GPG
Tools
GPG keys backup
https://www.howtogeek.com/816878/how-to-back-up-and-restore-gpg-keys-on-linux/ https://gock.net/blog/2020/gpg-cheat-sheet
GPG: GNU Privacy Guard
$ tree ~/.gnupg
/home/archie/.gnupg
├── common.conf
├── gpg-agent.conf
├── gpg.conf
├── openpgp-revocs.d
│ └── 5D58F91F8C34E8E26A8F96C6D56175D4B81A264C.rev
├── private-keys-v1.d
│ ├── D9E02B82115D70EFC105E43A6DA87FBAA70289FB.key
│ └── E97714F4E8DD2BE5917628DE053831FB1B116A55.key
├── public-keys.d
│ ├── pubring.db
│ └── pubring.db.lock
├── pubring.kbx
└── trustdb.gpg
- openpgp-revocs.d: This subdirectory contains your revocation certificate. You'll need this if your private key ever becomes common knowledge or otherwise compromised. Your revocation certificate is used in the process of retiring your old keys and adopting new keys.
- private-keys-v1.d: This subdirectory stores your private keys.
- pubring.kbx: An encrypted file. It contains public keys, including yours, and some metadata about them.
- pubring.kbx~: This is a backup copy of "pubring.kbx." It is updated just before changes are made to "pubring.kbx."
- trustdb.gpg: This holds the trust relationships you have established for your own keys and for any accepted public keys belonging to other people.
Files should be backup
https://www.gnupg.org/documentation/manuals/gnupg/GPG-Configuration.html
gpg.conf
pubring.kbx
not backup up trustdb.gpg, but should export owertrust use 'gpg --export-ownertrust > otrust.txt'
openpgp-revocs.d/
Determining Which Keys to Back Up
$ gpg --list-secret-keys --keyid-format LONG
[keyboxd]
---------
sec ed25519/D56175D4B81A264C 2024-06-21 [SC] [expires: 2025-06-21]
5D58F91F8C34E8E26A8F96C6D56175D4B81A264C
uid [ultimate] tianheg <i@tianheg.co>
ssb cv25519/D8D0FDE0A5C69978 2024-06-21 [E] [expires: 2025-06-21]
- The "sec" (secret) line shows the number of bits in the encryption (4096 in this example), the key ID, the date the key was created, and "[SC]." The "S" means the key can be used for digital signatures and the "C" means it can be used for certification.
- The next line is the key fingerprint.
- The "uid" line holds the ID of the key's owner.
- The "ssb" line shows the secret subkey, when it was created, and "E." The "E" indicates it can be used for encryption.
Backing Up
Public keys
$ gpg --export --export-options backup --output public.gpg
$ gpg --export --export-options backup --output public.gpg email # backup someone
Private keys
$ gpg --export-secret-keys --export-options backup --output private.gpg
Ownertrust
$ gpg --export-ownertrust > otrust.txt
Setup gpg key on a new PC
$ gpg --import public.gpg
$ gpg --import private.gpg
$ gpg --import-ownertrust otrust.txt
Encrypt these files and upload to cloud
https://linuxconfig.org/how-to-create-compressed-encrypted-archives-with-tar-and-gpg
# gnupg/otrust.txt
# gnupg/private.gpg
# gnupg/public.gpg
$ tar -cvzf - gnupg | gpg -c --batch --passphrase-fd 0 --passphrase-file passwd.txt > gnupg.tar.gz.gpg
upload the gnupg.tar.gz.gpg file to cloud
GPG failed to sign the data
error: gpg failed to sign the data:
[GNUPG:] KEY_CONSIDERED A47EAD5ACA5C2017C81149F834B5D16A1EE7FAB9 2
[GNUPG:] BEGIN_SIGNING H10
gpg: signing failed: Permission denied
[GNUPG:] FAILURE sign 67141633
gpg: signing failed: Permission denied
Above came from git commit -m "", when signing with GPG
Fix it with gpgconf --kill gpg-agent