13

It's accident generated a bulk of secret keys (without public key) in the GPG key ring, and I have written a script to delete those keys, but GPG doesn't allow me to do that:

$ gpg --batch --yes --delete-secret-keys KEYS
gpg: can't do this in batch mod
gpg: (unless you specify the key by fingerprint)

well I know what I'm doing and I know there may be duplicated key-id(s), but there seems no way to force to delete them, though the following doesn't work, too:

$ yes | gpg --delete-secret-keys KEYS

Any idea?

4 Answers 4

8

Use gpg --list-secret-keys --with-colons --fingerprint to generate the list of fingerprints in an easily parsable format. Grab the lines of the form fpr:::::::::xxxx: that correspond to the keys you want to delete, and pass the fingerprints (the xxxx) to gpg --batch --delete-secret-keys.

The following command generates all secret key fingerprints. Be sure to select only the ones you want to delete!

gpg --list-secret-keys --with-colons --fingerprint | sed -n 's/^fpr:::::::::\([[:alnum:]]\+\):/\1/p'
4
  • Great! I thought the fingerprint is only available in public keys.
    – Lenik
    Aug 11, 2010 at 9:47
  • Oops! I'm wrong, the fingerprint couldn't be fetched from, the command yeilds: gpg: key XXXXXXXX: secret key without public key - skipped gpg: error reading key: secret key not availble In fact, I'm just wondering why `yes | ...' doesn't work, and I think the only way is patch on gpg. Thanks
    – Lenik
    Aug 11, 2010 at 9:56
  • This commands output 2 fingerprints. The subkey fingerprint is deleted when the "primary" is deleted. Maybe that's why you get that error?
    – ixe013
    Jul 14, 2020 at 20:00
  • Can I pipe into | xargs gpg --delete-key to delete all?
    – alper
    Jan 1, 2022 at 21:47
3

I know this topic is old, and that the answer kinda looks like Gilles one, but I think it answers the question totally (since I had the same kind of problems as OP) :

for i in `gpg --with-colons --fingerprint | grep "^fpr" | cut -d: -f10`; do gpg --batch --delete-secret-keys "$i" ; done
3
  • Does not work. Please check your syntax
    – MaXi32
    Sep 4, 2021 at 12:48
  • It works for me. What is your output?
    – Dolanor
    Jan 5, 2022 at 8:47
  • 1
    This works for me thanks for the command Jan 12, 2022 at 5:06
2

I combined the answers by Gilles and Dolanor into this one liner that is useful in case you want to delete a specific key:

gpg --fingerprint --with-colons ${GPG_KEY} |\
    grep "^fpr" |\
    sed -n 's/^fpr:::::::::\([[:alnum:]]\+\):/\1/p' |\
    xargs gpg --batch --delete-secret-keys

Not answering the original question, but might be useful for someone else.

2
  • But still we need to supply $GPG_KEY.
    – MaXi32
    Sep 4, 2021 at 12:49
  • Maybe use ${GPG_KEY:-hey-user-you-forgot-something-to-set} instead... ;-)
    – U. Windl
    Jan 28, 2023 at 22:00
1

Export the keys you want to keep, delete the file and then recreate your ring.

1
  • I'd rather prefer to patch & recompile gpg.
    – Lenik
    Aug 11, 2010 at 9:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .