Inability to Specify Signing Subkey and GPG Executable
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- PR merge metrics
- PR metrics pending
Description
When running keybase I got it failed during login. I also had the problem when using Shell scripts commands, but that time I was able to adjust gpg command to make it work.
I have my gpg already setup and I do not want to change it. I have my primary key 0x8F39C8EFBC979206 and then I have per-device signing subkeys 0xB934E523A84176B6 and 0x3C8E71A1993CAC24:
pub rsa4096/0x8F39C8EFBC979206 2017-01-15 [SC] [expires: 2020-01-15]
...
sub rsa4096/0xB934E523A84176B6 2017-12-20 [S] [expires: 2018-12-20]
sub rsa4096/0x3C8E71A1993CAC24 2017-12-20 [S] [expires: 2018-12-20]
I do not want to use the primary key very often. I mostly use it for key certification and encryption (sporadically). Each computer is using subkey and specifies local-user in gpg.conf, so gpg knows what to use when signing:
keyid-format 0xlong
local-user 0x3C8E71A1993CAC24!
The problem is that keybase (at least the shells scripts proposed on the web) pass '-u' variable to gpg when calling, in my case that would be:
-u 8F39C8EFBC979206
and for that case gpg asks me to insert the primary key smartcard instead of using local subkey available (maybe it is also gpg's problem as it probably should be able to recognize that primary id have locally specified subkey that is available).
In addition to that, like on the default Ubuntu installation I have both gpg and gpg2 installed. And I need to use gpg2 only because my key size is longer than 2048.
Not sure what is exactly wrong with logging in into the keybase in this specific case, but I think there should be a way to specify which exact gpg executable to use and also a way customize "-u" parameter value to specify the exact signing subkey to use.
my log id: 867825b9745651085d907e1c
Contributor guide
No contributing guide indexed for this repository
Research direction
No files or tests are named. Start by tracing the Keybase login path that invokes GPG, then inspect how the executable and signing identity are selected. Done means login can use a configured GPG executable and an exact signing subkey without requiring the primary key.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100