Pull from CLI does not download remote private key

I am able to "Export my private key from keybase" from the browser at keybase.io.

**However, when I run from the command line, the private key is not stored locally by the command keybase pull** .

Steps followed:

Initial situation (my keybase private key is not stored locally):
$ **_gpg --list-secret-keys**_
/home/cualquiera/.gnupg/secring.gpg
sec 2048R/A12235C9 2014-07-05
uid MiNombre MiApellido (Mi comentario) abc@midireccion.com
ssb 2048R/F9978A6A 2014-07-05

I am logged in
$ **_keybase status**_
{
"status": {
"configured": true,
"logged_in": true
},
"user": {
"name": "cesarf",
"key": {
"key_id": "4D2543B4C617991B",
"fingerprint": "386C 2AD5 33E2 E020 70A9 F629 4D25 43B4 C617 991B"
},
"proofs": {
"twitter": "csrfdez"
},
"cryptocurrency": {
"bitcoin": "1Cxc1SAMApThhZ3wrqkv9cCvmTzww7Nf7p"
}
}
}

Important: Keybase pull does not detect my remote private key, so it does not download it
$ **_keybase -d pull**_
debug: + opening config file: /home/cualquiera/.config/keybase/config.json
debug: ++ loading config file /home/cualquiera/.config/keybase/config.json
debug: -- loaded config file -> {"user":{"name":"cesarf","salt":"103839888ba0259d60821e15438e612c","id":"63efb31fcb973099b16e7055de122619"}}
debug: - opened config file; found=true
debug: + testing GPG command-line client
debug: | using GPG command: gpg
debug: - tested GPG command-line client -> null
debug: Setting GPG_TTY=/dev/pts/0
debug: + Load proxy CAs
debug: - Loaded proxy CAs
debug: + startup message
debug: | CLI version: 0.8.20
debug: | Platform info: {"versions":{"http_parser":"1.0","node":"0.10.25","v8":"3.14.5.9","ares":"1.10.0","uv":"0.10.23","zlib":"1.2.8","modules":"11","openssl":"1.0.1f"},"arch":"x64","platform":"linux","features":{"debug":false,"uv":true,"ipv6":true,"tls_npn":true,"tls_sni":true,"tls":true}}
debug: | Version info: ["keybase (keybase.io CLI) v0.8.20","- node.js v0.10.25","- gpg (GnuPG) 1.4.16","- Copyright (C) 2013 Free Software Foundation, Inc.","Identifies as: 'keybase.io node.js client v0.8.20 linux'"]
debug: - startup message
debug: + opening database file: /home/cualquiera/.local/share/keybase/keybase.idb
debug: ++ DB::_init_db
debug: -- DB::_init_db -> 0
debug: - DB opened
debug: + session::load
debug: ++ opening config file: /home/cualquiera/.cache/keybase/session.json
debug: +++ loading config file /home/cualquiera/.cache/keybase/session.json
debug: --- loaded config file ->
debug: -- opened config file; found=true
debug: - session::load
debug: + session::check
debug: | calling to sesscheck
debug: ++ request to sesscheck (https://api.keybase.io:443/_/api/1.0/sesscheck.json) (cookie=true)
debug: || Adding a custom CA for host api.keybase.io when tls=true
debug: -- request to sesscheck -> null
debug: - session::check
debug: + KeyPull::run
debug: ++ KeyPull::load_user
debug: +++ cesarf: load user
debug: ++++ cesarf: load user from local storage
debug: +++++ load sig chain from local storage
debug: ||||| loading sig chain w/ payload hash 36461e811a0e4739f76706b259fc203e7921df86dd9ea4daf0ada42b83a78e07
debug: ++++++ 63efb31fcb973099b16e7055de122619: load signature chain
debug: |||||| 63efb31fcb973099b16e7055de122619: Loading link 36461e811a0e4739f76706b259fc203e7921df86dd9ea4daf0ada42b83a78e07
debug: |||||| -> found link and previous; prev=ffd583e48a87b93d64e4503614eed10a840e50e600f0a9dfccb09f4047eac8ea
debug: |||||| 63efb31fcb973099b16e7055de122619: Loading link ffd583e48a87b93d64e4503614eed10a840e50e600f0a9dfccb09f4047eac8ea
debug: |||||| -> found link and previous; prev=f89291a7b511376ea8a8d4d6fde1f4fa8ca37e7e9a6dbd91811d4f2e96787223
debug: |||||| 63efb31fcb973099b16e7055de122619: Loading link f89291a7b511376ea8a8d4d6fde1f4fa8ca37e7e9a6dbd91811d4f2e96787223
debug: |||||| -> found link and previous; prev=null
debug: ------ 63efb31fcb973099b16e7055de122619: loaded signature chain
debug: ----- loaded sig chain from local storage
debug: ---- cesarf: loaded user from local storage -> null / [object Object]
debug: ||| Checking session since we're loading User as self (and need secret key)
debug: ++++ session::load_and_check
debug: +++++ session::check
debug: ||||| calling to sesscheck
debug: ++++++ request to sesscheck (https://api.keybase.io:443/_/api/1.0/sesscheck.json) (cookie=true)
debug: |||||| Adding a custom CA for host api.keybase.io when tls=true
debug: ------ request to sesscheck -> null
debug: ----- session::check
debug: ---- session::load_and_check -> true
debug: ++++ cesarf: load user from server
debug: +++++ merkle find_and_verify: uid undefined, username cesarf
debug: ++++++ request to merkle/path (https://api.keybase.io:443/_/api/1.0/merkle/path.json?uid=&username=cesarf) (cookie=true)
debug: |||||| Adding a custom CA for host api.keybase.io when tls=true
debug: ------ request to merkle/path -> null
debug: ++++++ merkle get_merkle_pgp_key
debug: |||||| Call to gpg: { args: [ '-k', '--with-fingerprint', '--with-colons' ],
debug: quiet: true,
debug: no_options: true }
debug: |||||| merkle key already found in keyring
debug: ------ merkle get_merkle_pgp_key
debug: ||||| Load key /2A32340CEC8C9492 from master keyring (secret=undefined)
debug: ||||| Call to gpg: { args:
debug: [ '--export',
debug: '--export-options',
debug: 'export-local-sigs',
debug: '-a',
debug: '2A32340CEC8C9492' ] }
debug: ++++++ lookup UID
debug: +++++++ read_uids_from_keys 03E146CDAF8136680AD566912A32340CEC8C9492
debug: ||||||| Call to gpg: { args:
debug: [ '-k',
debug: '--with-fingerprint',
debug: '--with-colons',
debug: '03E146CDAF8136680AD566912A32340CEC8C9492' ],
debug: quiet: true,
debug: no_options: true }
debug: ||||||| got: [{"username":"Keybase.io Merkle Signing","comment":"v1","email":"merkle@keybase.io"}]
debug: ------- read_uids_from_key -> null
debug: - Map 2A32340CEC8C9492 -> [object Object] via gpg
debug: ------ looked up UID
debug: ++++++ Rollback check
debug: |||||| DB put value kv:e2:57fbe771d11d6f2c194eb7bca052df4547aa6cf9664f986face4d8129792576c1f129caca64fba4720878df362924e82f3ec3ecd2a92291fbea8a12e62f14964
debug: |||||| DB put lookup: lo:5:latest -> 7a087488c7e77a9fd4b8da77f25445c81b049431d8c962009fd849ff11387c3b
debug: ------ Rollback check
debug: ||||| id_version (3) and seqno (3) haven't changed.
debug: ++++++ cesarf: verifying signatures
debug: +++++++ cesarf: verifying sig
debug: ++++++++ libkeybase: replay(username: cesarf, uid: 63efb31fcb973099b16e7055de122619, eldest: 0101904401af2dc18f9b0881ce1b43e93089f0b18b41eed6081c23489f414e5638680a)
debug: |||||||| libkeybase: replaying signature 1: e06b4f5d421df9010865953c93db6941de6d23629ddbdf5454c7d66a2cf9f3c00f
debug: |||||||| libkeybase: chain link parsed, type 'cryptocurrency'
debug: |||||||| libkeybase: signing key is valid (0101904401af2dc18f9b0881ce1b43e93089f0b18b41eed6081c23489f414e5638680a)
debug: |||||||| libkeybase: replaying signature 2: 0111578a439bad697e28e74bddf469c8c614fea7b54a211c5cb5ad66c7eb010d0f
debug: |||||||| libkeybase: chain link parsed, type 'web_service_binding'
debug: |||||||| libkeybase: signing key is valid (0101904401af2dc18f9b0881ce1b43e93089f0b18b41eed6081c23489f414e5638680a)
debug: |||||||| libkeybase: replaying signature 3: fae8e50ab20e4eb0aae8ca5e43a12a9f7486abdec5b49f30be3e5ee7b1f939f50f
debug: |||||||| libkeybase: chain link parsed, type 'track'
debug: |||||||| libkeybase: signing key is valid (0101904401af2dc18f9b0881ce1b43e93089f0b18b41eed6081c23489f414e5638680a)
debug: -------- libkeybase: replay finished
debug: ++++++++ compressing signature chain
debug: +++++++++ Cryptocurrency::insert_into_table e06b4f5d421df9010865953c93db6941de6d23629ddbdf5454c7d66a2cf9f3c00f
debug: --------- Cryptocurrency::insert_into_table e06b4f5d421df9010865953c93db6941de6d23629ddbdf5454c7d66a2cf9f3c00f
debug: +++++++++ RemoteProof::insert_into_table
debug: --------- RemoteProof::insert_into_table
debug: +++++++++ Track::insert_into_table fae8e50ab20e4eb0aae8ca5e43a12a9f7486abdec5b49f30be3e5ee7b1f939f50f
debug: --------- Track::insert_into_table fae8e50ab20e4eb0aae8ca5e43a12a9f7486abdec5b49f30be3e5ee7b1f939f50f (uid=f3e8d1f602a9c103fa0fc794b79b1b19)
debug: -------- signature chain compressed
debug: ------- cesarf: verified sig
debug: ------ cesarf: verified signatures
debug: ++++++ cesarf: storing signature chain
debug: ------ cesarf: stored signature chain
debug: ----- cesarf: loaded user
debug: +++++ cesarf: check public key
debug: ||||| Call to gpg: { args:
debug: [ '-K',
debug: '--with-colons',
debug: '386c2ad533e2e02070a9f6294d2543b4c617991b' ],
debug: quiet: true }

**_warn: gpg: error reading key: secret key not available**_

debug: ----- cesarf: check_public_key: ret={"remote":false,"local":false}; err=null
debug: +++++ cesarf: check public key
debug: ||||| Call to gpg: { args:
debug: [ '-k',
debug: '--with-colons',
debug: '386c2ad533e2e02070a9f6294d2543b4c617991b' ],
debug: quiet: true }
debug: ----- cesarf: check_public_key: ret={"remote":true,"local":true}; err=null
debug: Check key secret: {"remote":false,"local":false}
debug: Check key public: {"remote":true,"local":true}
debug: ---- KeyPull::load_user -> null 0
debug: --- KeyPull::run

So as it is expected, If I want to decrypt something sent to me:
$ cat msg003.txt | keybase decrypt
**error: can't perform secret-key action without a secret key**

Workaround:
I have imported directly my private key with the gpg command. The private.key file contains my private key at keybase.io which I have downloaded with the browser and selecting "Export my private key from Keybase" in https://keybase.io

$ **_gpg --allow-secret-key-import --import private.key**_
gpg: key C617991B: secret key imported
gpg: key C617991B: "keybase.io/cesarf cesarf@keybase.io" not changed
gpg: Total number processed: 1
gpg: unchanged: 1
gpg: secret keys read: 1
gpg: secret keys imported: 1

With the workaround, my private key at keybase is stored in GPG
$ **gpg --list-secret-keys**
/home/cualquiera/.gnupg/secring.gpg
sec 2048R/A12235C9 2014-07-05
uid MiNombre MiApellido (Mi comentario) abc@midireccion.com
ssb 2048R/F9978A6A 2014-07-05

sec 4096R/C617991B 2015-09-24
uid keybase.io/cesarf cesarf@keybase.io
ssb 2048R/AFA7850E 2015-09-24
ssb 2048R/47D9EA82 2015-09-24

At this moment, I can decrypt the message with keybase decrypt

$ **_cat msg003.txt | keybase decrypt**_

You need a passphrase to unlock the secret key for
user: "keybase.io/cesarf cesarf@keybase.io"
2048-bit RSA key, ID CAADC677AFA7850E, created 2015-09-24
(subkey on main key ID 4D2543B4C617991B)

You need a passphrase to unlock the secret key for
user: "keybase.io/cesarf cesarf@keybase.io"
2048-bit RSA key, ID CAADC677AFA7850E, created 2015-09-24
(subkey on main key ID 4D2543B4C617991B)

nuevo mensaje, este lo envio en un fichero para que no lo toquen los sistemas de email ... a ver que tal

info: Valid signature from keybase user appapp (tracking remotely & locally)
info: Signed about 15 hours ago (Thu Sep 24 2015 20:33:24 GMT+0200 (CEST))
✔ public key fingerprint: E618 BC54 49ED 7133 DF8D 79F1 8C89 E2D4 38F5 A877
✔ "appapp000" on twitter: https://twitter.com/appapp000/status/646599734166224896
✔ "appapp" on github: https://gist.github.com/0f130c8bbb0aae06302d
✔ "app__app" on reddit: https://www.reddit.com/r/KeybaseProofs/comments/3m3foz/my_keybase_proof_redditapp_app_keybaseappapp/

The reported entry point is `keybase pull`, with GPG checks shown in the debug output; reproduce the missing-secret-key case and trace how pull decides whether a remote key is available. Done means a successful pull stores the remote private key in GPG so `keybase decrypt` works without manual import, with regression coverage for the reported case.

Written by the indexing model from the issue text.