pubring.gpg I have two users with the same email address, but one of the entries is not valid anymore. How one can delete one of them?
This is explained by the "How to specify a user ID" manual page. Generally, you have several options to reference keys:
- by user ID
- by mail address as a part of user IDs (that's the one you tried to use but failed due to duplicates)
- by short key ID (that's whatyou proposed in your answer, but be aware short key IDs are vulnerable to collision attacks and should not be used)
- you long key ID (which is just a longer part of the fingerprint, and prevents collision attacks as described above)
by fingerprint, which is a hash sum of the key material:
The best way to specify a key Id is by using the fingerprint. This avoids any ambiguities in case that there are duplicated key IDs.
In your case, probably the short key ID is already fine as you would realize any duplicate short key IDs. You can use the key ID to reference a key exactly the same way you would use a mail address -- simply run
gpg --delete-keys <the-key-id>, same as you would with fingerprints (
gpg --delete-keys <fingerprint>). But maybe consider this a good opportunity to configure GnuPG to use long key IDs instead?
Finally, if one of the keys is not valid any more as defined by OpenPGP (expired, revoked), GnuPG will not pick it up for encryption any more anyway and you can safely keep it. If the maintainer just kept both of them (because he lost access to the secret keys, ...), you can of course delete it on your own. Be aware: you will not be able to verify old signatures any more after deleting the key!