24

When I run gpg --with-fingerprints --with-colons keyfile.key, I get a machine parsable output on stdout containing the key fingerprint for the key inside the keyfile (which is exactly what I want), plus the following error on stderr:

gpg: WARNING: no command supplied.  Trying to guess what you mean ...

So GnuPG is guessing the command correctly, but for my life I can't figure out what command it is guessing. I have tried almost all of the commands listed on the man page. I'm using GnuPG 2.2.

Does anybody know the correct command to read a key file and show information about the key?

Edit: Ideally the mechanism would be able to read the keyfile from stdin, such as 

cat keyfile.key | gpg --some-command

I should have mentioned this earlier but so many commands for gpg work with stdin I didn't even consider it a relevant constraint.

Improve this question

4 Answers 4

Reset to default
29

The good folks at the gnupg-users@gnupg.org mailing list had the answer:

For versions >= 2.1.23:

cat keyfile.key | gpg --with-colons --import-options show-only --import

For versions >= 2.1.13 but < 2.1.23:

cat keyfile.key | gpg --with-colons --import-options import-show --dry-run --import
Improve this answer
1
  • To make it clear, it wasn't sure what to do with the given key. That's what the message means. But it guessed that you wanted to display it, and was right. By the way, --with-colons is not really needed. And an easy way to reproduce the issue: curl -sS https://packages.sury.org/php/apt.gpg | gpg.
    – x-yuri
    Mar 31, 2019 at 17:07
13

For newer versions:

gpg --show-keys my-local-key.asc

From the man page:

--show-keys

    This commands takes OpenPGP keys as input and prints information about them in the same way the command --list-keys does for locally stored key.  In addition the list options show-unusable-uids, show-unusable-subkeys, show-notations and show-policy-urls are also enabled.  As usual for automated processing, this command should be combined with the option --with-colons.

Improve this answer
1
  • 1
    This is up to date and should become the accepted answer.
    – not2savvy
    Jun 22, 2022 at 9:39
8

GnuPG does not know a dedicated command for listing contents of a key file. Either use gpg --list-packets <keyfile> (but this is not a stable, machine-readable output) or define the keyfile as keyring and list keys instead. The old keyring format up to GnuPG 2.0 stored keys as a concatenation of the key's packets; so you can also use a key file as a keyring. At least GnuPG 2.1 and 2.2 still support the old keyring format, and I wouldn't expect this to change in near future.

gpg --with-fingerprint --with-colons --no-default-keyring --keyring <keyfile> --list-keys

Be sure to include --no-default-keyring, otherwise GnuPG will also print all keys in your user's keyring!

Improve this answer
6
  • This partially works for me. Is there any way to accomplish the same thing feeding the file through stdin? I will edit the question appropriately.
    – rexroni
    Sep 9, 2017 at 17:17
  • You can often use the pseudo-file /dev/stdin as <keyfile> for such use cases (and in this case, it works fine).
    – Jens Erat
    Sep 9, 2017 at 17:41
  • Hmmm... For me, cat keyfile.key | gpg --no-default-keyring --keyring /dev/stdin --list-key fails with error gpg: [don't know]: invalid packet (ctb=03) on archlinux (gpg 2.2.0). On ubuntu 16.04 (gpg versions 1.4.20 and 2.1.11) it exits with code 0 but produces no output. The same file, when specified as a keyring, works for all three versions.
    – rexroni
    Sep 9, 2017 at 18:08
  • Also congrats on 1K reputation!
    – rexroni
    Sep 9, 2017 at 18:12
  • I guess I was wrong -- I tested by piping in contents from a file (< mykey.gpg), which probably results in a seekable "stdin", which a real pipe of course isn't. At least I assume that's why GnuPG fails. I fear there is no alternative but writing to a temporary file (or ignoring the message on STDERR)
    – Jens Erat
    Sep 9, 2017 at 19:13
0

For newer versions of gngpg version 2.2.8 and above:

If you are interested in only the short or long fingerprint of the key without redirecting stderr to stdout 2>&1:
(i.e. when you have scripts verifying the fingerprint before proceeding like for ansible or other configuration management tools)


I have included a way with --with-colons and one without depending on your scripting preferences. The commands below purposefully do not import the key into your keyring as these are scriptable ways to verify fingerprints before doing so.

Ways to get short format key ID

short key id format (using --show-keys and --with-colons):

gpg --show-keys --with-colons keyfile.key | awk -F':' '$1=="pub"{print $5}'

short key id format (using --list-packets):

gpg --list-packets keyfile.key | awk '$1=="keyid:"{print$2}'

Ways to get long format key ID

long key id format (using --show-keys and --with-colons):

gpg --show-keys --with-colons keyfile.key | awk -F':' '$1=="fpr"{print $10}'

long key id format (using --show-keys):

gpg --show-keys keyfile.key | sed -nr 's/^([ ]+)([0-9A-Z]{40}$)/\2/p'
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .