2

I am attempting to extract the fingerprint from a GPG2 key. The fingerprint will then be passed to pass init $GPG2_FINGERPRINT for initialization

In the example below I want the fingerprint value 0126E6FFD15E33B8BCE7B748E79142F98581FC60.

$ gpg2 --list-signatures
pub   rsa2048 2021-10-14 [SCEA]
      0126E6FFD15E33B8BCE7B748E79142F98581FC60
uid           [ unknown] User 1 (User 1) <[email protected]>
sig 3        E79142F98581FC60 2021-10-14  User 1 (User 1) <[email protected]>
sub   rsa2048 2021-10-14 [SEA]
sig          E79142F98581FC60 2021-10-14  User 1 (User 1) <[email protected]>

When using --with-colons the subkey fingerprint is also returned. How can I get a clean output without the subkey info?

if I omit --list-keys and use --with-fingerprint instead I get pretty close... expect the warning is displayed: gpg: WARNING: no command supplied. Trying to guess what you mean. I can redirect the warning to get a clean output but I would rather use the correct command

Is there another way I can accomplish this? The end goal is to setup pass with a GPG key via scripting (no user interaction).

$ gpg2 --with-fingerprint --with-colons ./pubring.kbx
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub:-:2048:1:E79142F98581FC60:1634220843:::-:
fpr:::::::::0126E6FFD15E33B8BCE7B748E79142F98581FC60:
uid:::::::::User 1 (User 1) <[email protected]>:
sub:-:2048:1:213A9C4C15D3AAA9:1634220843::::

1 Answer 1

3

When using --with-colons the subkey fingerprint is also returned.

The option --with-colons is the correct choice as it emits output in machine parseable format.

How can I get a clean output without the subkey info?

I suggest piping it into awk. The output of --with-colons is standardized with each line having a data type in field 1. Any line with a data type of pub indicates the public key (as opposed to subkey) and the line that follows (data type fpr) contains the fingerprint string in field 10.

From this it becomes simple to parse the output with awk by scanning for the line(s) that begin with "pub:" and processing the fingerprint in field 10 from the line that follows.

For example, this will print all public key fingerprints on the keyring:

gpg --with-colons -k | awk -F: '/^pub:.*/ { getline; print $10}'

1
  • 1
    Technically, /^pub:.*/ is no different than /^pub:/, but that's a minor issue.
    – x-yuri
    Jun 8, 2022 at 7:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .