1

GnuPG 2.1 has the nice feature unattendded key-signing. However, its matching seems to be somewhat fuzzy. E.g, if I have two user IDs like 'Foo' and 'Foo Bar' on a key with fingerprint FPR, gpg --quick-sign key FPR Foo will sign both. Can I force it to do exact matching?

1 Answer 1

0

Originally, GnuPG has different notions to specify substring matches, exact matches, matching mail addresses and so on, which I also discussed in How to get GnuPG fingerpints only for specified key name, not for substring matches?.

From my experiments, those do not work for --quick-sign-key (in your case, you should be able to select the specific user ID using the selector ='Foo', which at least does not work for user IDs containing whitespace). This seems a bad limitation of GnuPG, which in my opinion even makes this command unusable for its intended purpose, as you cannot reliably select specific user IDs any more. I'd recommend opening a bug report for this.

3
  • I gave bad examples. Gnupg actually won't accept Foo cuz that's too short. However, supposing I have Voldemort and Voldemort, the Dark Lord. My gpg2.1 (git master) won't accept =Voldemort and Voldemort will sign both of the uids. I had tried it before as the manpage somewhat indicates = might force exact matching and now I've reconfirmed (with another example setup) that it doesn't in this case. Apr 12, 2016 at 21:17
  • Sadly, I can't uid hashes (as shown with -k --with-colons) don't work either . Apr 12, 2016 at 21:23
  • If there is a way, it clearly lacks documentation. I wasn't aware of the user ID hashes yet, but I also haven't been able to use them.
    – Jens Erat
    Apr 12, 2016 at 21:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .