-
Notifications
You must be signed in to change notification settings - Fork 855
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
unable to force specific gpg subkey #1365
Comments
I ran into this specific issue yesterday! I have multiple subkeys for different devices so need a way to specify them. It seems to me like the behavior should be to try the long key first and fall back to shortening (or even just have users in those environments manually specify short ids). @hiddeco do you have more detail on which versions of gpg would barf on long fingerprints? |
I also ran into this problem. |
If shortening fingerprints, the trailing '!' from subkey fingerprints is removed, and the wrong key is selected later on, potentially resulting in just-created secrets not being decryptable. Fixes getsops#1365
If shortening fingerprints, the trailing '!' from subkey fingerprints is removed, and the wrong key is selected later on, potentially resulting in just-created secrets not being decryptable. Fixes getsops#1365 Signed-off-by: tilpner <git@tilpner.com>
If shortening fingerprints, the trailing '!' from subkey fingerprints is removed, and the wrong key is selected later on, potentially resulting in just-created secrets not being decryptable. Fixes getsops#1365 Signed-off-by: tilpner <git@tilpner.com>
If shortening fingerprints, the trailing '!' from subkey fingerprints is removed, and the wrong key is selected later on, potentially resulting in just-created secrets not being decryptable. Fixes getsops#1365 Signed-off-by: tilpner <git@tilpner.com>
situation
I use sops to manage secrets for my projects, all using GPG for encryption.
I have a GPG master key with several encryption subkeys:
I just recently added the desktop and work subkeys, and am hoping to be able to configure sops to encrypt my secrets with all of these subkeys so that I can recover in the eventuality that I lose the YubiKey.
state of the world
As far as I understand:
As a result, it isn't possible to tell sops to use a specific key fingerprint, since for a keyid like
0123456789ABCDEF!
, sops will produce123456789ABCDEF!
, which is rejected by gpg as malformed.In my case, this means that everything sops encrypts that points at my gpg key can be encrypted only with my work encryption key, as it's the newest.
proof of concept
The following patch solves this problem for me and lets me specify an exclamation-mark fingerprint to sops:
proposed upstream
In
shortenFingerprint
, special-case strings with terminal!
, chopping the string to 17 characters rather than 16, retaining the full key and the!
. If amenable, I could PR this.related
#808
The text was updated successfully, but these errors were encountered: