gpg --trust-model always and Owner Trust

gpg owner trust says how much you trust a key to certify others; --trust-model always sidesteps the prompts for CI.

A freshly imported key has undefined trust, which triggers a warning on verify and a blocking prompt on encrypt. In CI you either set trust explicitly or tell gpg to always trust.

What it does

Owner trust is your statement of how much a key may certify other keys. It is separate from a signature being valid. --trust-model always treats every key as fully valid, suppressing the "not certified" warning and the encrypt trust prompt without changing whether signatures verify.

Common usage

# set ultimate owner trust on a key non-interactively
echo -e "5\ny\n" | gpg --batch --command-fd 0 \
  --edit-key you@example.com trust quit
# or set trust by fingerprint via ownertrust import
echo "ABCD1234ABCD1234ABCD1234ABCD1234ABCD1234:6:" \
  | gpg --import-ownertrust
# or skip the model entirely for a single command
gpg --trust-model always --encrypt -r ci@example.com secrets.env

Options

In CI

For a key you imported and control, set ultimate owner trust via --import-ownertrust so encrypt and sign do not prompt. If you do not care about the trust graph at all, --trust-model always on each command is the simplest fix. Neither weakens signature verification; a BAD signature still fails.

Common errors in CI

"gpg: There is no assurance this key belongs to the named user" followed by "Use this key anyway?" is the encrypt trust prompt; it hangs in CI without --trust-model always or set owner trust. "gpg: WARNING: This key is not certified with a trusted signature" on verify is only a warning and does not change the exit code.

Related guides