I have two key files keys1.asc and keys2.asc exported from my keyring, each containing several PGP public keys. What is the easiest way to merge them into a single file?
One way that leads to the result, though probably not the easiest one:
% mkdir temp
% gpg --homedir temp --import keys1.asc keys2.asc
% gpg --homedir temp --armor --export >keys.asc
% rm -r temp
Related
I'm trying to take a public key and add it to /etc/apt/trusted.gpg.d/, but I'm getting an incompatibility issue.
I run:
gpg --no-default-keyring --keyring /etc/apt/trusted.gpg.d/example.gpg --import file.asc
Which works.
But then when I use apt-key list it says the key is incompatible.
Looking at the file types, my example.gpg is of type GPG keybox database version 1, where as the other apt keys are of type GPG key public ring.
How do I get gpg to generate a GPG key public ring rather than a keybox?
I know that this is old, but since I spent some time finding a solution, I am going to share it.
GnuPG has always been a pain, when it comes to automation and there doesn't seem to be a way, to make it use the old keyring v4 format.
However it can be done by re-exporting the key. Here an ugly one-liner with the MariaDB repo as an example:
# cd /etc/apt/trusted.gpg.d/ && wget -q -O - https://mariadb.org/mariadb_release_signing_key.asc | \
gpg --no-default-keyring --keyring=$(pwd)/mariadb.gpg --batch --import - && \
gpg --no-default-keyring --keyring=$(pwd)/mariadb.gpg --batch --output $(pwd)/mariadb.gpg~ --export --yes && \
mv $(pwd)/mariadb.gpg~ $(pwd)/mariadb.gpg; chmod 644 $(pwd)/mariadb.gpg
This can be done much easier with apt-key and its --keyring option (tested on Debian Buster 10.7).
$ wget -q -O - https://mariadb.org/mariadb_release_signing_key.asc | \
sudo apt-key --keyring /etc/apt/trusted.gpg.d/mariadb.gpg add -
If you look at the apt-key script you will find something similar to the one-liner above (but probably more robust).
Note that apt-key will complain and fail, if you use the suffix .asc instead of .gpg for the trusted file. That seems to be a bug, that can be avoided with a previous touch on the file.
I also recently stumbled across this issue, and after digging into the source code, I found pretty much the perfect solution.
You can just specify the keyring format with a prefix, so gnupg-ring: or gnupg-kbx:. In your case, the command would be:
gpg --no-default-keyring --keyring gnupg-ring:/etc/apt/trusted.gpg.d/example.gpg --import file.asc
I want to create a shell script and I haven't worked with it before.
There is a command for gpg:
gpg --keyserver SERVER --recv-keys KEY
The problem is that I don't want to run this command if key has been already added. Is there any method to check that key exists in keys list?
Thank you!
Run gpg --list-keys [key-id] (or the abbreviated command -k), which will have a return code of 0 (success) if a matching key exists, or something else (failure) otherwise. Don't list all keys and grep afterwards as proposed by others in the comments, this will get horribly slow for larger numbers of keys in the keyring. Run
gpg --list-keys [key-id] || gpg --keyserver [server] --recv-keys [key-id]
to fetch missing keys, possibly discarding the first gpg call's output (gpg --list-keys [key-id] >/dev/null 2>&1 || ...), as you're only interested in the return code.
Be aware that
updating keys from time to time might be a reasonable thing to do to fetch revocations
especially short key IDs should never be used, use the whole fingerprint if possible.
You can do:
[[ $(gpg --list-keys | grep -w KEY) ]] && echo "Key exists" ||
gpg --keyserver SERVER --recv-keys KEY
Additional (for apt keyring):
[[ $(apt-key list | grep -w KEY) ]] && echo "Key exists" ||
gpg --keyserver SERVER --recv-keys KEY
If apt-key is available
The correct way to do it is running the following command
gpg --keyserver hkp://keyserver.ubuntu.com -k [your-key-id]
I want to create an auto GnuPG key generation script for one person atm who, although they run ubuntu, does not feel comfortable using the CLI. In addition, someone else manages their computer, keeping it up to date and in good running order, so they do not have root/sudo access either. And I would really like to try and avoid doing as much as possible with instructions over the phone... been there too many times to know what a PITA that can be!
So I whipped up this script borrowing heavily from an example I found on the gnupg.org forums (I think?). But it does not seem to do anything once the gpg --gen-key --batch command is run no matter how much mouse activity is generated in 3 or 4 minutes. All the echo statements btw are just a temporary means to indicate script progress, which isn't very far atm.
#!/bin/bash
# First run give your server some work, otherwise gpg won't be able to generator random bytes.
#sudo rngd -r /dev/urandom
#no sudo so:
echo -e "\nYou need to begin moving your mouse continuously and in random patterns for as long as it takes to generate a new key. This could take a minute or two, so be patient and just keep moving the mouse.\n"
echo -e "\ngpg --gen-key --batch\n"
gpg --batch --gen-key
%echo Generating a default key
Key-Type: default
Key-Length: 2048
Subkey-Type: default
Name-Real: Firstname Lastname
Name-Comment: No comment
Name-Email: user#domain.com
Expire-Date: 0
Passphrase: abcde
%pubring foo.pub
%secring foo.sec
# Do a commit here, so that we can later print "done" :-)
%commit
%echo done
# kill the rngd task.
#sudo service rng-tools stop
echo -e "\ngpg -k\n"
gpg -k
# get key id for newly created passkey
echo -e "\nkId=$(gpg -k Firstname|grep pub|sed -r 's/^pub[ ]*2048R\/([A-Z0-9]{8,})[ ]*.*$/\1/')\n" #; echo "\$kId: ${kId}"
kId=$(gpg -k Firstname|grep pub|sed -r 's/^pub[ ]*2048R\/([A-Z0-9]{8,})[ ]*.*$/\1/') ; echo -e "\n\$kId: ${kId}\n"
# set key as the default key (if desired) by entering this line in your ~/.bashrc
echo -e "\nexport GPGKEY=$kId\n"
export GPGKEY="$kId"
# restart the gpg-agent and source your .bashrc again
echo -e "\nkillall -q gpg-agent\n"
killall -q gpg-agent
eval $(gpg-agent --daemon)
source ~/.bashrc
#create revocation cert
echo -e "\ngpg --output revoke.asc --gen-revoke $GPGKEY\n"
gpg --output revoke.asc --gen-revoke $GPGKEY
# send public key to keyserver
echo -e "\ngpg --send-keys --keyserver keyserver.ubuntu.com $GPGKEY\n"
#gpg --send-keys --keyserver keyserver.ubuntu.com $GPGKEY
I wonder if anyone can see any obvious problems or omissions feeding 'gpg' required key details?
I get the same thing even if I run the script with the sudo rngd -r /dev/random command that I need to bypass for the intended user (no sudo access).
So I guess the prob is in the key params I want to pass to gpg, but I have cross referenced them with the man page and can't seem to find what the problem might be. It is funny though that gpg does not return the error.
With batch key generation, GnuPG expects the creation commands in a file, compare with the GnuPG manual page on batch key generation.
cat <<EOT >batch-cmds
%echo Generating a default key
Key-Type: default
Key-Length: 2048
Subkey-Type: default
Name-Real: Firstname Lastname
Name-Comment: No comment
Name-Email: user#domain.com
Expire-Date: 0
Passphrase: abcde
%pubring foo.pub
%secring foo.sec
# Do a commit here, so that we can later print "done" :-)
%commit
%echo done
EOT
gpg --batch --gen-key batch-cmds
Consider the security implications of storing the passwords in a file on the hard disk. I'm not sure if you can also pipe the contents directly into GnuPG instead of storing them to a file. Try something like this:
gpg --batch --gen-key <<EOT
%echo Generating a default key
Key-Type: default
Key-Length: 2048
Subkey-Type: default
Name-Real: Firstname Lastname
Name-Comment: No comment
Name-Email: user#domain.com
Expire-Date: 0
Passphrase: abcde
%pubring foo.pub
%secring foo.sec
# Do a commit here, so that we can later print "done" :-)
%commit
%echo done
EOT
I have several hundred gpg encrypted files in a directory, of the format filename.xyz.gpg where "xyz" is some arbitrary extension. I need to decrypt all of the files to generate filename.xyz decrypted in such a way that I don't have to manually enter the password for each file.
I have tried the following for directory "Testing":
for file in 'ls Testing'; do (echo <password>|gpg --passphrase-fd 0 -d $file
--output $file.decrypted);
I just wind up with a command prompt >, and nothing happens.
What is the matter with my syntax? Is there some more efficient way to do this without a bash shell loop?
gpg can decrypt multiple files so you shouldn't need to write a loop.
Try the following. You will need to enter your password once.
gpg --passphrase-fd 0 --decrypt-files *.gpg
As it is said in the manual you need to add --batch option:
--passphrase-fd n
Read the passphrase from file descriptor n. Only the first line will be read from file descriptor n. If you use 0 for n, the passphrase will be read from
STDIN. This can only be used if only one passphrase is supplied. Note that this passphrase is only used if the option --batch has also been given. This is
different from gpg.
--passphrase string
Use string as the passphrase. This can only be used if only one passphrase is supplied. Obviously, this is of very questionable security on a multi-user sys‐
tem. Don't use this option if you can avoid it. Note that this passphrase is only used if the option --batch has also been given. This is different from
gpg.
You can have either of these two forms:
echo "passphrase" | gpg --passphrase-fd 0 --batch -d --output "decrypted.file" "file.gpg"
Or simpler:
gpg --passphrase "passphrase" --batch -d --output "decrypted.file" "file.gpg"
You can try a script like this to extract your files:
#!/bin/bash
read -rsp "Enter passphrase: " PASSPHRASE
for FILE in *.*.gpg; do
echo "Extracting $FILE to ${FILE%.gpg}."
echo "$PASSPHRASE" | gpg --passphrase-fd 0 --batch -d --output "${FILE%.gpg}" "$FILE"
done
I had success with
gpg --decrypt-files *.gpg
cf. https://serverfault.com/a/388068/103585
I had success with gpg --decrypt-files *
but not *.gpg
It worked with below commands for me:
For single file:
gpg --decrypt --input C:\PGPFiles\[encryptedfilename.pgp] --passphrase [yourpassphrase]
For multiple files:
gpg --decrypt --input C:\PGPFiles\* --passphrase [yourpassphrase]
How can I write data to stdout instead of writing file?
I'm using GPG and want to print encrypted text to stdout, without saving files.
However, with gpg command, encrypted text is written to file in ordinary way:
$> gpg --recipient someone#example.com --armor --output encrypted.txt --encrypt example.pdf
(With above command, encrypted file is saved in encrypted.txt)
What I want to do is like following:
$> gpg --recipient someone#example.com --armor --output <STDOUT> --encrypt example.pdf
and encrypted messages are shown in console.
I don't want to save hard disk to avoid loss of performance.
Usually you use "-" to specify stdout, but not all commands accept this and I don't about gpg.
For example:
tar -cvzf - foo/ ¦ split -b 50k foobar_
will pipe the "tar-file" to stdout, split it and save to "foobar_<123...>".
If your application does not support '-' as a filename (and it should) then an alternative is to use a named pipe, although I'll admit this looks like using a sledgehammer to crack a nut:
pipe='/tmp/pipe'
mkfifo "$pipe"
gpg --recipient someone#example.com --armor --output "$pipe" --encrypt example.pdf &
while read
do
echo "$REPLY"
done < $pipe
rm "$pipe"
Based on the gnupg manual
Simply omit the --output.