Hot answers tagged

175

You need to add --import to the command line to import the private key. You need not use the --allow-secret-key-import flag. According to the man page: "This is an obsolete option and is not used anywhere." gpg --import private.key


140

Installing the package dirmngr fixed the error. user@debian-server:~$ sudo apt-get install dirmngr Retrying : user@debian-server:~$ sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF Executing: /tmp/apt-key-gpghome.haKuPppywi/gpg.1.sh --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys ...


117

This is usually caused by your firewall blocking the port 11371. You could unblock the port in your firewall. In case you don't have access to the firewall you could either: Force it to use port 80 instead of 11371 gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 94558F59 Alternatively Find and open the key from the key server. Copy it's ...


108

Private keys never expire. Only public keys do. Otherwise, the world would never notice the expiration as (hopefully) the world never sees the private keys. For the important part, there is only one way, so that saves a discussion about pros and cons. You have to extend the validity of the main key: gpg --edit-key 0x12345678 gpg> expire ... gpg> ...


89

Above is only a partial answer. Complete answer is: gpg --import private.key Given the KEYID (e.g FA0339620046E260) from the output: gpg --edit-key {KEY} trust quit # enter 5<RETURN> (I trust ultimately) # enter y<RETURN> (Really set this key to ultimate trust - Yes) OR use the automated command below: expect -c "spawn gpg --edit-key {KEY} ...


59

Ok, the gpg manual does not seem to mention these abbreviations. Thus, one has to look at the source. For example under Debian/Ubuntu: $ apt-get source gnupg2 $ cd gnupg2-2.0.17 $ cscope -bR $ grep 'usage: %' . -r --exclude '*po*' $ vim g10/keyedit.c jump to usage: % jump to definition of `usagestr_from_pk` From the code one can derive following table: ━━...


59

I am in your exact same boat (it worked on Fedora but not Ubuntu). Here is an apparent work around I discovered: echo your_password | gpg --batch --yes --passphrase-fd 0 your_file.gpg Explanation: Passing 0 causes --passphrase-fd to read from STDIN rather than from a file. So, piping the passphrase will get --passphrase-fd to accept your specified password ...


54

You usually have a proxy for ftp, http and https; I am seeing there hkp:// as an URL; so it should not be directed via a pure http proxy, hence failing the communication. Use this instead: sudo apt-key adv --keyserver keyserver.ubuntu.com --keyserver-options http-proxy=http://localhost:3128 --recv-keys BBEBDCB318AD50EC6865090613B00F1FD2C19886 As for the ...


45

For some reason or another I need to install the gnupg-curl to get SSL support over HKP: This package contains the keyserver helper tools built with libcurl, which replace the ones in the gnupg package built with the "curl shim" variant of gnupg. This package provides support for HKPS keyservers. Installing it solved the issue.


41

You should set yout GPG_TTY variable for it to work, as in this document: GPG_TTY=$(tty) export GPG_TTY Those two lines are supposed to be in your .bashrc (assuming bash), so they're run every time you open new terminal session. There's another solution, though: in bash you can run your pv and pretend it's a file, using process substitution: gpg -o file....


38

Upgraded 2017-12-04. (Adding --batch in order to prevent passphrase prompt) You may have to add --batch option: From version 2 of GPG, the option --batch is needed to ensure no prompt... Ok, looking that: $ gpg --version gpg (GnuPG) 2.1.18 libgcrypt 1.7.6-beta Copyright (C) 2017 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <...


38

Gpg-agent is a program that runs in the background (a daemon) and stores GPG secret keys in memory. When a GPG process needs the key, it contacts the running gpg-agent program through a socket and requests the key. If the agent process has the key, it provides it to gpg. If it doesn't, it attempts to load the encrypted key from your keyring, and prompts you ...


36

Looking at the versions reveals the problem: % gpg-agent --version gpg-agent (GnuPG) 2.1.7 % gpg --version gpg (GnuPG) 1.4.19 The components come from different packages (gnupg2-2.1.7-1.fc22.x86_64 and gnupg-1.4.19-2.fc22.x86_64 in my case). The solution is to use the gpg2 command instead of ...


33

You may not be able to do this, at least not yet, or at least not in the general case. However, I will share what I have learned, and look forward to updating this answer in due course. First of all, unlike the ssh-agent capability, which actually caches private keys, gpg-agent can cache either keys or passphrases. It is up to each client which to cache, ...


30

GNUPG has a trust database stored at ~/.gnupg/trustdb.gpg You can backup this trust database using the --export-ownertrust option: gpg --export-ownertrust > file.txt If you exported your secret keys and import them later into a new environment, the trust database is no longer present. However, this is easily remedied: gpg --edit-key user@useremail....


29

I use the following method, which works fairly well: 1) Store your passwords in separate gpg encrypted files. For example ~/.passwd/<accountname>.gpg 2) Create a python extension file with a name of your choosing (e.g., ~/.offlineimap.py), with the following contents: def mailpasswd(acct): acct = os.path.basename(acct) path = "/home/<username&...


29

How did you create the password store? pass init "Kelly's Passwords"? If so, this is wrong, you should have called pass init 64290B2D. And if then pass insert foo will fail with: gpg: fooo: skipped: public key not found gpg: [stdin]: encryption failed: public key not found then you have to trust your own key first (gpg --edit-key 64290B2D, trust, 5, save)....


28

Behind a firewall you should use the port 80 instead of the default port 11371 : sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 9A2FD067A2E3EF7B Sample output: Executing: /tmp/apt-key-gpghome.mTGQWBR2AG/gpg.1.sh --keyserver hkp://keyserver.ubuntu.com:80 --recv 9A2FD067A2E3EF7B gpg: key 9A2FD067A2E3EF7B: "Launchpad PPA for GNS3" not ...


26

For gpg version 2.x you don't need to use --batch, just --pinentry-mode loopback works with --passphrase & --passphrase-file, and will let you enter new info, in case of filename conflicts for example: gpg --pinentry-mode loopback --passphrase-file=file encrypted.gpg ... File 'encrypted' exists. Overwrite? (y/N)n Enter new filename: f2 unlike --...


24

To choose a default key without having to specify --default-key on the command-line every time, create a configuration file (if it doesn't already exist), ~/.gnupg/gpg.conf, and add a line containing default-key <key-uid> replacing <key-uid> with the key uid you want to use by default.


23

Store the passphrase in a file which is only readable by the cron job’s user, and use the --passphrase-file option to tell gpg to read the passphrase there. This will ensure that the passphrase isn’t visible in process information in memory. The level of security will be determined by the level of access to the file storing the passphrase (as well as the ...


22

You can make a UID appear at the top of the list by making it primary. The top UID then gets moved down to the second slot, and likewise, everything else shifts one space downward. It seems as though this "shift" only happens once you save the changes to the key. If you want to get the correct order, you need to repeat these steps starting with the UID you ...


22

Export Public Key This command will export an ascii armored version of the public key: gpg --output public.pgp --armor --export username@email Export Secret Key This command will export an ascii armored version of the secret key: gpg --output private.pgp --armor --export-secret-key username@email Security Concerns, Backup, and Storage A PGP public key ...


21

Did you delete the /home/me123/.gnupg directory and then it was recreated by gpg? If so, that's likely what is confusing the agent. Either restart the agent (gpgconf --kill gpg-agent) or, more drastically, reboot your machine and try again.


20

This is the result of running gpg with sudo: gpg then runs as root, but its home directory is still the user’s. This explains both the warning (gpg is running as root but another user owns the configuration directory) and dirmngr’s socket’s ownership. To fix this up, you should stop dirmngr: sudo gpgconf --kill dirmngr (sudo just this once because dirmngr ...


19

sudo gpg --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys SOMEKEY


19

apt-key adv will let you directly pass options to GnuPG. So you can do something like this to get parseable outpout: # apt-key adv --list-public-keys --with-fingerprint --with-colons ⋮ fpr:::::::::126C0D24BD8A2942CC7DF8AC7638D0442B90D010: pub:-:4096:1:9D6D8F6BC857C906:2014-11-21:2022-11-19::-:Debian Security Archive Automatic Signing Key (8/jessie) <...


19

I came across this exact issue (OSX Sierra 10.12.6, gpg/GnuPG 2.2.5) Commands that would hang: gpg -K # --list-secret-keys gpg -d # --decrypt gpg --edit-key gpgconf --kill gpg-agent My solution was the same as mentioned by John above (ie. kill gpg-agent) as most other methods on how-can-i-restart-gpg-agent would also hang. # Solution pkill -9 gpg-...


18

The keyid is the last 8 characters of the gpg key's fingerprint, which is that long hex-code under pub In your case it is: sudo apt-key del C9A97C2C Reference: How can I remove gpg key that I added using apt-key add -?


16

The layout of the --edit-key listing is not documented (not that I could find anyway). The abbreviations you mention however are, somewhere in the info pages (info gpg). I searched for S: and found that I actually wanted to search for usage:. In "GPG Key related Options": 4.2.1 How to change the configuration These options are used to change the ...


Only top voted, non community-wiki answers of a minimum length are eligible