6

When I run gpg --with-fingerprints --with-colons keyfile.key, I get a machine parsable output on stdout containing the key fingerprint for the key inside the keyfile (which is exactly what I want), plus the following error on stderr:

gpg: WARNING: no command supplied.  Trying to guess what you mean ...

So GnuPG is guessing the command correctly, but for my life I can't figure out what command it is guessing. I have tried almost all of the commands listed on the man page. I'm using GnuPG 2.2.

Does anybody know the correct command to read a key file and show information about the key?


Edit: Ideally the mechanism would be able to read the keyfile from stdin, such as

cat keyfile.key | gpg --some-command

I should have mentioned this earlier but so many commands for gpg work with stdin I didn't even consider it a relevant constraint.

9

The good folks at the gnupg-users@gnupg.org mailing list had the answer:

For versions >= 2.1.23:

cat keyfile.key | gpg --with-colons --import-options show-only --import

For versions >= 2.1.13 but < 2.1.23:

cat keyfile.key | gpg --with-colons --import-options import-show --dry-run --import
  • To make it clear, it wasn't sure what to do with the given key. That's what the message means. But it guessed that you wanted to display it, and was right. By the way, --with-colons is not really needed. And an easy way to reproduce the issue: curl -sS https://packages.sury.org/php/apt.gpg | gpg. – x-yuri Mar 31 at 17:07
5

GnuPG does not know a dedicated command for listing contents of a key file. Either use gpg --list-packets <keyfile> (but this is not a stable, machine-readable output) or define the keyfile as keyring and list keys instead. The old keyring format up to GnuPG 2.0 stored keys as a concatenation of the key's packets; so you can also use a key file as a keyring. At least GnuPG 2.1 and 2.2 still support the old keyring format, and I wouldn't expect this to change in near future.

gpg --with-fingerprint --with-colons --no-default-keyring --keyring <keyfile> --list-keys

Be sure to include --no-default-keyring, otherwise GnuPG will also print all keys in your user's keyring!

  • This partially works for me. Is there any way to accomplish the same thing feeding the file through stdin? I will edit the question appropriately. – rexroni Sep 9 '17 at 17:17
  • You can often use the pseudo-file /dev/stdin as <keyfile> for such use cases (and in this case, it works fine). – Jens Erat Sep 9 '17 at 17:41
  • Hmmm... For me, cat keyfile.key | gpg --no-default-keyring --keyring /dev/stdin --list-key fails with error gpg: [don't know]: invalid packet (ctb=03) on archlinux (gpg 2.2.0). On ubuntu 16.04 (gpg versions 1.4.20 and 2.1.11) it exits with code 0 but produces no output. The same file, when specified as a keyring, works for all three versions. – rexroni Sep 9 '17 at 18:08
  • Also congrats on 1K reputation! – rexroni Sep 9 '17 at 18:12
  • I guess I was wrong -- I tested by piping in contents from a file (< mykey.gpg), which probably results in a seekable "stdin", which a real pipe of course isn't. At least I assume that's why GnuPG fails. I fear there is no alternative but writing to a temporary file (or ignoring the message on STDERR) – Jens Erat Sep 9 '17 at 19:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.