Kleopatra allows the user to configure the visual appearance of keys based on a concept called Key Categories. This section describes how you can edit the available categories and add new ones.
When trying to find the category a key belongs to, Kleopatra
tries to match the key to a sequence of key filters,
configured in the libkleopatrarc
. The
first one to match defines the category.
Each key filter is defined in a config group named
Key Filter #
,
where n
n
is a number, starting from
0
.
The only mandatory key in a Key Filter
#
group is
n
Name
, containing the name of the category
as displayed in the config dialog.
Table 6.1, “Key-Filter Configuration Keys Defining Display Properties” lists all keys that define the display properties of keys belonging to that category (that is, those keys that can be adjusted in the config dialog), whereas Table 6.2, “Key-Filter Configuration Keys Defining Filter Criteria” lists all keys that define the criteria the filter matches keys against.
Table 6.1. Key-Filter Configuration Keys Defining Display Properties
Config Key | Type | Description |
---|---|---|
background-color | color | The background color to use. If missing, defaults to whichever background color is defined globally for list views. |
foreground-color | color | The foreground color to use. If missing, defaults to whichever foreground color is defined globally for list views. |
font | font | The custom font to use. The font will be scaled to the size configured for list views, and any font attributes (see below) will be applied. |
font-bold | boolean |
If set to true and
font is not set, uses the
default list view font with bold font style added (if
available). Ignored if font is also
present.
|
font-italic | boolean |
Analogous to font-bold , but for
italic font style instead of bold.
|
font-strikeout | boolean |
If true , draws a centered line over
the font. Applied even if
font is set.
|
icon | text | The name of an icon to show in the first column. Not yet implemented. |
Table 6.2. Key-Filter Configuration Keys Defining Filter Criteria
Config Key | Type | If specified, filter matches when... |
---|---|---|
is-revoked | boolean | the key has been revoked. |
is-expired | boolean | the key is expired. |
is-disabled | boolean | the key has been disabled (marked for not using) by the user. Ignored for S/MIME keys. |
is-root-certificate | boolean | the key is a root certificate. Ignored for OpenPGP keys. |
can-encrypt | boolean | the key can be used for encryption. |
can-sign | boolean | the key can be used for signing. |
can-certify | boolean | the key can be used for signing (certifying) other keys. |
can-authenticate | boolean | the key can be used for authentication (for example, as an TLS client certificate). |
has-secret-key | boolean | the secret key for this key pair is available. |
is-openpgp-key | boolean |
the key is an OpenPGP key (true ),
or an S/MIME key (false ).
|
was-validated | boolean | the key has been validated (see -> (Shift+F5)). |
| validity[a] |
the key has exactly
(prefix = is ),
has anything but
(prefix = is-not ),
has at least
(prefix = is-at-least ),
or has at most
(prefix = is-at-most )
the ownertrust given as the value of the config key. If
more than one
keys (with different
prefix values) are present in a
single group, the behavior is undefined.
|
| validity |
Analogous to
,
but for key validity instead of ownertrust.
|
[a]
Validity is an (ordered) enumeration with the
following allowed values:
|
Some of the more interesting criteria, such as
is-revoked
or
is-expired
will only work on
validated keys, which is why, by
default, only validated keys are checked for revocation and
expiration, although you are free to remove these extra
checks.
In general, criteria not specified (that is, the config entry is not set) are not checked for. If a criterion is given, it is checked for and must match for the filter as a whole to match, that is, the criteria are AND'ed together.
Example 6.1. Examples of key filters
To check for all expired, but non-revoked root certificates, you would use a key filter defined as follows:
[Key Filter #n
]
Name=expired, but not revoked
was-validated=true
is-expired=true
is-revoked=false
is-root-certificate=true
To check for all disabled OpenPGP keys (not yet supported by Kleopatra) with ownertrust of at least “marginal”, you would use:
[Key Filter #n
]
Name=disabled OpenPGP keys with marginal or better ownertrust
is-openpgp=true
is-disabled=true
is-at-least-ownertrust=marginal
Would you like to comment or contribute an update to this page?
Send feedback to the TDE Development Team