菜单
Sign a file or text with GPG — detached signature, clear-signed, or inline. Use when the user wants to publish a release artefact with a `.sig` file, prove authorship of a document, or sign a plain-text message that recipients can verify with their copy of their public key.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/danielrosehill/Claude-GPG-Ops-Plugin --skill gpg-sign命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Decrypt a GPG-encrypted file (.gpg or .asc) using the local keyring. Handles both asymmetric (key-encrypted) and symmetric (passphrase-encrypted) ciphertext — GPG auto-detects which. Use when the user receives an encrypted file or has at-rest encrypted backups they need to read.
Encrypt a file or text with GPG to one or more recipients (asymmetric) or with a passphrase (symmetric). Use when the user wants to send confidential data to someone whose public key they have, or lock a file with a password. Defaults to ASCII-armored output and refuses to encrypt to keys with marginal/unknown trust unless the user confirms.
Export a GPG public key in ASCII-armored form, ready to share, paste into GitHub, or upload to a keyserver. Use when the user wants to publish their public key, share it with a collaborator, or register it for signed commits. Selects the key by email, key ID, or fingerprint.
基于 SOC 职业分类
正在显示 SKILL.md
| name | gpg-sign |
| description | Sign a file or text with GPG — detached signature, clear-signed, or inline. Use when the user wants to publish a release artefact with a `.sig` file, prove authorship of a document, or sign a plain-text message that recipients can verify with their copy of their public key. |
The user wants to attach a cryptographic signature to a file or message — for release artefacts (.tar.gz + .tar.gz.sig), signed announcements, or signed email body text.
| Mode | Flag | Output | When |
|---|---|---|---|
| Detached | --detach-sign | Separate .sig / .asc file alongside the original | Release artefacts, large binaries — original stays unchanged |
| Clear-signed | --clearsign | Plaintext wrapped in -----BEGIN PGP SIGNED MESSAGE----- | Signed email body, signed announcements that should remain human-readable |
| Inline | --sign | Single binary/armored blob containing message + signature | Niche; use detached or clear-signed instead in most cases |
gpg --armor --detach-sign --output <file>.sig <file>
Drop --armor if you want a binary .sig instead of an armored .asc-style signature. By GitHub-release convention, releases ship <artefact>.tar.gz + <artefact>.tar.gz.sig (binary) or .asc (armored).
To sign with a specific key (if you have multiple secret keys):
gpg --local-user <KEYID-or-email> --armor --detach-sign --output <file>.sig <file>
gpg --clearsign --output <file>.asc <file>
Or pipe text:
echo "Announcement: …" | gpg --clearsign
The output is human-readable plaintext with a signature appended — recipients can verify and read without a GPG-aware client.
Round-trip the signature locally before publishing:
gpg --verify <file>.sig <file> # detached
gpg --verify <file>.asc # clear-signed (verifies and prints the message)
You should see gpg: Good signature from "Your Name <email>".
If multiple people need to sign the same artefact (e.g. a release with co-maintainers), each signer produces their own detached signature:
# Alice
gpg --local-user alice@... --detach-sign --armor -o release.tar.gz.alice.asc release.tar.gz
# Bob
gpg --local-user bob@... --detach-sign --armor -o release.tar.gz.bob.asc release.tar.gz
Verifiers run gpg --verify against each .asc.
gpg-encrypt (--sign --encrypt), not here.git config commit.gpgsign true and git commit -S / git tag -s — that's a git workflow, not a direct GPG invocation.S capability flag (gpg --list-keys shows [SC] or [S] on the relevant subkey).