Gpgagentconf

Gpg-agent.conf is the configuration file used by gpg-agent, the background service in GnuPG that manages private key operations, passphrase caching, and the interaction with pinentry programs. It allows administrators and users to tailor the behavior of the agent to their environment.

Location and format: The file is typically found at ~/.gnupg/gpg-agent.conf for per-user configuration or at /etc/gnupg/gpg-agent.conf for system-wide settings. The file uses simple key=value lines, with comments beginning with the hash character (#). The agent reads the file at startup, and changes can be applied by restarting the agent or by asking it to reload the configuration when supported.

Common options: Pinentry selection is controlled by pinentry-program, which specifies the path to the pinentry dialog program (for example, pinentry-program /usr/bin/pinentry-gtk-2). Passphrase caching is configured with default-cache-ttl and max-cache-ttl, which define the time-to-live for cached passphrases (in seconds). enable-ssh-support enables the agent to provide SSH keys via the standard SSH agent protocol. allow-loopback-pinentry permits pinentry communication over a loopback interface in certain setups. write-env-file can be used to have the agent write environment variables to a file for use by other processes.

Reloading and scope: Changes to gpg-agent.conf take effect after the agent is restarted or explicitly reloaded (for example, via gpg-connect-agent 'reloadagent /bye'). The configuration affects all operations performed by gpg-agent for the user or system, depending on where the file is located. Properly configuring gpg-agent.conf can balance usability with security by adjusting TTLs and ensuring the appropriate pinentry and SSH integration are in place.