# Personal PGP Key Provisioning

## Requirements

* Computer that can load AirgapOS ([compatibility reference](https://git.distrust.co/public/airgap#tested-models))

* [AirgapOS SD card](../level-2/fixed-location/provisioner/provision-airgapos.md)

* 2+ new smart cards

* 2+ SD cards

##  Generate OpenPGP Key

1. Insert AirgapOS SD card into computer

1. Boot to AirgapOS

    * Boot from the SD card by modifying the Boot Menu

    * [Disabling secure boot](generated-documents/level-2/fixed-location/procurer/procure-tamper-proofing-equipment.html) may be necessary

{{ #include ../../component-documents/openpgp-setup.md:steps-keyfork}}

## Adding a OpenPGP Public Certificate to the Ceremony Repository

1. Ensure you are on the correct branch:

    * `git checkout main`

1. Pull the latest ceremony repo changes

    * `git pull origin main`

1. If using a certificate from [Personal PGP Key Provisioning](/generated-documents/all-levels/pgp-key-provisioning.html):

	1. Obtain the fingerprint for the certificate:

		* `fingerprint="$(sq keyring cert.asc | awk '{ print $2 }')"`

	2. Copy the certificate to a name based on the keyring:

		* `cp cert.asc "${fingerprint}.asc"`

1. If exporting a certificate from GnuPG:

	1. Find your key fingerprint:

		* `gpg --list-keys`

	1. Export your OpenPGP public certificate:

		* `gpg --export --armor <key_fingerprint> > <key_fingerprint>.asc`

1. Place the file in `keys/all/<key_fingerprint>.asc`

1. Create signed git commit:

    * `git commit -S -m "add <name> pgp key"`

1. Push to the commit:

    * `git push origin main`

1. Communicate your new key fingerprint to all other participants:

    * Preferred: In person 
    
    * Fallback: via two logically distinct online communications methods (e.g. encrypted chat, and video call)

1. Get confirmation they have used `gpg --import <your_key_id>.asc` to import your key from the git repo to the keyrings on workstations they will use to interact with the ceremony repo