keybase / keybase/keybase-issues

Primary key ist not selected properly using bash+GPG+curl

Open
#1,193 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

I've tried proving a few things using the bash/GPG/curl option. But the generated script would _not_ use my primary GPG key for signing but a signing subkey (S, not C!) I have in my keyring too. In this case a simple

```
gpg -u "$MASTERKEYID" --sign
```

will silently select the _subkey_ for signing. In order to really force the primary key this command will do by adding an `!` to the id:

```
gpg -u "$MASTERKEYID!" --sign
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Search the generated bash/GPG/curl script for the use of MASTERKEYID and inspect how the signing command selects a key. Confirm the behavior with a keyring containing a primary key and signing subkey, then verify that signing explicitly targets the primary key.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash
Domain
cli, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.