test
gpg: Signature made Fri 22 Jul 2011 11:34:02 AM EDT using RSA key ID ABCD00B0
gpg: using PGP trust model
gpg: Good signature from "Testing Key <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: ABCD 1234 0527 9D0C 3C4A  CAFE BABE DEAD BEEF 00B0
gpg: binary signature, digest algorithm SHA1

The part we care about is this:

gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.

The exit code returned by gpg in this case is 0, despite the trust failure:

# echo $?
0

How do we get gpg to fail in the event that something is signed with an untrusted signature?

I've seen some suggestions that the gpgv command will return a proper exit code, but unfortunately gpgv doesn't know how to fetch keys from keyservers. I guess we can parse the status output (using --status-fd) from gpg, but is there a better way?

At a small office, my clients' HR department needs to communicate with some vendors regarding HIPAA-covered material. How do most companies deal with securely sending e-mails regarding HIPAA. I would prefer to encrypt the e-mails themselves instead of requiring vendors to log into a secure messaging server, but I don't know if this is commonplace

I use a 4096 byte RSA PGP key; since SSH also uses the RSA standard, is it at all possible to use the PGP key as an SSH key without installing additional software on the server (and as little as possible on the client)?