Private key with no expiration can't be found about gopass HOT 9 CLOSED

Using a script to automate a relevant web of trust with all possible validity values, I have confirmed that gopass init will show you the keys with ultimate, full or marginal validity and NOT those with unknown or undefined validity

validity is computed based on a combination of signing trust, signing distance and signing count while trust is manually set by the keyring owner.

The only trust value that will automatically update the validity of itself is ultimate
So if you have imported your key (from keybase for example) then you must edit the trust value so the validity can be computed accordingly.

Also note the following :

• Generated keys (gpg --gen-key) will always have a ultimate validity, because the trust value is automatically set to ultimate
• Imported keys (gpg --import) will almost everytime have an unknown validity, because the trust value is unknown. If the key is yours, it must be edited (gpg --edit-key [email protected] trust quit), if it's not yours but want the system to consider it valid, it must be signed (gpg --edit-key [email protected] lsign quit)

TLDR

There is NO issue here.
Just trust your imported key so it is considered valid

from gopass.

Sorry for taking so long to reply I've only just found a chance to try again. I couldn't get it working by generating a key with the defaults. However, I modified the key with gpg --edit-key as per @frntn screencast and its now working perfectly. Thanks for your time.

from gopass.

Hello,

I stumbled upon this bug too.
After some tests, I believe the issue is on the key validity [1] [2].
Here is an asciinema record to show some valid and invalid tust/validity : https://asciinema.org/a/5g77rduux3c9tc801potfc54k?autoplay=1&speed=7

TLDR :

• unknown/unknown => NOT OK
• full/unknown => NOT OK
• ultimate/ultimate => OK

I haven't tried all possible trust/validity combinations because it requires complex scenario with multiple signing identities.
Hope this helps anyway.

from gopass.

hmm. I just created and then edited a key to have no expiration date. So far it works for me, without any issues whatsoever. Maybe a few more details on how to reproduce this would be helpful, thanks!

from gopass.

To the best of my understading we are correctly handling trust/validity of keys.

For GPG to accept a recipients public key it must at least have marginal validity. If you import a secret key it has no validity. See 1 and 2.

I've tried to reproduce the issue using your (very cool!) screencast, but for using an exported/imported secret key with ultimate/unknown worked perfectly well.

from gopass.

Yes this may just be a documentation issue.

How did you manage to get ultimate/unknown ?
Everytime I ultimately trusted a key, validity was automatically set to ultimate too...

from gopass.

Great summary, thank you!

from gopass.

Awesome, thanks for sharing your solution.

from gopass.

#960 (comment)

from gopass.