I'm using Debian-based Docker image, and I have only one usable key in the keyring:
$ gpg -K /tmp/test-keyring/pubring.kbx ------------------------------- sec> rsa2048 2012-01-16 [C] [expires: 2024-05-15] CB522FE0379DDF40A93400D7E4BC91FACDA9A65B Card serial no. = 00nn 00nnnnnn uid [ unknown] John Doe <firstname.lastname@example.org> ssb# rsa2048 2012-01-16 [S] [expires: 2024-05-14] ssb rsa3072 2012-01-16 [S] [expires: 2024-05-15]
As you can see here, there are three keys:
- Primary key tagged with
>resides on the smart card. It is marked as certify-only key, therefore it can't be used for signing.
- Private part for the second secondary signing key, tagged with
#, isn't present here. Therefore it can't be used for signing.
- Third secondary signing key has a private part available. This is the only key here that can be used for signing.
Again, last key here is the only key usable for signing purposes.
Alas, for some reason GnuPG fails to see it:
$ echo test | gpg --clearsign gpg: no default secret key: Unusable public key gpg: [stdin]: clear-sign failed: Unusable public key
Yet has no problem signing if I specify a user ID directly:
$ echo test | gpg --clearsign --default-key email@example.com gpg: using "firstname.lastname@example.org" as default secret key for signing -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 test -----BEGIN PGP SIGNATURE-----
The manual says it should be working out of the box:
--default-key name Use name as default user ID for signatures. If this is not used the default user ID is the first user ID found in the secret keyring.
I'm using GnuPG 2.2.19:
$ gpg --version gpg (GnuPG) 2.2.19 libgcrypt 1.8.5
I've applied a known Docker workaround with
GPG_TTY, to no avail.
What do I do to make it work?