1{
 2  den.aspects.desktop.provides.gpg.nixos = {pkgs, ...}: {
 3    programs.gnupg.agent = {
 4      enable = true;
 5      pinentryPackage = pkgs.pinentry-gnome3;
 6      enableSSHSupport = false;
 7      settings.default-cache-ttl = 4 * 60 * 60; # 4 hours
 8    };
 9  };
10
11  den.aspects.desktop.provides.gpg.homeManager = {config, ...}: {
12    programs.gpg = {
13      enable = true;
14      homedir = "${config.home.homeDirectory}/.gnupg";
15
16      mutableTrust = false;
17      mutableKeys = false;
18
19      # This configuration is based on the tutorial below, it allows for a robust setup
20      # https://blog.eleven-labs.com/en/openpgp-almost-perfect-key-pair-part-1
21      # ~/.gnupg/gpg.conf
22      settings = {
23        # Get rid of the copyright notice
24        no-greeting = true;
25
26        # --- Avoid information leaked --- #
27        # Disable inclusion of the version string in ASCII armored output
28        no-emit-version = true;
29        # Do not write comment packets
30        no-comments = false;
31        # Export the smallest key possible
32        # This removes all signatures except the most recent self-signature on each user ID
33        export-options = "export-minimal";
34
35        # Display long key IDs
36        keyid-format = "0xlong";
37        # List all keys (or the specified ones) along with their fingerprints
38        with-fingerprint = true;
39
40        # Display the calculated validity of user IDs during key listings
41        list-options = "show-uid-validity";
42        verify-options = "show-uid-validity show-keyserver-urls";
43
44        # Select the strongest cipher
45        personal-cipher-preferences = "AES256";
46        # Select the strongest digest
47        personal-digest-preferences = "SHA512";
48        # This preference list is used for new keys and becomes the default for "setpref" in the edit menu
49        default-preference-list = "SHA512 SHA384 SHA256 RIPEMD160 AES256 TWOFISH BLOWFISH ZLIB BZIP2 ZIP Uncompressed";
50
51        # Use the strongest cipher algorithm
52        cipher-algo = "AES256";
53        # Use the strongest digest algorithm
54        digest-algo = "SHA512";
55        # Message digest algorithm used when signing a key
56        cert-digest-algo = "SHA512";
57        # Use RFC-1950 ZLIB compression
58        compress-algo = "ZLIB";
59
60        # Disable weak algorithm
61        disable-cipher-algo = "3DES";
62        # Treat the specified digest algorithm as weak
63        weak-digest = "SHA1";
64
65        # The cipher algorithm for symmetric encryption for symmetric encryption with a passphrase
66        s2k-cipher-algo = "AES256";
67        # The digest algorithm used to mangle the passphrases for symmetric encryption
68        s2k-digest-algo = "SHA512";
69        # Selects how passphrases for symmetric encryption are mangled
70        s2k-mode = "3";
71        # Specify how many times the passphrases mangling for symmetric encryption is repeated
72        s2k-count = "65011712";
73      };
74    };
75  };
76}