Metadata-Version: 2.4
Name: pcaff
Version: 0.1.0
Summary: CAFF replacement for an offline-key OpenPGP certification workflow
License-Expression: GPL-2.0-or-later
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: jinja2>=3.1
Requires-Dist: pyyaml>=6.0
Dynamic: license-file

# pcaff

`pcaff` is a replacement for the CAFF (CA Fire and Forget) OpenPGP
key-certification workflow. It supports both local certification and a
two-machine workflow in which the certification key remains on a permanently
offline keyholder machine.

## Installation

Create the project environment and install the package with:

```console
uv sync
```

This installs the `pcaff-control` and `pcaff-sign` commands. The online control
command has two Python dependencies, Jinja2 and PyYAML. The complete workflow
also requires the external `sq` and `gpg` executables. All private-key
operations (certifying, signing a transaction tarball, decrypting) go through
`sq` directly, using its own passphrase prompting; `gpg` is used only for
public, non-secret-key operations (per-user-ID certificate export). The offline
keyholder machine in particular never needs `gpg` at all, and never needs a
persistent `sq` certificate or key store either.  The `gpg` dependency is
expected to go away once `sq` grows the ability to redact specific UIDs out of
a certificate export on its own.

See `pcaff(1)`, `pcaff-control(1)`, and `pcaff-sign(1)` for configuration and
usage details.

## License

Copyright 2026 Marc Haber <mh+debian-packages@zugschlus.de>

`pcaff` is free software: you can redistribute it and/or modify it under the
terms of the GNU General Public License as published by the Free Software
Foundation, either version 2 of the License, or (at your option) any later
version. See the `LICENSE` file for the full license text.

## Acknowledgments

Created with assistance of OpenAI and Anthropic AI models. Kristian Köhntopp
helped a lot with the prompting.
