Under Debian 8 I created (presumably, then with gpg 1 or 2.0) and published my key secring.gpg to a keyserver, the file is still under the directory ~/.gnupg/. But now with gpg 2.1:

gpg --list-secret-keys

has no output and attempts to sign something

gpg -s tmp.txt

fail with

gpg: no default secret key: secret key not available
gpg: signing failed: secret key not available

Did I botch somehow the upgrade from Debian 8 to 9? Should I have exported the secret key before upgrading and how can I import the "old" secret key into the "new" gpg?

update 2018-03-01:

The problem is simply that - somehow, sometime - my secring.gpg shrank to the size 0! :-/ Discovered it with the solution from Stephen Kitt, when trying to import

gpg --import-secret-keys secring.gpg

I got a message that my file contains no valid data.

  • 1
    Does it help at all if you install gnupg1 and run gpg1 --list-secret-keys? Feb 28, 2018 at 7:29
  • @StephenKitt Just did that, also with gpg1 --list-secret-key there's no output! :-/ I only see the public keys with gpg2 and gpg1... Feb 28, 2018 at 7:30
  • OK, how big is ~/.gnupg/secring.gpg? Do you have anything in ~/.gnupg/private-keys-v1.d? (The former is used by GPG 1 and 2.0, the latter by GPG 2.1.) Feb 28, 2018 at 8:53
  • @StephenKitt there's nothing in private-keys-v1.d. Regarding secring.gpg I've to check but there should be only on key included. Here's the corresponding puplic key: uid H. Dieter Wilhelm (Emacsite) <[email protected]> pub 2048R/8A39DBAE 2013-08-07 Feb 28, 2018 at 10:02

1 Answer 1


GnuPG 2.1 no longer uses ~/.gnupg/secring.gpg; instead, it uses separate files in ~/.gnupg/private-keys-v1.d`, with the help of its agent. There should have been an automatic migration at some point, however there are a number of scenarios where that misses some information (including the case where a private key is added using GnuPG 1 after the 2.1 migration).

To resolve the issue, you should import your secret keyring:

gpg --import ~/.gnupg/secring.gpg

You’ll find more useful information in this handy GnuPG 2.1 migration guide, and in the release notes.

(I think it’s also worth mentioning that your secret keyring should never be exported to a public server, and that GnuPG itself will try to prevent you from doing so; thus you can’t rely on external sources of information as backups of your secret keys.)

  • Didn't you mean --import-secret-keys? Mar 1, 2018 at 9:29
  • I think --import is correct, GnuPG 2.1 doesn’t have an --import-secret-keys option any more — if you know better (e.g. if you tried --import, and it didn’t work, but --import-secret-keys did), I’d be grateful if you edited the answer accordingly! Mar 1, 2018 at 9:53
  • @Stepen Kitt thanks for the hint, it seems that gpg 2.1 is still accepting --import-secret-keys ;-). Maybe for a backward compatibility reasons... (My import attempts didn't work with neither options, obviously.) Mar 1, 2018 at 10:18
  • Oh I see, I hadn’t noticed your updated question :-/. A truncated secring.gpg is rather unexpected... Mar 1, 2018 at 13:48
  • The truncation must have been around my debian updgrade from 7 to 8. in 2015 since this time I didn't use encryption any longer and the key was created in 2013... Mar 1, 2018 at 14:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .