0

Here on a Debian system I use mainly gpg2. Some (Debian packaging/signing) tools use gpg1 internally, and changing them as it should be would be infeasible.

Both my gpg versions are using the same work directory (~/.gnupg) and their databases / configuration seem mainly compatible. An exception for this is the handling of the private keys.

As I experienced, private keys created by gpg2 are not visible for gpg1 (but their public pairs are).

Digging a lot on the net, as I understand, the gpg versions are using different files (and maybe different formats) below ~/.gnupg to store them. There are also various one-line solutions to convert the gpg2 database to gpg1 and vice versa.

Now I have to use mainly gpg2, but I have to allow also gpg1 to work. My idea for this task is that

  1. I export the gpg2 private key database.
  2. I import it with gpg1.

The expected result would be that I can see the same public and private keys with both gpg versions.

Is it possible? Could it work? How can I do that?

(Note: at least Ubuntu and Mint uses already gpg2 for packaging tasks, but Debian still doesn't.)

|improve this question
  • Which tools still need gpg1? I see devscripts in Jessie still does, but you could use the backported version instead. dpkg and the related tools are fine in Jessie as-is. – Stephen Kitt Jun 14 '17 at 12:42
  • Thanks! I will do. For example, my debsign wants still gpg1. Earlier I had trouble also with some debhelper scripts, and also with apt, I don't know if they still exist. Actually, I want to exterminate gpg1 and show its place with salt, now the problem is that I should recompile many .deb development tools for that. – peterh Jun 14 '17 at 12:59
3

GnuPG 1.4, 2.0 and 2.1 all support the "good old" pubring.gpg file for storing public keys. As long as a pubkey.gpg exists, also GnuPG 2.1 will continue to use it and not create a public keyring in the new keybox format.

There are differences with respect to private keys, though. While GnuPG 1.4 and 2.0 both store private keys in the secring.gpg file, GnuPG 2.1 merges those into the public keyring file, such that GnuPG 2.1 (gpg2, on newer distributions also gpg) and GnuPG 1.4 (gpg1 if available, on older distributions also gpg) do not share a common secret keyring store any more (but still can do for the public keyring, as already explained).

If you export the secret keys from gpg2 and import them to gpg/gpg1, you should be able to use them from both implementations. GnuPG 1.4 does not mind that secret keys are stored in your pubring.gpg file. Be aware GnuPG 1.4 cannot merge secret key packets; if you change your subkeys in GnupG 2.1 and want to copy them to GnuPG 1.4 agein, you will have to delete the secret key from GnuPG 2.1 and import it again. Always make a backup copy before changing anything!

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.