keybase / keybase/client

Inability to Specify Signing Subkey and GPG Executable

Open
#10,005 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

When running keybase I got it failed during login. I also had the problem when using Shell scripts commands, but that time I was able to adjust gpg command to make it work.

I have my gpg already setup and I do not want to change it. I have my primary key 0x8F39C8EFBC979206 and then I have per-device signing subkeys 0xB934E523A84176B6 and 0x3C8E71A1993CAC24:

pub rsa4096/0x8F39C8EFBC979206 2017-01-15 [SC] [expires: 2020-01-15]
...
sub rsa4096/0xB934E523A84176B6 2017-12-20 [S] [expires: 2018-12-20]
sub rsa4096/0x3C8E71A1993CAC24 2017-12-20 [S] [expires: 2018-12-20]

I do not want to use the primary key very often. I mostly use it for key certification and encryption (sporadically). Each computer is using subkey and specifies local-user in gpg.conf, so gpg knows what to use when signing:

keyid-format 0xlong
local-user 0x3C8E71A1993CAC24!

The problem is that keybase (at least the shells scripts proposed on the web) pass '-u' variable to gpg when calling, in my case that would be:

-u 8F39C8EFBC979206

and for that case gpg asks me to insert the primary key smartcard instead of using local subkey available (maybe it is also gpg's problem as it probably should be able to recognize that primary id have locally specified subkey that is available).

In addition to that, like on the default Ubuntu installation I have both gpg and gpg2 installed. And I need to use gpg2 only because my key size is longer than 2048.

Not sure what is exactly wrong with logging in into the keybase in this specific case, but I think there should be a way to specify which exact gpg executable to use and also a way customize "-u" parameter value to specify the exact signing subkey to use.

my log id: 867825b9745651085d907e1c

Contributor guide

No contributing guide indexed for this repository

Research direction

No files or tests are named. Start by tracing the Keybase login path that invokes GPG, then inspect how the executable and signing identity are selected. Done means login can use a configured GPG executable and an exact signing subkey without requiring the primary key.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.