GnuPG End to End: Keys, Signatures and Encryption

You've joined the release team and need a working GnuPG setup: a key pair of your own, a signed release note, an encrypted hand-off to a colleague, and an encrypted credentials file. Your name and e-mail, your colleague, the passphrase and the files all differ per session; /root/case/brief.txt and /root/case/assignment.env have the details.

This box runs gpg 2.3 but has no pinentry program, so gpg can't open its usual passphrase dialog. Add --pinentry-mode loopback to any command that needs a passphrase and gpg asks in the terminal instead.

1. Generate a key pair in root's keyring (~/.gnupg) with the user ID the brief gives you.

2. Export your public key, ASCII-armored and on its own, to /root/out/pubkey.asc.

3. Write a detached signature of /root/case/release-notes.txt, made with your key, to /root/out/release-notes.txt.sig. Leave the notes unchanged.

4. Encrypt /root/case/handoff.txt to your colleague as /root/out/handoff.txt.gpg. Two key files in /root/case/keys/ claim to be theirs. Only one carries the fingerprint they gave you over the phone, which is printed in the brief.

5. Encrypt /root/case/db-creds.txt symmetrically with the brief's passphrase as /root/out/db-creds.txt.gpg, then delete the plaintext.

Grading uses gpg itself: it finds your key by e-mail address and checks that its private half exists, then verifies your signature, inspects your export, and decrypts both ciphertexts. Any key type and any spelling of the commands passes.