2

I need help with GnuPG commands related to building a web of trust.

  1. How can I add five different signatures I received to my public key before uploading it to a key server?
  2. And, a similar, question: How can I combine 5 signed versions of my public key into one file? I would like to have one key-file that contains all five signatures.
2

I assume you already did some key signing and imported the signatures into GnuPG. If so, by exporting the key using gpg -a --export [key-id] you also include all signatures to that key. This is both valid for your own and also other's keys.

Also, both key servers and GnuPG actually combine all signatures when receiving them; so if others upload their signatures for your key, all of them will be stored together.


Given you're not having any signatures yet, find somebody to sign it. Possible ways to do so would be going to a key signing party, having a look at biglumber.com or visiting some Linux/Unix user group in your town (often, there are OpenPGP-users in there).

You could also create keys on your own and use them to sign your "main key", but there's no use in doing so, you're not getting any closer to the web of trust.

|improve this answer|||||
  • 1
    Thank you Jens for your explanation. You said: "Also, both key servers and GnuPG actually combine all signatures when receiving them; so if others upload their signatures for your key, all of them will be stored together." This is exactly what I was trying to learn about, but did not know how to word it. How can I combine signatures from different people. Suppose I send my public key to Alice, Bob, Eric,Frank, and Gary. They all sign my key and send it back to me. Now I have 5 files each containing my key with one signature. How do I combine these signatures? – Vivarto Jan 25 '14 at 13:43
  • 1
    You received one file from each of them. Now you do gpg --import signature.asc (whatever the file name is) to import each of them, and then either gpg -a --export [key-id] > key.asc to export the key and upload it manually, or directly gpg --send-key [key-id] to upload it. In Windows, you might have to use gpg.exe instead of gpg. – Jens Erat Jan 25 '14 at 14:06
  • 1
    Thank you again. It is now becoming more clear. Just wanted to make sure if in your example "signature.asc" is a regular public key. If so, then apparently we just import the signed public even if we already have it (unsigned) in the ring, and the GPG will combine the signatures. Righ? – Vivarto Jan 26 '14 at 1:31
  • 1
    It doesn't matter if signature.asc also includes your key. OpenPGP implementations will look at each data package in that file, check if they already know it, and otherwise import it. If your public key is already known, it will be ignored -- but the unknown signature package will be imported anyway. – Jens Erat Jan 26 '14 at 7:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.