I'm getting a few friends to sign my key. Each time they've signed my key, if they send the signed key to a key server, when I try to get the signatures with gpg --refresh-keys --keyserver some.keyserver, my key is unchanged, I don't see their signatures. The same thing happens if I use gpg --recv-keys. They've tried three different servers. However, if they If they email me my key, or I look up my key on the keyserver's web interface and copy the text, then I import it, I see their signatures on my key. Does anyone have an idea as to why this might be happening or what I'm doing wrong?
Add a comment
|
2 Answers
You need to import their signatures into your key. They aren't supposed to send it to the keyservers themselves.
The process looks like this:
- Create a GPG signature (you've already done this)
- Publish your signature
gpg --send-key 12345678ABCDEF12
- Make a physical copy of your fingerprint. Print the output of this onto your business card or print out a bunch of them on one sheet and chop it up.
gpg -v --fingerprint 12345678ABCDEF12
Go to a key-signing party. Meet people, have fun, and hand out your physical fingerprint to people. Often people should ask you for ID so they can verify that your name is really the same name as what's on the GPG key.
The people you've met will use the physical fingerprint you gave them to download your published key from the key-server. They will check character by character that the physical copy you gave them matches what's on the server.
If they are satisfied, they'll gpg --sign your signature, then export it (and preferably encrypt it too). Then they email the result to you.
gpg --recv-keys 12345678ABCDEF12
gpg --fingerprint 12345678ABCDEF12
gpg --sign-key 12345678ABCDEF12
gpg --armor --export 12345678ABCDEF12 | gpg --encrypt -r 12345678ABCDEF12 --armor --output 12345678ABCDEF12-signedBy-112233445566778899.asc
- You will receive the signature by email. You'll first need to decrypt it (this is another check that you really own the signature) if it was encrypted, then you will
gpg --importtheir signature into your own key, and publish the results:
gpg -d 12345678ABCDEF12-signedBy-112233445566778899.asc | gpg --import
gpg --send-key 12345678ABCDEF12
-
That is exactly what we're doing since I can't get the new signatures when I use gpg to get the key from a keyserver. The only step we're missing is encrypting the key before it's sent back to me (although I get why we should be doing this - it ensures that the signed key is only imported by someone who has the private key). I am still curious about why I don't see the signatures if I use gpg to get the signed key from the server, despite the fact that the keyserver has them (because the key that I get from the web interface has the signatures).– user465929Apr 9, 2021 at 15:36
Stewart answer is correct when you are dealing with signatures exchanged with your friends. But if you just want to import signatures from other keys you'll get into the same problem. gpg (in e.g. Debian 11) drops all non-self-signatures. If you need to import/refresh signatures on the keys from server try to use the following commandline argument: --keyserver-options no-self-sigs-only
