# GPG

### GPG keys backup

https://www.howtogeek.com/816878/how-to-back-up-and-restore-gpg-keys-on-linux/ https://gock.net/blog/2020/gpg-cheat-sheet

GPG: GNU Privacy Guard

```bash
$ tree ~/.gnupg
/home/archie/.gnupg
├── common.conf
├── gpg-agent.conf
├── gpg.conf
├── openpgp-revocs.d
│   └── 5D58F91F8C34E8E26A8F96C6D56175D4B81A264C.rev
├── private-keys-v1.d
│   ├── D9E02B82115D70EFC105E43A6DA87FBAA70289FB.key
│   └── E97714F4E8DD2BE5917628DE053831FB1B116A55.key
├── public-keys.d
│   ├── pubring.db
│   └── pubring.db.lock
├── pubring.kbx
└── trustdb.gpg
```

- openpgp-revocs.d: This subdirectory contains your revocation certificate. You'll need this if your private key ever becomes common knowledge or otherwise compromised. Your revocation certificate is used in the process of retiring your old keys and adopting new keys.
- private-keys-v1.d: This subdirectory stores your private keys.
- pubring.kbx: An encrypted file. It contains public keys, including yours, and some metadata about them.
- pubring.kbx~: This is a backup copy of "pubring.kbx." It is updated just before changes are made to "pubring.kbx."
- trustdb.gpg: This holds the trust relationships you have established for your own keys and for any accepted public keys belonging to other people.

#### Files should be backup

https://www.gnupg.org/documentation/manuals/gnupg/GPG-Configuration.html

```
gpg.conf
pubring.kbx
not backup up trustdb.gpg, but should export owertrust use 'gpg --export-ownertrust > otrust.txt'
openpgp-revocs.d/
```

#### Determining Which Keys to Back Up

```bash
$ gpg --list-secret-keys --keyid-format LONG
[keyboxd]
---------
sec   ed25519/D56175D4B81A264C 2024-06-21 [SC] [expires: 2025-06-21]
      5D58F91F8C34E8E26A8F96C6D56175D4B81A264C
uid                 [ultimate] tianheg <i@tianheg.co>
ssb   cv25519/D8D0FDE0A5C69978 2024-06-21 [E] [expires: 2025-06-21]
```

- The "sec" (secret) line shows the number of bits in the encryption (4096 in this example), the key ID, the date the key was created, and "[SC]." The "S" means the key can be used for digital signatures and the "C" means it can be used for certification.
- The next line is the key fingerprint.
- The "uid" line holds the ID of the key's owner.
- The "ssb" line shows the secret subkey, when it was created, and "E." The "E" indicates it can be used for encryption.

#### Backing Up

##### Public keys

```bash
$ gpg --export --export-options backup --output public.gpg
$ gpg --export --export-options backup --output public.gpg email # backup someone
```

##### Private keys

```bash
$ gpg --export-secret-keys --export-options backup --output private.gpg
```

##### Ownertrust

```bash
$ gpg --export-ownertrust > otrust.txt
```

#### Setup gpg key on a new PC

```bash
$ gpg --import public.gpg
$ gpg --import private.gpg
$ gpg --import-ownertrust otrust.txt
```

#### Encrypt these files and upload to cloud

https://linuxconfig.org/how-to-create-compressed-encrypted-archives-with-tar-and-gpg

```bash
# gnupg/otrust.txt
# gnupg/private.gpg
# gnupg/public.gpg
$ tar -cvzf - gnupg | gpg -c --batch --passphrase-fd 0 --passphrase-file passwd.txt > gnupg.tar.gz.gpg
```

upload the gnupg.tar.gz.gpg file to cloud

### GPG failed to sign the data

```bash
error: gpg failed to sign the data:
[GNUPG:] KEY_CONSIDERED A47EAD5ACA5C2017C81149F834B5D16A1EE7FAB9 2
[GNUPG:] BEGIN_SIGNING H10
gpg: signing failed: Permission denied
[GNUPG:] FAILURE sign 67141633
gpg: signing failed: Permission denied
```

Above came from git commit -m "", when signing with GPG

Fix it with `gpgconf --kill gpg-agent`


相关：[[keep-my-ssh-keys-safe|keep-my-ssh-keys-safe]]