11

I have a keyid (648ACFD622F3D138) and keyserver: hkps://keyserver.ubuntu.com.

I can download the key and import it with something like: gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 648ACFD622F3D138.

But is it possible to only download the key as a file, without importing it in my keyring? Or, alternatively, is there a way to make gpg display info about the key (the same info as in gpg --list-keys)?

P.S.

Rationale: Before importing, I just would like to check its details.

DimanNe
  • 213

3 Answers3

7

You can accomplish this by setting the GNUPGHOME environmental variable to another directory, then receive keys to the alt keyring in it. None of the gpg actions you perform in the context of this alternate gnupg home will effect the keyring or any other data in your normal gnupg home.

The GNUPGHOME you set will remain in effect only for this terminal session. When you close the terminal window the gnupg home directory will revert to the default ~/.gnupg. You can either create a persistent directory to use for this or just create a temporary directory on the fly:

$ export GNUPGHOME=$(mktemp -d)

Now retrieve the key:

$ gpg --keyserver pool.sks-keyservers.net --recv-keys 648ACFD622F3D138

Now you can display the info for the imported key:

$ gpg -k 648ACFD622F3D138

And export the ascii-armored key file to your home directory.

$ gpg -ao ~/648ACFD622F3D138.asc --export 648ACFD622F3D138

Just close the terminal window when you're done using the temporary home directory. If you decide you want the key in your keyring, import it from the file you exported.

fuzzydrawrings
  • 737
3

here is one liner without contaminating the default keyring (as @OlofL) or create additional gpg home dir (as @fuzzydrawrings).

gpg --no-default-keyring --keyring /tmp/keyring.gpg --keyserver keyserver.ubuntu.com --recv-key 98E5A594422A7F7CEC7A5DCD1E9E66385D3E4D5D && gpg --no-default-keyring --keyring /tmp/keyring.gpg --output /tmp/test2.gpg --export

You can verify the key file content via gpg --show-keys test2.gpg

It utilizes the --no-default-keyring option to skip the default keyring database.

Then we tell it to create a new keyring file with --keyring. We receive/import key into it. Then we export all pub keys in the temporary keyring file.

You may want to delete the keyring file if you want to download multiple key files.

You can even use --recv-keys <fp1> <fp2> ... to download multiple keys into single file.

Wang
  • 842
2

This oneliner works. I don't think there is a way to import from keyserver directly to file in one command, so you have to chain a few commands.

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 648ACFD622F3D138 && \
gpg --export --armor 648ACFD622F3D138 > yourpubkey.gpg && \
gpg --batch --yes --delete-keys 648ACFD622F3D138

Tips: if you are doing this to import key into apt's trusted.gpg.d, remove the --armor keyword.

It will import key to default keyring, then it will export it to yourpubkey.gpg, and finally it will delete key from keyring.

OlofL
  • 51
  • 5