email-extract-openpgp-certs(1)

📦
version 31 · 3 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

👑 email-extract-openpgp-certs — the email-extract-openpgp-certs(1) page, but make it cute ✨

okay bestie, sit down, hydrate, because this little tool is so useful and also so chaotic. it's from the User Commands section, it's a one-liner (literally, see below), and it will absolutely hand you a pile of OpenPGP certs straight out of an email. let's get into it 💅

🌸 NAME 🌸

email-extract-openpgp-certs — extract OpenPGP certificates from an e-mail 🦋

like. it goes into an email and it pulls out the certs. that's the whole vibe.

✨ SYNOPSIS ✨

email-extract-openpgp-certs <message.eml | gpg --import

that's it. that's the whole interface. pipe it in, pipe it out, and you're on your way to gpg --import. iconic behaviour honestly 👑

💖 DESCRIPTION 💖

so email-extract-openpgp-certs digs through an e-mail and extracts all the things it can find that look like they might be OpenPGP certificates, and then it produces them on standard output. it's giving "search party but for keys" 🔍

note the "might be" — we'll get to that in LIMITATIONS, and it is a whole thing, but for now: it finds stuff, it prints stuff. slay.

rn it currently knows about how to find OpenPGP certificates in two places:

  • as attachments of MIME type application/pgp-keys 📎
  • as Autocrypt: style headers 📨

that's the whole toolkit for now. no cap.

🎀 OPTIONS 🎀

None.

bestie there are literally no options. zero flags. no --help, no --verbose, no nothing. the tool said "I contain multitudes but not flags." periodt 💅✨

🌈 EXAMPLE 🌈

okay here's the iconic workflow, verbatim:

$ notmuch show --format-raw id:b7e48905-842f@example.net >test.eml
$ email-extract-openpgp-certs <test.eml | gpg --import

first you dump the raw message out of notmuch into test.eml, then you feed it straight into this tool and straight into gpg --import. no middleman, no temp files, no drama. it's giving pipeline main character energy 🫶

😭 LIMITATIONS 😭

okay bestie this is the part where we get real, because there is a lot here and you need to hear all of it.

  • email-extract-openpgp-certs currently does not try to decrypt encrypted e-mails, so it cannot find certificates that are inside the message's cryptographic envelope. if the cert is locked inside the encryption, this tool just... doesn't see it. it's not going in there. it's not that kind of tool 🙈
  • email-extract-openpgp-certs does not attempt to validate the certificates it finds in any way. it does not ensure that they are valid OpenPGP certificates, or even that they are of a sane size. it does not try to establish any relationship between the extracted certificates and the messages in which they are sent. for example, it does not check the Autocrypt addr= attribute against the message's From: header.
so like. it does zero vibe checks. it does zero fact checks. it will hand you a 400MB blob and a cert from a totally different person and be like "here you go bestie 💖". do not trust it to have done the thinking for you, because it has not. the thinking is your job.
  • Importing certificates extracted from an arbitrary e-mail in this way into a curated keyring is not a good idea. better to extract into an ephemeral location, inspect, filter, and then selectively import.
fr fr. do NOT dump random internet certs straight into your nice curated keyring. that keyring is a curated gallery, not a junk drawer. extract somewhere temporary, look at what you got, filter it, and only then import the ones you actually trust. trust the process, not the pipeline 😌

💜 SEE ALSO 💜

go read these too, bestie, they're the supporting cast:

🌟 AUTHOR 🌟

email-extract-openpgp-certs and this manpage were written by Daniel Kahn Gillmor, with guidance and advice from many others. shoutout to the whole committee, we love a collaborative effort 🫶

okay that's the whole page!! now go extract some certs, but remember: extract into ephemeral, inspect, filter, then import. that's the mantra. say it with me. 🧚

this lil writeup is living under perl v5.40.1 from the Debian Project — mwah, thanks for having us, catch you in the next manpage 💖🎀🦋

📦 where this page comes from