0

I signed the public key of bob@example.com with 3 of my identities. I did not use lsign so that the signature is exportable. The signatures are listed properly with

gpg --list-signatures bob@example.com

Now I want to send bob a mail including his key with my signature so that he can decide to upload it to his favorite key server, or not.

I tried to prepare the attachment

gpg --armor --export bob@example.com > bob.asc

I want to verify, that the file includes my signatures, but I can not see my signatures with

gpg --with-colons bob.asc

a) How do I properly export bob's key with my signatures to a file?

b) How can I verify the file afterwards?

1
# assuming gnupg-tmp is empty or non-existing
mkdir -p gnupg-tmp
gpg --homedir gnupg-tmp/ --import bob.asc your_key.asc
gpg --homedir gnupg-tmp/ --edit-key bob@example.com
clean
save
gpg --homedir gnupg-tmp/ --list-sigs bob@example.com

Importing the signing key and running --edit-key clen are not strictly necessary. Importing the key both makes the output more readable (but, of course, you could recognize or grep for your key ID, too) and allows clean to check your signature and removing all others.

You could use --list-packets directly on the exported file (i.e. without --homedir) but that may be confusing due to the number of signatures and the printed data and would not check the signatures.

  • Thank you. Could you add some more explanation, please? Why do I have to import your_key.asc? Is it correct, that this method will create a minimal copy of a keyring in order to keep the output of --list-sigs tidy? – Jonas Stein May 27 '18 at 15:57
  • @JonasStein Correct, that's what is does, among other things. – Hauke Laging May 27 '18 at 16:48
  • I could not see my signatures on bob's key. Does --armor --export not export the the signatures together with the public key? – Jonas Stein May 27 '18 at 17:31
  • @JonasStein --export ignores signatures which have been made with lsign. – Hauke Laging May 27 '18 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.