0

Under Debian 8 I created (presumably, then with gpg 1 or 2.0) and published my key secring.gpg to a keyserver, the file is still under the directory ~/.gnupg/. But now with gpg 2.1:

gpg --list-secret-keys

has no output and attempts to sign something

gpg -s tmp.txt

fail with

gpg: no default secret key: secret key not available
gpg: signing failed: secret key not available

Did I botch somehow the upgrade from Debian 8 to 9? Should I have exported the secret key before upgrading and how can I import the "old" secret key into the "new" gpg?

update 2018-03-01:

The problem is simply that - somehow, sometime - my secring.gpg shrank to the size 0! :-/ Discovered it with the solution from Stephen Kitt, when trying to import

gpg --import-secret-keys secring.gpg

I got a message that my file contains no valid data.

  • 1
    Does it help at all if you install gnupg1 and run gpg1 --list-secret-keys? – Stephen Kitt Feb 28 '18 at 7:29
  • @StephenKitt Just did that, also with gpg1 --list-secret-key there's no output! :-/ I only see the public keys with gpg2 and gpg1... – Dieter.Wilhelm Feb 28 '18 at 7:30
  • OK, how big is ~/.gnupg/secring.gpg? Do you have anything in ~/.gnupg/private-keys-v1.d? (The former is used by GPG 1 and 2.0, the latter by GPG 2.1.) – Stephen Kitt Feb 28 '18 at 8:53
  • @StephenKitt there's nothing in private-keys-v1.d. Regarding secring.gpg I've to check but there should be only on key included. Here's the corresponding puplic key: uid H. Dieter Wilhelm (Emacsite) <dieter@duenenhof-wilhelm.de> pub 2048R/8A39DBAE 2013-08-07 – Dieter.Wilhelm Feb 28 '18 at 10:02
2

GnuPG 2.1 no longer uses ~/.gnupg/secring.gpg; instead, it uses separate files in ~/.gnupg/private-keys-v1.d`, with the help of its agent. There should have been an automatic migration at some point, however there are a number of scenarios where that misses some information (including the case where a private key is added using GnuPG 1 after the 2.1 migration).

To resolve the issue, you should import your secret keyring:

gpg --import ~/.gnupg/secring.gpg

You’ll find more useful information in this handy GnuPG 2.1 migration guide, and in the release notes.

(I think it’s also worth mentioning that your secret keyring should never be exported to a public server, and that GnuPG itself will try to prevent you from doing so; thus you can’t rely on external sources of information as backups of your secret keys.)

  • Didn't you mean --import-secret-keys? – Dieter.Wilhelm Mar 1 '18 at 9:29
  • I think --import is correct, GnuPG 2.1 doesn’t have an --import-secret-keys option any more — if you know better (e.g. if you tried --import, and it didn’t work, but --import-secret-keys did), I’d be grateful if you edited the answer accordingly! – Stephen Kitt Mar 1 '18 at 9:53
  • @Stepen Kitt thanks for the hint, it seems that gpg 2.1 is still accepting --import-secret-keys ;-). Maybe for a backward compatibility reasons... (My import attempts didn't work with neither options, obviously.) – Dieter.Wilhelm Mar 1 '18 at 10:18
  • Oh I see, I hadn’t noticed your updated question :-/. A truncated secring.gpg is rather unexpected... – Stephen Kitt Mar 1 '18 at 13:48
  • The truncation must have been around my debian updgrade from 7 to 8. in 2015 since this time I didn't use encryption any longer and the key was created in 2013... – Dieter.Wilhelm Mar 1 '18 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.