MIGRATE-PU...LASSIC-GPG(1)

💖 MIGRATE-PU...LASSIC-GPG(1) 💖

General Commands Manual 🎀

✨ NAME ✨

okay so this tool is migrate-pubring-from-classic-gpg, and its whole job is moving a public keyring from the "classic" GnuPG format to the "modern" one 🔥

🦋 SYNOPSIS 🦋

migrate-pubring-from-classic-gpg [ GPGHOMEDIR | --default ]

🌸 DESCRIPTION 🌸

bestie, migrate-pubring-from-classic-gpg takes the public keyring in your GnuPG home directory GPGHOMEDIR and upgrades it from the old "classic" format (pubring.gpg) to the "modern" keybox format (pubring.kbx). This works with GnuPG versions 2.1 or 2.2 and it's giving glow-up 💅

Passing --default tells it to use the standard GnuPG home directory instead. It checks $GNUPGHOME first, and if that isn't set it falls back to ~/.gnupg ✨

🎀 OPTIONS 🎀

• -h, --help, --usage — shows a short usage message, so you can check the vibe before you do anything 🙈

🫶 DIAGNOSTICS 🫶

ngl the program is a bit chatty 😭 It sends quite a lot of text (maybe too much) to stderr.

During a migration it also backs up several pieces of your data into a timestamped subdirectory of GPGHOMEDIR. Safety first, periodt 💜

🚫 LIMITATIONS 🚫

the keybox format is picky and rejects a bunch of OpenPGP certificates that the classic keyring used to accept 💀

These filters are there on purpose, because the certificates getting rejected are unsafe. They're either cryptographically unsound or dangerously non-performant. So yes, some migrations will throw warnings saying the migration is incomplete. Honestly that's generally a good thing! 🌈

⭐ Known limitations ⭐

🌊 Flooded certificates

Some OpenPGP certificates got flooded with bogus certifications as part of an attack on the SKS keyserver network. You can read more about it at https://tools.ietf.org/html/draft-dkg-openpgp-abuse-resistant-keystore-03#section-2.1.

The keybox format refuses to import any OpenPGP certificate larger than 5 MiB. As of GnuPG 2.2.17, if gpg runs into one of these flooded certificates, it will retry the import while stripping all third-party certifications (see "self-sigs-only" in gpg(1)).

If you migrate a keyring with a flooded certificate, the error will look something like this:

error writing keyring 'pubring.kbx': Provided object is too
large

🍓 OpenPGPv3 public keys (a.k.a. PGP-2 keys)

Modern OpenPGP implementations use "OpenPGP v4" public keys. The older public key format has serious known problems, so v3 is deprecated. If you want the tea on why, check https://tools.ietf.org/html/rfc4880#section-5.5.2.

The keybox format skips v3 keys entirely during migration, and GnuPG will tell you something like this:

skipped PGP-2 keys: 1

🧚 ENVIRONMENT VARIABLES 🧚

• GNUPGHOME — picks the GnuPG home directory, but only when --default is given 🗝️
• GPG — the name of the gpg executable. It defaults to gpg 💜

🔗 SEE ALSO 🔗

gpg(1) is the one to read next, trust me 👑

🌈 AUTHOR 🌈

Copyright (C) 2016 Daniel Kahn Gillmor for the Debian project. Found a bug? Report it via the Debian BTS 🐛

---

That's the whole manual, bestie! 🎀 Written for the April 2016 release of MIGRATE-PU...LASSIC-GPG(1) 💅✨