source files for
git clone git://
Log | Files | Refs

gpg-sync-all-pub-keys.xml (4803B)

      1 <?xml version="1.0" encoding="utf-8"?>
      2 <article data-sblg-article="1">
      3 	<header>
      4 		<h1>Updating All Public Keys in GPG</h1>
      5 		<time datetime="2019-07-16">July 16, 2019</time>
      6 	</header>
      7 	<p>GPG and other OpenPGP implementations aren’t well known for their ease of use <sup><a class="footnote" href="#fn1" id="fnref1">1</a></sup> and the general view among many professional cryptographers <sup><a class="footnote" href="#fn2" id="fnref2">2</a></sup> is that the entire ecosystem is a dud, to be replaced with more modern, specialised tools. Even when signing/encrypting emails⁠—the thing it was designed for, mind⁠—GPG is a letdown.</p>
      8 	<p>Recently, <code>mutt</code> alerted me that the public key for a mailing list user had expired. I sent a friendly message letting them know, and received this in return:</p>
      9 	<blockquote>
     10 		<p>What keyserver did you pull from? I pushed a new expiry date at least a month ago.</p>
     11 	</blockquote>
     12 	<p>So even though I set GPG to auto-download keys, it won’t update them. Rather than wade through GPG’s option list, I decided it would be simpler to just extract a list of public keys and feed that to <code>--recv-keys</code>:</p>
     13 	<code>
     14 <pre class="chroma"><span class="cp">#!/bin/sh</span>
     15 <span class="cp"/><span class="c1"># The command expansion outputs a "machine readable" list of public keys</span>
     16 gpg --recv-keys <span class="k">$(</span>gpg --keyid-format long --list-public-keys --with-colons <span class="p">|</span>
     17                   grep <span class="s1">'^fpr'</span> <span class="p">|</span> cut -d <span class="s1">':'</span> -f <span class="m">10</span> <span class="k">)</span></pre>
     18 	</code>
     19 	<p>Smugly, I dropped this in my <code>scripts</code> folder and called it a day. Then I bothered to look at the gpg(1) manpage and found that there was in fact an option for this:</p>
     20 	<blockquote>
     21 		<dl>
     22 			<dt>--refresh-keys</dt>
     23 			<dd>Request updates from a keyserver for keys that already exist on the local keyring. This is useful for updating a key with the latest signatures, user IDs, etc. Calling this with no arguments will refresh the entire keyring.</dd>
     24 		</dl>
     25 	</blockquote>
     26 	<p>This experience has made me question why I put up with this UI hell. My interactions with GPG are limited to email encryption/signing (sparingly) and file encryption via <a href="">password-store</a>. I used to sign all my commits too like a good boy, before realising that nobody really checks them (especially not from little ol’ me). Recently I’ve moved secure communications to <a href="">Signal</a> <em>because</em> of its simplicity over PGP. If Filippo can get around to releasing his <a href="">age</a> tool, then I could finally dispose of this broken ecosystem and fully transition to modern, simpler crypto.</p>
     27 	<hr/>
     28 	<p>Update: I’ve reflected on this post a bit, and decided to remove the links to my PGP key on my website. I fully believe that PGP is fundamentally broken, and intend to revoke my PGP key when age is released.</p>
     29 	<section class="footnotes" role="doc-endnotes">
     30 		<p>References:</p>
     31 		<ol>
     32 			<li id="fn1" role="doc-endnote">
     33 				<p>Take your pick:</p>
     34 				<ul>
     35 					<li>
     36 						<a href="">Why Johnny Can’t Encrypt</a>
     37 					</li>
     38 					<li>
     39 						<a href="">Why Johnny Still Can’t Encrypt</a>
     40 					</li>
     41 					<li>
     42 						<a href="">Why Johnny Still, Still Can’t Encrypt</a>
     43 					</li>
     44 					<li>
     45 						<a href="">“Johnny, you are fired!”</a>
     46 					</li>
     47 				</ul>
     48 				<a class="footnote-back" href="#fnref1">↩</a>
     49 			</li>
     50 			<li id="fn2" role="doc-endnote">
     51 				<p>Ditto:</p>
     52 				<ul>
     53 					<li>
     54 						<a href="">Matthew Green⁠—What’s the matter with PGP?</a>
     55 					</li>
     56 					<li>
     57 						<a href="">Moxie Marlinspike⁠—GPG And Me</a>
     58 					</li>
     59 					<li>
     60 						<a href="">Bruce Schneier⁠—Giving Up on PGP</a>
     61 					</li>
     62 					<li>
     63 						<a href="">Filippo Valsorda⁠—I’m throwing in the towel on PGP</a>
     64 					</li>
     65 					<li>
     66 						<a href="">Filippo Valsorda⁠—OpenPGP Is Broken</a>
     67 					</li>
     68 				</ul>
     69 				<a class="footnote-back" href="#fnref1">↩</a>
     70 			</li>
     71 		</ol>
     72 	</section>
     73 </article>